Privacy Policy

Overview

This policy explains what personal information MURO collects when you make a reservation, how we use it, and how we keep it safe.

This policy is published in accordance with the Digital Personal Data Protection Act, 2023, and with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent those remain in force.

Information We Collect

When you make a reservation, we collect only what is necessary to manage your booking:

• Name
• Mobile number
• Email address
• Dietary preferences and food allergies
• Celebration or occasion details (if provided)
• Number of guests in your party

How We Use Your Information

Your information is used exclusively for the following purposes:

• Confirming and managing your reservation
• Communicating booking updates, reminders, and confirmations
• Noting dietary requirements and allergies for your safety
• Personalising your experience on future visits

We will not use your information for marketing communications without your explicit consent.

Payment Data & Security

All payments are processed by Razorpay, a PCI DSS-compliant payment gateway. MURO does not store, process, or have access to your card number, CVV, or any other sensitive payment credentials.

Razorpay's privacy policy governs the handling of your payment data.

Data Retention

We retain your reservation details and guest profile for as long as necessary to provide our services and comply with applicable law.

You may ask us to delete your data at any time. When you do, your name, email address and phone number are removed straight away and the rest of what we hold about you — your profile, your messages and anything you have told us — is deleted 90 days later.

Records we are required to keep, such as invoices for payments you have made, are retained for as long as the law requires. They no longer identify you: your name and number are removed from them.

Third Parties

We do not sell, rent, or trade your personal information. Beyond our own team, it reaches the following service providers, and only for the purpose named:

• Razorpay — Name, phone number, booking reference and amount. Taking the advance payment. Card details go to Razorpay directly and never reach MURO.
• Interakt — Phone number, name and booking details. Sending booking confirmations, reminders and one-time passcodes on WhatsApp.
• Meta Platforms (WhatsApp) — Phone number and the content of WhatsApp messages. Carrying those messages — every WhatsApp message passes through Meta.
• SmartPing — Phone number and the passcode itself. Sending the one-time passcode by SMS when WhatsApp is unavailable.
• Amazon Web Services (Bedrock, Mumbai and Hyderabad) (only if you use the AI assistant) — The content of your conversation with the assistant. Answering questions and taking bookings in chat — conversation content, processed in India.
• Restroworks (only where the restaurant has connected its point-of-sale system) — Bill details and the phone number on the bill. Matching your visit to your bill.
• Our hosting provider — Everything above, at rest. Running the servers and the database. Hosted in India.

Each of them may use your data only to provide that service to us, and not for their own purposes.

Where Your Data Goes

Your data is stored in India. Some of the services above process it outside India, because that is where they operate:

• Meta Platforms (WhatsApp) — Phone number and the content of WhatsApp messages

Sending your data to them is permitted under the Digital Personal Data Protection Act, 2023. If you would rather we did not, you can book by telephone instead and we will not message you on WhatsApp.

Your Rights & Contact

You have the right to access, correct, or request deletion of the personal information we hold about you. To make a request or raise a privacy concern, please contact us at reservations@muroindia.com.