1. Who is responsible (Data Fiduciary)
ZaikaQR, operated by Dhruvdev Patel (sole proprietorship) from Ahmedabad, Gujarat, India, is the Data Fiduciary for personal information collected from restaurant owners. For customer order data collected through a restaurant's menu, the restaurant is the Data Fiduciary and we act as the Data Processor.
Contact for any privacy question: sales@zaikaqr.com.
2. Information we collect
From restaurant owners (during signup and use)
- Business name, owner name, business address, GSTIN (optional)
- Email address and mobile number
- Login credentials (passwords are hashed, never stored in plaintext)
- Payment metadata via Razorpay (we never see your card or UPI PIN)
- Menu content you upload — items, photos, prices, descriptions, GST settings
- Usage analytics — pages visited, features used, error logs
From restaurant customers (when they scan a QR menu)
- Name and phone number (only if entered — both fields are optional)
- Order contents, table number, special notes, language preference
- Device type, browser, IP address (for fraud prevention and analytics)
- Anonymous session identifiers stored in your device's localStorage
We do not collect customer email, payment card details, government IDs, or biometric data.
3. How we use the information
- To operate the menu, accept orders, and route them to the kitchen
- To send transactional alerts (order placed, payment received, reservation confirmed)
- To bill restaurant owners for their subscription
- To improve product features and fix bugs (aggregated, non-personally-identifiable analytics)
- To respond to support requests
- To comply with legal obligations (e.g. tax records, lawful information requests)
We do not sell your data to advertisers. Ever.
4. Legal basis (under DPDPA 2023)
We process personal data on one of the following grounds:
- Consent — when you sign up or click "Place order", you consent to processing.
- Legitimate use — to perform the service you asked for and to keep it secure.
- Legal compliance — when required by Indian law, court order, or tax authority.
5. Sharing of information
We share personal data only with these categories of recipients:
- Restaurants — receive the customer name, phone, and order they explicitly submitted to that restaurant.
- Service providers — Supabase (database hosting), Vercel (web hosting), Razorpay (payment processing), Resend / Postmark (transactional emails). All are bound by data processing agreements.
- Authorities — when legally required (court order, valid subpoena, lawful investigation).
We never share data for marketing by third parties.
6. Where data is stored
Primary data is stored in Supabase databases located in Mumbai, India (ap-south-1). Backups may be replicated to other regions for disaster recovery. We do not transfer data to jurisdictions blacklisted by the Indian government under DPDPA Section 16.
7. How long we keep data
- Active accounts — for the duration of your subscription.
- Cancelled accounts — up to 90 days, then permanently deleted (except as required for tax / legal records, which may be kept for 8 years per Indian law).
- Customer order data — retained for as long as the restaurant remains active; deletable on request.
- Backups — rolled over within 30 days.
8. Your rights (Data Principal rights under DPDPA)
You have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Request deletion (right to erasure)
- Withdraw consent at any time
- Nominate another person to exercise these rights on your behalf
- Raise a grievance — see Section 10
To exercise any of these rights, email us at sales@zaikaqr.com. We will respond within 30 days as required by DPDPA.
9. Security measures
- All traffic is encrypted in transit with TLS 1.3.
- Passwords are hashed with bcrypt / scrypt — never stored in plaintext.
- Database access requires authenticated keys and row-level security (RLS).
- Owner sessions are stored in HttpOnly, Secure cookies.
- Service-role keys are kept in environment variables, never in client code.
- We follow industry-standard security practices, but no system is 100% breach-proof.
10. Grievance Officer
If you have a complaint about how we handle your data, write to:
Dhruvdev Patel
Grievance Officer, ZaikaQR
Ahmedabad, Gujarat, India
Email: sales@zaikaqr.com
We will acknowledge your complaint within 7 working days and resolve it within 30 days.
11. Cookies & local storage
We use first-party cookies to keep you logged in and to remember your language preference. The customer menu stores cart, table number, and preferences in your browser's localStorage so the order survives a page refresh. We do not use third-party advertising or tracking cookies.
12. Children's data
Our service is not directed to children under 18. We do not knowingly collect data from minors. If you become aware that a child has provided us personal data, contact us and we will delete it.
13. Changes to this policy
We may revise this Privacy Policy from time to time. The "last updated" date at the top reflects the most recent revision. We will notify you in-product or via email of material changes at least 30 days before they take effect.