[LEGAL REVIEW REQUIRED]DPDP Act 2023 • IT Rules 2021
Privacy Policy & Statutory Privacy Notice
v1.1-2026
Formulated under Section 5 & 6 of India's Digital Personal Data Protection Act, 2023 (DPDP Act) & the draft DPDP Rules, 2025.
Language Availability: Displaying English version. Under DPDP Act rules, translated copies (including Hindi / हिन्दी) are available upon formal request to our Grievance Desk.
PostgreSQL Row-Level Security ensures no restaurant can view another tenant's menu, orders, or customer information.
Zero Data Selling
We never monetize, sell, or license diner phone numbers or restaurant financial data to ad brokers.
Payment Protection
All card and UPI payments are processed by RBI-regulated Razorpay. We never store CVVs, OTPs, or banking passwords.
[LEGAL REVIEW REQUIRED: This Privacy Notice specifies the categories of digital personal data collected, lawful purposes of processing, retention periods, third-party processors, and Data Principal rights under India's DPDP Act, 2023.]
1Itemized Categories of Personal Data Collected
Under Section 5(1) of the DPDP Act 2023, we provide an itemized notice of personal data processed across our two Data Principal groups:
GROUP ARestaurant Partners & Merchant Operators
Account Credentials: Owner name, business email, encrypted password hash, and 2FA TOTP secrets.
Business Profile: Restaurant trade name, public slug, primary business phone, city, and physical address.
Statutory Business Identifiers: 14-digit FSSAI Food License Number (optional) and 15-character GSTIN (optional) for tax invoices.
Billing History: Plan tier, Razorpay transaction ID, subscription renewal timestamp, and billing address.
GROUP BDining Customers (Diners)
Anonymous Browsing: Diners scanning table QR codes browse menus without creating an account or providing identity.
Order Record: Table identifier, ordered menu items, dietary preferences (Veg/Non-Veg), timestamps, and item quantities.
Optional Mobile Number: Provided exclusively if the diner chooses to receive an e-receipt or live order preparation updates.
GROUP CProspective Restaurant Partners (Lead Enquiries & Callbacks)[LEGAL REVIEW REQUIRED]
Contact Identifiers: Owner name, verified 10-digit Indian mobile number, restaurant trade name, city, and optional business email.
Enquiry Details: Preferred time to call (Morning/Afternoon/Evening) and optional inquiry message (up to 300 characters).
Consent Records: Cryptographic SHA-256 hash of consent notice displayed, explicit opt-in timestamps, IP address, and channel telemetry stored append-only in our compliance ledger.
Technical Telemetry & Network Identifiers
Anonymized/hashed client IP addresses and browser User-Agent strings collected exclusively for rate-limiting, DDoS prevention, and trial fraud detection.
2Specific Lawful Purposes of Data Processing (DPDP §4 & §6)
Personal data is processed strictly for defined, lawful purposes:
Providing the cloud QR menu, kitchen display routing, and table ordering services.
Executing subscription billing and issuing GST-compliant tax invoices via Razorpay.
Transmitting order confirmation and status notifications via SMS or WhatsApp (opt-in only).
Contacting prospective restaurant owners via phone call or WhatsApp regarding their callback enquiry (opt-in consent under DPDP §6).
Transmitting optional product updates and promotional growth offers where explicit marketing consent was granted.
Enforcing security controls, tenant isolation, and audit logging under Indian cyber laws.
3Third-Party Processors & Infrastructure Partners
Under Section 8(2) of the DPDP Act 2023, data is shared only with vetted Data Processors under strict confidentiality obligations:
Razorpay Software Pvt Ltd
RBI-regulated Payment Aggregator for subscription billing. PCI-DSS Level 1 compliant.
Supabase Inc.
PostgreSQL database, authentication, and WebSocket realtime subscription infrastructure.
Vercel Inc.
Edge hosting, TLS encryption termination, and serverless compute provider.
Transactional Email & SMS Partners
Delivering password reset emails, invite tokens, and dining order e-receipts.
4Data Retention & Auto-Purging Schedules
Under Section 8(7) of the DPDP Act 2023, personal data is retained only for as long as necessary for the purpose or statutory compliance:
Merchant Account Data: Retained for the duration of the active subscription + 30 days grace period following account closure.
Financial & GST Invoicing Records: 7 fiscal years to comply with Section 36 of the Central Goods and Services Tax (CGST) Act, 2017.
Kitchen Dining Orders: Active on kitchen display for 90 days; archived and anonymized after 180 days.
Diner Mobile Numbers: Retained for 30 days after order completion, then purged unless required for chargeback resolution.
Prospective Lead Enquiries: Retained for a maximum period of 12 months from submission. If a prospective restaurant owner has not converted into an active merchant account within 12 months, all identifying lead records (name, phone, email, notes) are permanently deleted or irreversibly anonymized [LEGAL REVIEW REQUIRED].
Security & Network Telemetry Logs: 180 days in compliance with CERT-In directions.
5Your Statutory Rights Under the DPDP Act, 2023
As a Data Principal under Indian law, you possess the following enforceable rights:
Right to Access (§11)
Request a summary of personal data being processed and third-party identities with whom data was shared.
Right to Correction & Erasure (§12)
Correct inaccurate personal data or request permanent erasure of personal data that is no longer necessary.
Right to Withdraw Consent (§6(4))
Withdraw optional consents at any time as easily as giving them, accessible directly in your Account Settings.
Right to Nominate (§14)
Nominate an individual who shall exercise your data rights in the event of death or incapacity.
In strict accordance with Section 9 of the DPDP Act 2023, ZemQR does not knowingly collect personal data of individuals under the age of 18 without verifiable parental consent. We do not engage in tracking, behavioral monitoring, or targeted advertising directed at children.
7Statutory Grievance Redressal & Data Protection Board of India
Under Section 13 of the DPDP Act 2023 read with the DPDP Rules 2025, you may address statutory inquiries, data complaints, or rights grievances to our designated Grievance Officer:
Statutory Resolution Timelines: Acknowledged within 24–48 hours; formally investigated and resolved within 30 calendar days in accordance with DPDP statutory requirements.
Escalation to the Data Protection Board of India (DPBI)
If your grievance is not resolved to your satisfaction by our Grievance Officer within statutory timelines, you have the statutory right under Section 13(3) of the DPDP Act 2023 to lodge a formal electronic complaint with the Data Protection Board of India at dpb.gov.in .