Privacy policy

For your account and our website, we decide how your data is used, so we are the data fiduciary.

For data your restaurant enters about its guests and staff (for example a guest's name and phone number on a bill or booking), your restaurant is the data fiduciary and we are its data processor: we handle that data only on the restaurant's instructions, to provide the service. Guests who want to use their rights over that data should contact the restaurant first; we will help the restaurant respond.

• Account details: name, email address, phone number and password (stored only as a one-way hash).
• Restaurant details: business and outlet names, addresses, GSTIN, tax settings, menu, tables and printer settings.
• Staff details: names, roles, email addresses where given, and sign-in PINs (stored only as a one-way hash).
• Transactions: orders, bills, invoices, payments, refunds, shifts and the audit log of who did what.
• Guest details the restaurant chooses to record: name, phone number, booking details, order history.
• Device and usage data: device identifiers for registered POS devices, sign-in times, and technical error reports. Error reports carry only internal ids, never names, emails, bill contents or IP addresses.
• Website enquiries: what you type into our demo request form.

• To provide the service: run your POS, kitchen display, billing, reports and offline sync.
• To sign you in, keep your account secure and prevent misuse.
• To bill you for your subscription and meet our tax and accounting obligations.
• To answer support requests and demo enquiries.
• To find and fix faults and improve the product, using error reports and aggregated, non-identifying usage.

We do not sell personal data, rent it, or use your restaurant's or your guests' data for advertising. We do not contact your guests for our own purposes.

We use a small number of providers to run the service. Each processes data only for us, under contract:

• Supabase: database and sign-in, hosted in Mumbai, India.
• Vercel: runs and delivers the web application.
• Sentry: error monitoring (internal ids only, as described above).
• Razorpay: online payments, when your restaurant turns them on.
• Meta (WhatsApp): automatic e-bills and booking reminders, when your restaurant turns them on. We share the guest's phone number, name and the message details.
• Anthropic: reads menu photos you upload to import a menu. Only the photos are sent, and only when you use that feature.
• Our email provider: sends sign-in, password reset and invitation emails.

Some of these providers may process data outside India. Where they do, we rely on their contractual commitments to protect it and follow any restrictions the Government of India notifies.

We keep your data while your account is active. If you close your account, we delete or anonymise it within 90 days, except records we must keep by law (for example our own invoices to you). Before closing, you can ask us for a copy of your restaurant's data.

Encrypted backups are kept for up to 30 days and then overwritten.

Your restaurant is responsible for keeping its own GST records for as long as the law requires; please export them before closing your account.

Data is encrypted in transit and at rest, access is limited by role at the database level, passwords and PINs are hashed, and every sensitive action is logged. See our security page for details. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the law requires.

You can ask us to tell you what personal data we hold about you, correct or update it, erase it (subject to legal retention), and withdraw consent where we rely on it. You can also nominate someone to exercise these rights for you. Most details can be changed directly in the app; for anything else, write to our grievance officer below. We reply within 30 days.

If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

We use only what the service needs: a sign-in cookie, and on registered POS devices, storage that holds the menu and unsent bills so billing works offline. We don't use advertising or tracking cookies.

Qbite is a business tool for restaurants and is not meant for anyone under 18. Restaurants should not record personal data about children through it.

If we change this policy in a way that matters, we will tell account owners by email or in the app before it takes effect. The date at the top shows the latest version.

Grievance officer: Harsh Shah, privacy@qbite.in

Harsh Shah
Ahmedabad, Gujarat

Email: support@qbite.in