Privacy Policy

1. Introduction & Applicability

This Privacy Policy outlines how MenuQRO Technologies ("MenuQRO", "Company", "we", "us") collects, processes, stores, and safeguards personal and operational data when you access or use:

• Our website: https://menuqro.in and https://menuqro.pages.dev
• Our high-speed QR digital menus, POS terminals, Kitchen Display Systems (KDS), and Cloud Admin suite
• Our native hardware printer bridge, automated UPI verification, and staff management portals

By registering for MenuQRO, activating a restaurant terminal, or browsing our digital menus, you consent to the data practices described in this policy.

2. Categories of Information We Collect

A. Restaurant Merchant & Operator Data

• Business Credentials: Restaurant legal name, display brand name, outlet address, contact telephone, email address, and dining mode profile.
• Tax & Compliance Details: GSTIN and FSSAI license numbers (where provided voluntarily for customer bill formatting).
• Staff Profiles & PINs: Employee display names, assigned roles (Owner, Manager, Cashier, Chef, Waiter), and hashed 4-digit POS PINs.
• Menu & Catalog Data: Dish names, descriptions, categories, allergen tags, pricing, and high-resolution food images.

B. Diner & End-Customer Data

MenuQRO is engineered to prioritize guest privacy. Diners are not required to register an account or install mobile applications to view menus and place table orders.

• Order Records: Items ordered, table number / token identifier, bill total, special cooking instructions, and order timestamp.
• Optional Contact Details: Phone number or guest name if voluntarily entered by the diner to receive electronic WhatsApp receipts or loyalty rewards.

C. Payment & Transaction Data

When merchants or diners execute digital payments (e.g. SaaS subscription renewal or tableside UPI settlement):

• Transactions are processed directly by RBI-authorized Payment Aggregators (Razorpay, Cashfree, Paytm) or bank UPI applications.
• MenuQRO does not receive or store card numbers, CVVs, bank passwords, or UPI MPINs.
• We only receive a transaction reference ID, payment timestamp, payment status (Success/Failed), and gross amount for automatic invoice generation and KOT dispatch.

3. How We Use Collected Information

4. Cookies, Local Storage & Offline Cache

MenuQRO utilizes modern browser storage (IndexedDB, LocalStorage, and SessionStorage) to deliver ultra-fast offline-first performance on restaurant floors:

• Staff Session Storage: Keeps active staff members securely logged into their assigned terminal role during shifts.
• Printer Mode Cache: Stores thermal printer paper width (58mm/80mm) and local network IP addresses.
• Offline Order Queue: Temporarily queues kitchen tickets if internet connectivity drops, synchronizing seamlessly to cloud databases upon reconnection.
• No Third-Party Ad Trackers: We do not run third-party advertising tracking cookies or sell behavioral profile data to external data brokers.

5. Data Storage, Cloud Infrastructure & Security

All data is maintained in accordance with industry-standard cryptographic safeguards:

• Cloud Infrastructure: Hosted on ISO-27001 and SOC-2 compliant Supabase Cloud and Cloudflare Enterprise Edge networks.
• Encryption: Enforced HTTPS/TLS 1.3 encryption for all data in transit and AES-256 encryption at rest.
• Role-Based Access Control: Restaurant managers and staff accounts can only access data belonging strictly to their assigned outlet.
• 24-Hour Rolling Retention on Guest Logs: Detailed tableside guest interaction logs are automatically pruned to prevent unnecessary historical accumulation.

6. Sharing of Information

We do not sell, rent, or lease merchant or diner data. Data is shared exclusively under the following strict conditions:

• Authorized Payment Processors: Necessary transaction references transmitted to Razorpay, Cashfree, or UPI acquiring banks to verify successful payment.
• Cloud Infrastructure Providers: Hosting and database providers operating under strict confidentiality and data protection agreements.
• Legal & Regulatory Mandates: Where required by valid court order, tax authority audit, or law enforcement request under applicable Indian legislation.

7. Merchant & User Rights (DPDPA 2023)

Under the Digital Personal Data Protection Act (DPDPA 2023) of India, merchants and users possess the following rights:

• Right to Access: Review all personal information and business records stored on your tenant.
• Right to Rectification: Edit inaccurate business, staff, or menu catalog data directly from your dashboard or via support.
• Right to Erasure / Account Closure: Request complete deletion of your restaurant database tenant and staff profiles upon subscription termination.

8. Grievance Officer & Support Contact

In accordance with the Information Technology Act, 2000 and the Consumer Protection (E-Commerce) Rules, 2020, the designated Grievance Officer details are published below: