Privacy Policy

Lhasa CRM is an internal tool used by The Lhasa Lounge to manage bookings, customer relationships, marketing campaigns, inventory, finance, and communications. This policy explains what data we process, why we process it, and the rights available to individuals whose data is held in the system.

We collect information that is necessary to operate the restaurant and serve our guests, including:

• Contact details: name, phone number, email address, and company or team name.
• Booking and event information: preferred dates, party size, occasion, dietary preferences, budget, and event history.
• Messaging data: WhatsApp conversations, campaign sends, open/click events, and message delivery status.
• Social data: Facebook, Instagram, and Google Business interactions where connected for publishing or review management.
• Operational data: inventory purchases, supplier records, employee payroll, financial transactions, and business table entries.
• Technical data: IP address, browser type, device information, cookies, and usage logs.

Lhasa CRM connects to Meta services (Facebook, Instagram, WhatsApp) and Google Business Profile to help us manage social presence, respond to guest messages, and run marketing campaigns.

• WhatsApp: We receive incoming messages, profile names, and message delivery status through the WhatsApp Cloud API. We use this data to respond to inquiries, confirm bookings, and send service updates or marketing messages where consent has been given.
• Facebook and Instagram: When connected, we may publish content, read comments, and access post insights. We do not sell follower data or use it for unrelated advertising.
• Permissions: We only request the permissions necessary to operate these integrations. Access tokens are encrypted at rest and refreshed in accordance with each provider’s security guidelines.

We use the data we collect for the following purposes:

• Confirming, managing, and following up on bookings and events.
• Responding to guest inquiries via WhatsApp, email, or social channels.
• Running internal marketing campaigns with consent.
• Managing inventory, vendors, and restaurant finances.
• Generating operational reports and business intelligence.
• Improving service quality and training staff.
• Complying with legal, accounting, and tax obligations.

Lhasa CRM is built on Lovable Cloud with Supabase as the underlying database. Data is stored in secure, encrypted data centers. We apply the following security measures:

• Row-level security (RLS) policies to restrict data access to authorised staff.
• Role-based access controls (RBAC) for sensitive modules such as finance, payroll, and marketing.
• Encrypted storage of access tokens, credentials, and payment-related information.
• HTTPS for all data transmitted between the application and backend.
• Regular backups and audit logging for critical data changes.

No system is completely secure. We continually review our security practices and respond promptly to any suspected breach.

Lhasa CRM uses a small number of trusted third-party services to operate. These providers act as data processors and are contractually bound to handle data only for the purposes we define:

• Lovable Cloud / Supabase: hosting, database, and authentication.
• Meta (Facebook, Instagram, WhatsApp): messaging, social publishing, and advertising.
• Google: Google Sheets sync, Google Business Profile, and OAuth authentication.
• OpenAI: natural language generation for guest responses, content suggestions, and inventory bill scanning.
• Email and notification providers: for transactional messages and staff alerts.

We use cookies and similar technologies to keep you signed in, remember preferences, and understand how the application is used. Cookies may include:

• Essential cookies: required for authentication and core functionality.
• Analytics cookies: help us improve the product anonymously.
• Provider cookies: set by Meta or Google when using OAuth or embedded content.

You can manage cookies through your browser settings. Disabling essential cookies may prevent you from logging in.

We keep data only for as long as it is needed for the purpose it was collected, or as required by law. Retention periods vary by data type:

• Guest and lead data: retained while active and for a reasonable period afterwards to support repeat business and marketing preferences.
• Financial and payroll records: retained for the statutory period required by Indian tax and labour law.
• Marketing unsubscribes: retained indefinitely to honour suppression requests.
• Log and audit data: retained for security and compliance purposes, then deleted on a rolling schedule.

Customers and staff may request deletion of personal data by contacting us. We will delete or anonymise data unless we are legally required to retain it.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your personal data.
• Withdraw consent for marketing communications.
• Object to or restrict certain processing activities.
• Request a copy of your data in a portable format.

To exercise these rights, please contact us using the details below. We will respond within a reasonable timeframe.

Lhasa CRM is not intended for children under the age of 13. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on this page with a revised “Last updated” date. We encourage you to review this page periodically.

If you have any questions, concerns, or requests about this Privacy Policy or how we handle your data, please contact us: