Privacy policy

QRated builds a QR-first menu platform for small food and beverage businesses in India. This policy explains what data we collect, why we collect it, and the rights you have under India's Digital Personal Data Protection Act (DPDP 2023) and other applicable laws.

Who we are

QRated (qrated.palinntech.com) is a product of PAL Innovation and Technology, Bengaluru, India. "We," "our," and "us" refer to QRated. "You" refers to the merchant owner who signs up, kitchen staff who use the dashboard, and the diners who scan a menu.

What we collect

From merchant owners

• Account details: email, business name, optional WhatsApp number, UPI ID.
• Menu content: category names, items, prices, allergens, photos.
• Operational: QR scan counts, help requests, order events.

From diners

• Scan events: timestamp, user agent, coarse geo (country + city from Cloudflare request metadata).
• Order data (only when you place an order): items chosen, your name, a 10-digit mobile number, a delivery address for delivery, a note to the kitchen, the bill total, an optional rating, a random device id kept in a cookie for up to a year, used to limit coupon abuse and to show your usual order at that cafe, and a salted hash of your IP used only to limit coupon abuse.
• Payment happens either at the counter with the merchant or online by UPI through Cashfree Payments. QRated never receives or stores your UPI credentials; Cashfree tells us only whether the payment succeeded.

How we use it

• Render menus, process orders, power the kitchen ticket board.
• Show scan analytics and help requests to the merchant.
• Invoice the merchant for their QRated subscription (via our payment partner on paid tiers; not applicable on the Free tier).
• Send transactional messages to the merchant (help notifications, order summaries). WhatsApp relay is only used if the merchant opts in.

Product analytics

We use PostHog (hosted in the EU) to see how menus and the dashboard are used and to catch errors, so we can fix what gets in the way. It records pages viewed, taps, a random browser id stored on your device and a session replay of the visit with every form input masked. Names, phone numbers, delivery addresses and notes are never sent to it, and your IP address is not stored. For merchant staff signed in to the dashboard we also link these events to your account email, and every customer name and number on screen is masked. Replays are kept for 30 days.

What we don't do

• Sell your data.
• Target ads.
• Track diners across websites.
• Store card or UPI credentials.

Sharing

Diner data (order details, help requests) is shared with the merchant you ordered from. Infrastructure providers (Cloudflare for hosting, Supabase for storage in Mumbai, India, PostHog in the EU for product analytics, Cashfree Payments for online payments, WhatsApp Business API for alerts) receive only the data needed to run the service. Merchants can export their orders as CSV from the dashboard.

Retention

• Scan events: 90 days rolling.
• Orders: 18 months (or longer if required by tax law).
• Help requests: 30 days.
• Account content: until you delete your account.

Your rights

Under DPDP 2023 you have the right to access, correct, and erase your personal data, and to withdraw consent. Merchants can manage their own data via the dashboard. Diners can email hello@palinntech.com to request deletion of order data tied to their phone number.

Contact

Data protection questions: hello@palinntech.com. Security reports: hello@palinntech.com.