Privacy Notice for Guests

The restaurant you are ordering from decides why and how your data is used, so under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) it is the Data Fiduciary. Its name, address and phone number are shown above when you open this page from its menu, in “See more about this restaurant” on the menu, and on your bill.

Monika Sharma, trading as QueueWho provides the ordering software (QueueWho) and processes your data only on the restaurant's instructions, as its Data Processor, under a written data processing agreement. Restaurants using the software can't see each other's guests.

Only what is needed for your visit. Each item is used only for the purpose next to it.

• Your name and mobile number

  Why it is used: To take, prepare and hand over your order, contact you about it (for example if a dish runs out), bill you, and show your earlier orders here when you come back

  Needed: Yes

• What you order, notes for the kitchen, your table, and the time

  Why it is used: To prepare and serve the order and to issue the bill

  Needed: Yes

• Bill and payment details: amounts, tax, payment method and payment reference

  Why it is used: To issue a GST bill, take payment, handle refunds and keep the tax records the law requires

  Needed: Yes

• A one-time code sent to your number (stored only as a scrambled fingerprint)

  Why it is used: To confirm the number is yours, when the restaurant asks for this or before showing your data

  Needed: When asked

• Your choice about offers (yes or no) and when you made it

  Why it is used: To send offers only if you said yes, and to prove what you agreed to

  Needed: No, optional

• Loyalty points, if the restaurant runs a points programme

  Why it is used: To add and redeem points on your bills

  Needed: No

• Ratings and comments you leave after a meal

  Why it is used: To improve service; low ratings are sent to the restaurant's owner

  Needed: No, optional

• Your name in a group order, and a random identifier for this browser

  Why it is used: So everyone at the table sees who added what to a shared cart

  Needed: Only for group orders

• Questions you type into the menu assistant

  Why it is used: To answer them about the menu. Please don't type personal details

  Needed: No, optional

• An email address, if you ask for your bill by email

  Why it is used: To send that one email. It is not stored

  Needed: No, optional

• Technical data: IP address, browser type, cookies

  Why it is used: To keep the service secure, stop abuse and keep your visit together. See the cookie policy

  Needed: Yes

Not collected: your address, location, date of birth, contacts or photos, or card and UPI details (you enter those on the payment provider's own page or on the restaurant's card machine).

• Your consent. You give it by ticking the box at checkout after reading this notice. Offers need a separate tick, which is never pre-selected.
• Legitimate uses allowed by law (DPDP Act s.7). The restaurant keeps bills and tax records because the GST law requires it, and may share data when a court or government authority lawfully asks.

Your data is never sold and never used for advertising by anyone else. It is seen by the restaurant's staff who need it (for example the cashier sees your name on the bill), by Monika Sharma, trading as QueueWho to run and support the software, and by these service providers, each only for the job listed:

• Amazon Web Services (or the hosting provider named in our records)

  What for: Hosting the application, its database and uploaded files

  Where: Australia (Sydney)

• Cloudflare, Inc.

  What for: Content delivery, DNS, protection from attacks, the bot check on some forms, backup storage (if used)

  Where: Global network (including outside India)

• The payment gateway the restaurant chose: Cashfree, Razorpay, PhonePe, PayU or Paytm

  What for: Taking online payments and refunds (the restaurant's own gateway account)

  Where: India

• MSG91 (Walkover Web Solutions Pvt. Ltd.)

  What for: SMS: one-time codes, order updates and, with consent, offers

  Where: India

• Meta Platforms (WhatsApp Business Cloud API), if the restaurant uses WhatsApp

  What for: WhatsApp messages: one-time codes, order updates and, with consent, offers

  Where: Outside India

• Resend

  What for: Email: invitations, sign-in and password emails, receipts a guest asks for, alerts to owners

  Where: United States

• Google (Gemini and Veo) or Anthropic (Claude), whichever the platform uses

  What for: AI features: reading menu photos, writing dish descriptions and translations, the menu assistant

  Where: United States

• Sentry (Functional Software, Inc.), if enabled

  What for: Finding and fixing software errors

  Where: United States or European Union

Some providers process data outside India. The DPDP Act allows this except to countries the Government of India restricts by notification. Each provider is bound by contract to protect the data and use it only for our instructions.

