I Only Gave My Number: What a Booking App Knows About You

The 10 digits that started it

It’s Friday evening. You open a restaurant booking app, pick a table for two at 8:30, and type in your phone number. An OTP arrives. You’re booked.

As far as you’re concerned, you shared one thing: your number.

But by the time you sit down to eat, that app knows where you were when you booked, which phone you use, how often you eat out, what you usually order, how you pay, and which offers you’re most likely to open. Some of that has already left the app and landed with half a dozen other companies.

None of this is unusual, and most of it isn’t sinister. It is simply how consumer apps work. What’s changing is the law. Under India’s Digital Personal Data Protection (DPDP) Act, every one of those details is personal data, and the app is accountable for each of them.

One booking, step by step

Here’s what a typical booking journey collects. You only consciously handed over the first item.

Step	What you see	What the app records
1. Sign up	“Enter your mobile number”	Name, phone number, email
2. Open the app	Restaurants near you	Location, device model, device ID, IP address, operating system
3. Browse	Menus and photos	Which places you viewed, for how long, at what time of day
4. Book	Table for two, 8:30 pm	Booking history, party size, preferred days and times
5. Add a note	“Window seat, one vegetarian”	Dietary choices and preferences
6. Pay or prepay	Card or UPI screen	Payment method, transaction records
7. Join loyalty	“Earn points on every visit”	Membership ID, spend pattern, birthday
8. Get updates	“Allow notifications?”	Communication preferences, which messages you open

Each row makes sense on its own. Together, they add up to a detailed profile of how you live, eat and spend.

Your phone number isn’t a detail. It’s a key.

On most consumer apps, your phone number is the ID everything else hangs on. It links your bookings to your payments, your payments to your loyalty account, and your loyalty account to the device in your pocket.

That’s why “I only gave my number” misses the point. A list of order times means little on its own. Attached to a number, it becomes a record of where a specific person eats, how often, and with how many people.

The DPDP Act sees it the same way. It defines personal data as any data about an individual who can be identified by or in relation to it. Your location, device ID and order history all qualify, because your number ties them back to you.

One tap, many companies

The app you trusted is rarely the only one holding your data. Most consumer apps run on a stack of outside tools, and each one needs a piece of you to do its job.

Who	Why the app uses them	What they may receive
Cloud hosting	Running the app and storing data	Everything the app stores
Payment gateway	Taking your money	Name, phone, payment details
Analytics and tracking tools	Understanding how you use the app	Device ID, location, screens viewed, taps
CRM and marketing platforms	Sending offers and reminders	Name, contact details, booking history
Messaging providers	SMS, WhatsApp and email	Phone number, email, message content
Customer support desk	Handling complaints	Contact details, booking and chat history

Under DPDP, these companies are data processors and the app is the data fiduciary. The difference matters. If a vendor mishandles your data, the app is still responsible, and it must have a valid contract in place with each processor it shares data with.

What DPDP changes

The DPDP Rules were notified in November 2025, and most obligations for businesses apply from May 2027. They apply to any organisation that handles the digital personal data of people in India, with no minimum size. A 10-person startup collecting phone numbers is covered, just like a national chain.

For you as a user, DPDP means:

• You must be told what’s collected and why. The app has to give a clear notice listing the personal data and the purpose for each.
• Consent must be specific. Agreeing to a booking is not agreeing to marketing. Each purpose needs its own yes.
• You can change your mind. Withdrawing consent must be as easy as giving it, and the processing based on it must stop.
• You can ask questions. You can ask what data an app holds about you, have it corrected, or have it erased once the purpose is over.

For apps, the shift is from “collect everything, decide later” to “collect what you can justify, and prove it.” That applies to data already sitting in their systems too, as we covered in why legacy data is the DPDP bottleneck nobody budgeted for. Penalties can go up to ₹250 crore, for example where an app fails to protect your data with reasonable security safeguards.

What an honest booking screen looks like

Most apps today have one checkbox, often pre-ticked, covering the booking, marketing and sharing with partners. Under DPDP, that won’t hold up.

A DPDP-ready screen splits the journey into purposes and lets you choose:

Purpose	Your choice
Confirm my table and share details with the restaurant	Required
Process my order and payment	Required
Remember my preferences for recommendations	Optional, off by default
Send me offers by SMS and email	Optional, off by default

One screen, plain language, nothing pre-selected, and a preference centre where you can switch any optional item off later.

Where Kwach comes in

Building this properly takes more than a redesigned checkbox. Every consent has to be recorded, tied to its purpose, passed to the vendors who act on it, and switched off everywhere when a user withdraws.

Kwach by Finfactor is a DPDP consent management system built for this. It lets consumer apps:

• capture purpose-specific consent across app, web, in-store and call centre;
• keep a timestamped, auditable record of every consent;
• push withdrawals instantly to internal systems and vendors;
• handle user requests to access, correct or erase data;
• delete data automatically when its purpose or retention period ends.

Kwach runs inside your own cloud, so consent data never leaves your environment.

Want to know what your app is really collecting? Book a 30-minute compliance review and we’ll map your gaps before May 2027.