Privacy Policy

This Privacy Policy explains what information QR398 collects, why, and how it is stored and protected. It applies to restaurant owners who create an account, and to customers who view a menu through QR398.

1. Restaurant Account Data We Store

When a business creates a QR398 account, we store the information needed to operate the Service on their behalf:

2. Login Information

Your password is never stored in readable form. It is processed through a one-way cryptographic hashing function (PBKDF2-HMAC-SHA256 with a unique random salt per account) before being saved — meaning even QR398 itself cannot look up or recover your actual password. We can only verify a login attempt against the stored hash, not reveal the original password.

We also keep a security log of login attempts (successful and failed), password reset requests, and key account actions (such as account deletion), for the purpose of detecting and preventing abuse. This log records the IP address, the action taken, and a timestamp — it does not record your password or its hash.

3. Menu Data

Menu data — your categories, dishes, descriptions (in English, Telugu, and/or Hindi), prices, and dietary tags (vegetarian/non-vegetarian, bestseller, spicy, available/unavailable) — is stored so it can be displayed to customers who scan your QR code or visit your menu link. This data is visible publicly to anyone who has your menu link or QR code, by design, since the purpose of the Service is to display your menu to customers.

3A. Table Ordering, Order Notes & Staff Accounts (Pro Plan)

On the Pro plan, additional data is collected specifically to operate table-wise ordering and kitchen/waiter workflows:

• Orders — items, quantities, notes/special instructions a customer types for the kitchen, table number, order status history, and the GST/Service Charge rates that applied at the time the order was placed. A customer's order is tied to a table session, not to any personal identity — customers are never asked to create an account or provide their name, phone number, or email to place a table order.
• Table sessions — a short-lived, anonymous session token created when a customer scans a table's QR code, used only to keep their cart and order status working across page reloads during their visit, and automatically expired after a period of inactivity.
• Staff accounts — name, username, optional email/phone, and role (Manager, Waiter, or Kitchen Staff) for team members you add under Staff Management. Staff accounts are scoped permanently to your restaurant and cannot see or affect any other restaurant's data.
• Billing configuration — your GSTIN (if provided) and configured GST/Service Charge percentages, used to compute the itemized estimated bill shown to customers and stored per-order so historical figures never change if you update these rates later.
• Audit logs — a record of which staff role performed which operational action (accepting/cancelling orders, staff management changes, settings updates) and when, visible to you as the restaurant owner, used to help you understand activity on your own account.

4. Analytics Data

Each time your public menu page is loaded, we record a single anonymous tally: one count, against your restaurant, for that calendar day. This powers the "Views Today / Last 7 Days / Last 30 Days" chart on your dashboard.

• We do not record who viewed your menu, their name, their phone, their location, or any other identifying detail about the customer.
• We do not track individual customers across visits or build any profile of menu visitors.
• The analytics shown to you are aggregate daily counts only, intended to help you understand general traffic to your menu over time.

5. Cookies & Sessions

QR398 uses a single session cookie to keep a restaurant owner (or admin) logged in after entering their password. This cookie:

• Is cryptographically signed so it cannot be forged or tampered with.
• Is marked HttpOnly, meaning it cannot be read by page scripts — only by the browser communicating with our server.
• Is marked Secure in production, meaning it is only ever transmitted over an encrypted HTTPS connection.
• Automatically expires after a period of inactivity (30 minutes on the dashboard), requiring you to log in again.
• Is automatically invalidated the moment you change your account password (Settings → Security), even on a different device or browser that was still logged in with the old password, so a lost or shared device stops working as soon as you change your password.

Repeated failed login attempts on an account trigger a temporary lockout that lengthens the more it keeps happening — this protects against automated password-guessing while avoiding unnecessarily long lockouts for a single mistyped password on a shared restaurant device.

Customers viewing a public menu page are not issued any login or tracking cookie — there is no account to log into on that side of the Service, so no session cookie is created for them.

We do not use third-party advertising cookies, and we do not sell or share visitor data with advertisers.

6. Third-Party Services

QR398 may use the following third-party services as part of operating the platform:

• Railway — our cloud hosting provider, which runs the application and database.
• Cloudinary (optional) — used to host uploaded images (logos, banners, dish photos) if configured, instead of storing them on our own server disk.
• Google Fonts — used to load certain decorative font styles for dish names on the menu page.

These providers may process data strictly as needed to provide their respective service to us; we do not permit them to use your data for their own independent purposes.

7. Data Retention & Deletion

We retain your account data for as long as your account remains active. If you choose to delete your account from your dashboard settings, your restaurant profile, menu, categories, dishes, uploaded images (stored locally), analytics history, payment records, and — for Pro-plan restaurants — tables, orders, order items, staff accounts, and audit logs are all permanently and immediately deleted, and this action cannot be undone. Note that images stored via the optional Cloudinary integration, if used, are not automatically removed as part of this process.

8. Data Security

We apply a range of technical safeguards to protect the data described above, including encrypted password storage, parameterized database queries to prevent injection attacks, rate limiting on sensitive actions, CSRF protection on all account-changing actions, and secure session cookies. No system can guarantee absolute security, but we take these protections seriously and apply them consistently across the platform.

9. Your Rights

As a restaurant account holder, you may access and update most of your information directly from your dashboard settings at any time. You may request a copy of your account data, or request that we delete it on your behalf, by contacting us using the details below — or by using the account deletion option in your dashboard.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

11. Contact

If you have questions about this Privacy Policy or how your data is handled, please contact us at [email protected].