• Name, number, offers choice, points, feedback

  Kept for: Until you ask for erasure, or automatically erased 3 years after your last order at the restaurant

• Bills, invoices and payment records

  Kept for: As long as GST law requires: at least 72 months from the due date of the annual return for that year. The name and last 4 digits of your number printed on an issued invoice can't be changed

• Record of the notice you accepted and your offers choices

  Kept for: As long as needed to show what you agreed to, and then deleted with your profile

• One-time codes

  Kept for: 1 day

• Security logs (IP address, browser, pages requested)

  Kept for: 1 year, as the DPDP Rules and CERT-In directions require, then deleted

• The visit cookie on your phone / your saved name and number on your phone

  Kept for: 8 hours / 90 days, or until you clear them

• Backups

  Kept for: Up to 30 days, then overwritten. An erasure also reaches the backups when they expire

Under the DPDP Act you can:

• See your data: get a summary of what is held, what it is used for, and who it has been shared with (s.11).
• Correct, complete or update it, and have it erased once it is no longer needed, except what the law requires to be kept, such as issued invoices (s.12).
• Withdraw your consent at any time, as easily as you gave it (s.6(4)). Withdrawing doesn't affect what was done before.
• Have a complaint resolved by the restaurant and by us (s.13), and then by the Data Protection Board of India.
• Nominate someone to use these rights for you if you die or can't act (s.14).

The fastest ways:

• Your data on the menu (or “Your data and privacy” in the menu sheet): confirm your number with a code, then see and download your data, stop offers, or ask for a correction or erasure.
• Ask any member of the restaurant's staff, or call the restaurant on the number shown on the menu and your bill.
• Email our Grievance Officer (below), who passes the request to the restaurant and follows it up. This works even without a phone code.

Give the mobile number you ordered with, so the right record is found. Requests are acknowledged within 24 hours and answered within 15 days, and never later than the 90 days the DPDP Rules allow. To nominate someone, email the Grievance Officer with their name and contact details.

If you ticked “Send me offers”, the restaurant may send you offers by SMS or WhatsApp, at most once a week and only between 9 am and 9 pm. Every message has a link to stop them in one tap. You can also stop them in Your data or by telling staff. Order updates and one-time codes are not offers and stop when your visit ends.

The service is meant for adults. If you are under 18, please ask a parent or guardian to place the order. Offers are only for people aged 18 or over, and no one's activity is tracked or profiled for advertising. If a parent or guardian believes a child's data was given, they can ask for it to be erased using any of the ways above.

• Connections are encrypted (HTTPS). Secret keys and sign-in codes are encrypted or stored only as fingerprints.
• Each restaurant's data is kept apart by the database itself, so one restaurant can never read another's.
• Staff see only what their role needs. Access by our support team needs the restaurant's permission, is time-limited and is logged.
• Important actions (refunds, voids, data downloads, erasures) are recorded in a log that can't be changed.
• Backups are taken daily and restoring them is practised.

If a personal data breach affects you, you will be told without delay what happened, what it may mean for you, what is being done, and what you can do, and the Data Protection Board of India will be informed as the DPDP Rules require.

Contact the restaurant, or our Grievance Officer, who handles complaints about the platform and helps with requests to restaurants:

If you are not satisfied with the answer, you can complain to the Data Protection Board of India through its online complaint process (details on the Ministry of Electronics and Information Technology website, meity.gov.in). See Grievance redressal.

If this notice changes in a way that matters, you will be asked to read and accept the new version the next time you order. The version and date are at the top of this page.