Walk-in Ordering ("we", "us") provides QR table ordering software to cafés, restaurants and hotel dining venues. This policy explains what we collect when you visit this website, buy Platform Access, run a café on the platform, work as staff, or order as a guest.
The short version
- Guests can order without giving us their name, phone number or email.
- We collect what we need to run a café's account and take payment for it, and nothing for advertising.
- We don't sell personal data, and this website uses no advertising or analytics trackers.
- Card and UPI details for Platform Access are handled by Razorpay. We never see or store them.
What we collect
Café owners and managers
When you buy Platform Access we collect your name, email, phone number (optional) and business name, plus the billing period you chose and Razorpay's order and payment references. When you create a Café Admin login we store your email and a securely hashed password.
Staff
When an owner or manager adds a team member, we store that person's name, email, role and a securely hashed password, and a record of which order statuses they changed and when. That record is how the café's analytics show orders per staff member.
Guests
An order records the table, the items and quantities, any note for the kitchen, the payment method chosen and the order's status history. We don't ask guests for personal details. If a guest pays by UPI or bank transfer, that payment happens between the guest and the café. We only store that the café marked the order as paid.
Café content
Menus, photos, prices, stock counts, tables, branding and payment instructions (such as a UPI ID) that a café adds are stored so guests and staff can see them.
Contact form
If you message us, we keep your name, email, optional phone and business name, and your message. To stop spam we keep a one-way hash of your IP address. It can't be turned back into the address.
How we use it
- To provide the service: showing menus, sending orders to staff, updating guests and producing analytics.
- To take payment for Platform Access and keep the invoices and records the law requires.
- To keep accounts secure, prevent abuse and fix problems.
- To reply to messages and send essential account emails. We don't send marketing without consent.
Cookies and local storage
Signed-in owners, managers and staff get essential session cookies that keep them logged in. The staff app remembers whether order sounds are switched on in the browser's local storage. We don't use advertising or cross-site tracking cookies.
Who processes data for us
- Supabase: database, authentication and file storage.
- Vercel: website and application hosting.
- Razorpay: payment processing for Platform Access.
These providers may store and process data outside India, including in Japan and the United States, under their own security and privacy commitments.
Each café's data stays separate
Every café is its own account. Database access rules make sure owners and staff can only read and change their own café's menu, tables, orders and team. A café's data is never shown to another café.
How long we keep it
- Account, menu and order data: for as long as the café's account is active, and up to 90 days after it closes, so it can be reactivated or exported.
- Payment and invoice records: as long as tax and accounting law requires.
- Contact form messages: up to 2 years, then deleted.
Your choices and rights
You can ask us to access, correct or delete personal data we hold about you, or to stop using it for a particular purpose, as allowed under applicable law, including India's Digital Personal Data Protection Act, 2023. Staff can ask their café's owner to remove their login at any time. To make a request, use the contact form. We'll confirm your identity before acting on it.
Security
Data is encrypted in transit, passwords are hashed, and access inside the platform is restricted by role. No system is perfectly secure. If we learn of a breach that affects you, we'll tell you and the relevant authorities as the law requires.
Children
Café accounts are for businesses and adults. Guests of any age can order at a venue without an account, and we don't knowingly collect personal data from children.
Changes
If we change this policy we'll update the date at the top, and tell café owners by email before any significant change takes effect.