Privacy Policy

1. Introduction

DineByQR Technologies Pvt Ltd ("DineByQR", "we", "us") is committed to protecting the privacy of our restaurant partners ("Restaurants") and their end customers ("Diners"). This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data.

2. Data We Collect

2.1 From Restaurants

• Business information (restaurant name, address, GSTIN, FSSAI license number)
• Account credentials (email, phone, password hash)
• Menu content (items, prices, descriptions, images)
• Transaction and billing data
• Staff accounts and role assignments

2.2 From Diners (End Customers)

• Name and phone number (when provided for order tracking)
• Order history and preferences
• Device information (browser type, OS — for technical compatibility)
• We do not collect payment card details — all payments are processed through certified third-party payment gateways (Razorpay, PhonePe, etc.)

2.3 Automatically Collected

• IP addresses and approximate location (for analytics and fraud prevention)
• Usage analytics (pages visited, features used, session duration)
• Cookies and local storage tokens (for session management and preferences)

3. How We Use Data

• Service Delivery: Process orders, generate invoices, manage kitchen operations
• Improvement: Analyze usage patterns to improve platform performance and features
• Communication: Send order confirmations, receipts, and platform updates
• Security: Detect and prevent fraud, unauthorized access, and abuse
• Legal Compliance: Meet tax, accounting, and regulatory requirements (GST filings, etc.)

4. Data Sharing

We do not sell personal data. We share data only in these limited cases:

• With Restaurants: Diner order data is shared with the restaurant that received the order
• Payment Processors: Order totals are shared with payment gateways for transaction processing
• Service Providers: Cloud hosting (AWS/GCP), email delivery, SMS providers — all bound by data processing agreements
• Legal Requirements: When required by law, court order, or regulatory authority

5. Data Security

• All data transmission is encrypted via TLS 1.3 (256-bit SSL)
• Passwords are hashed using bcrypt with salt
• Database backups are encrypted and stored in geographically redundant cloud storage
• Access to production systems is restricted to authorized personnel with MFA
• Regular security audits and vulnerability assessments

6. Data Retention

• Active Accounts: Data is retained for the duration of the subscription
• After Termination: Data is available for export for 90 days, then permanently deleted
• Invoices & Tax Records: Retained for 8 years as required by Indian tax law
• Diner Data: Order history is retained for 12 months, then anonymized

7. Cookies

We use cookies for:

• Essential: Session management, authentication, CSRF protection
• Functional: Theme preference (dark/light mode), language selection
• Analytics: Anonymous usage statistics to improve the platform

You can manage cookie preferences through your browser settings or our cookie consent banner.

8. Your Rights

You have the right to:

• Access: Request a copy of all data we hold about you
• Correction: Update inaccurate or incomplete data
• Deletion: Request deletion of your data (subject to legal retention requirements)
• Export: Download your data in a machine-readable format
• Objection: Object to specific data processing activities

9. Children's Privacy

DineByQR is a business-to-business platform. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware of such collection, we will promptly delete the data.

10. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or dashboard notification at least 14 days before taking effect.

11. Contact Us

For privacy-related inquiries, data access requests, or complaints, contact our Data Protection Officer at: privacy@dinebyqr.com or reach us at hello@dinebyqr.com.