Privacy notice

Your data on QRThali

Short and plain: what we collect, why, who sees it, how long we keep it, and how you see, correct or delete it. Last updated .

Who we are

QRThali is run by , . It gives restaurants a QR menu, ordering, a kitchen screen and staff and accounts tools.

When you order at a restaurant, that restaurant decides how your order is handled; QRThali stores it for them. For your QRThali account itself, QRThali is responsible. Under the Digital Personal Data Protection Act, 2023 (DPDP Act), each is a data fiduciary for its part.

What we collect

Customers

Name and email from Google sign-in; a mobile number only if you add one.
Your orders: dishes, amounts, table and chairs, when you say you will arrive, and whether you paid.
Ratings, suggestions, and likes or comments on the restaurant's photos.
Lucky-wheel spins. Your name is shown to other customers only if you tick the box to show it.
Your cart, favourites and order list are also kept on your phone.

Restaurant owners and team

Name, email and the access the owner gives you.
What you do in the apps: orders accepted, payments marked, changes to the menu. This log protects the restaurant against mistakes and theft.

Restaurant staff

Name, mobile numbers, address, family and emergency contacts.
Only the last 4 digits of Aadhaar, PAN, and bank details for salary.
Health papers (medical fitness, vaccination), which food law requires for food handlers.
Attendance, leave, salary and payments.

We never collect card numbers, UPI PINs or bank passwords. Payments happen in your own UPI app.

Why we use it

To take and serve your order, show your bill and let the restaurant confirm your payment. Your consent, given when you place the order.
Ratings, suggestions and the lucky wheel: only if you use them. Your consent.
Staff records and salary: for employment, which the DPDP Act allows (section 7(i)). Health papers because food safety rules require them.
Tax and accounts: bills are kept because GST law requires it.

We do not sell your data, show advertising, or build profiles to target you.

How long we keep it

Data	Kept
Orders and bills	As long as tax law requires (GST records: 72 months), then deleted or made anonymous.
Ratings, suggestions, comments, wheel name	Until you delete them or your account.
Staff records and salary	While employed, then as long as labour and tax law require.
Health papers	Until replaced by a newer one, or one year after the person leaves.
Logs of who changed what	At least one year, as security rules require.

Your rights

Under the DPDP Act you can:

See what we hold about you, and download it: menu app → your profile → Your data.
Correct your name and mobile in your profile.
Delete your ratings, comments, wheel name and the link between you and your orders: menu app → your profile → Delete my data. Bills the law requires us to keep are kept without your name.
Withdraw consent as easily as you gave it, for example by unticking "show my name" or deleting your data.
Name someone to use these rights for you if you cannot.
Complain to our grievance officer (below). If you are not satisfied, you can complain to the Data Protection Board of India.

Children

Signing in and the lucky wheel are for people aged 18 or over. Anyone younger can order with a parent, without signing in. We do not knowingly collect a child's data, and we do not track or target children.

Security

All connections are encrypted (HTTPS).
The database checks every request against your role, so a cashier cannot open staff salaries, and a customer sees only their own orders.
Private files (staff papers, licences) open only through links that expire within minutes.
If a breach affects your data, we will tell you and the Data Protection Board as the law requires.

Grievances and questions

Grievance officer:
Email:
Phone:
Post: ,

We acknowledge a complaint within 48 hours and resolve it within 30 days.

This notice may change. The date at the top shows the latest version; for a big change we will tell you in the app.