Privacy Policy

In short

qr_order is operated by Nsquare Microtech for small Indian food shops. We collect the minimum data needed to take and fulfil your order. We do not sell or share customer data with anyone outside the shop you ordered from. We do not handle your payments — those happen directly between you and the shop.

What we collect

When you place an order, we store the items you ordered, the name you typed, optionally a phone number you provided, the order short-code, and a request id used to prevent duplicate orders if your network drops. Order status changes (placed, accepted, ready, collected, cancelled) are also stored against the order.

The shop's staff and owner can see this information for their shop only. They cannot see orders from any other shop.

What we don't collect

• We don't collect or process payment instruments. Payment is offline (cash or UPI to the shop's VPA / QR), and we have no visibility into payment success or failure.
• We don't use third-party advertising trackers, analytics tied to identifiers, or marketing pixels on the customer surface.
• We don't store your location.

Cookies and local storage

We use your device's local storage to remember your cart for the current shop, to remember whether you dismissed the notification or app-install prompts, and to remember your last order time so we can surface a smoother experience for repeat visits. None of this leaves your device.

How long we keep your data

Order records are retained for 24 months for the shop's accounting and dispute resolution, then aggregated and the personally identifying fields (your name, phone) are removed. Static device flags in local storage stay on your device until you clear it.

Your rights (DPDP Act, 2023)

Under India's Digital Personal Data Protection Act, 2023, you have the right to access the data we hold about you, correct it, erase it (subject to lawful retention windows), and withdraw consent. Email us at hello@nsquaremicrotech.in and we'll respond within 30 days.

Where data is stored

Order data is stored in Supabase (Postgres) in the ap-south-1 (Mumbai) region. Static assets are served via Vercel (also Mumbai). We do not transfer data outside India for processing.

Children

qr_order is not directed at children under 18. We do not knowingly collect data from minors. If you believe a minor has submitted data, contact us and we will remove it.

Changes to this policy

We'll update the "Last updated" date when this policy changes. Material changes that expand the data we collect will be highlighted on the customer surface for at least 14 days before they take effect.