Privacy Policy

RestroXa ("we", "our", or "us") collects information necessary to deliver comprehensive SaaS dining solutions, process POS and digital table orders, facilitate demo requests, verify restaurant onboarding credentials, and power our Kitchen Display System (KDS) and admin dashboard tools.

A. Personal & Demo Lead Data

• Demo Booking Information: Full name, work email, phone/WhatsApp number, restaurant brand name, city/location, preferred demo slot, and outlet requirements submitted through our 'Book a Demo' section.
• Diner & Customer Data: Contact name, phone number, dietary preferences, and table order details provided during guest QR ordering or checkout.
• Restaurant Owner & Staff Details: Full name, business email, contact number, venue address, credential hashes, and role permissions (Owner, Manager, Cashier, Chef).
• Licensing & Verification Documents: FSSAI license numbers, GST registration certificates, and business verification documents uploaded during venue onboarding.

B. Automated Technical & Session Data

• Table QR Sessions: Unique table tokens, cart contents, and IP addresses used for session management and table verification.
• Usage Data & System Diagnostics: Browser type, device parameters, latency metrics, endpoint logs, and rate limit counters (to prevent automated abuse).

We process your information strictly for legitimate operational, security, sales demonstration, and contractual purposes across RestroXa.

• Demo Walkthroughs & Lead Management: Scheduling personalized 1-on-1 platform demonstrations, following up on inquiries, and evaluating restaurant outlet requirements.
• Fulfilling Live Dining Orders: Dispatching table orders directly to the venue's Kitchen Display System (KDS) and POS billing consoles.
• Admin Reporting & Date-Wise Data Export: Providing authorized restaurant managers with date-wise analytics, sales reports, and CSV export capabilities.
• Account Security & Rate Protection: Authenticating user sessions, enforcing IP rate limits (5 requests/15 mins on public forms), and preventing brute-force attacks.
• Restaurant Verification: Reviewing FSSAI licenses and GST documents prior to live menu activation.

Guest Dining Privacy

Diners using RestroXa table QR codes can view digital menus without mandatory user account creation. Guest contact information (such as phone or name) is collected solely for order status notifications and kitchen verification.

Table Session Protection

Each active table QR code generates a temporary session token. Active table sessions restrict ordering modifications to devices physically at the table to prevent external cart manipulation.

RestroXa shares user data strictly on a need-to-know basis under strict privacy safeguards:

• With Restaurant Venues: Customer names, order items, table numbers, and dietary notes are shared with the venue preparing the meal.
• Infrastructure & Cloud Hosting: Encrypted database clusters, cloud object storage, and serverless hosting facilities.
• Communication Gateways: Transactional email and SMS notification services used for authentication OTPs and demo confirmations.
• Legal Compliance: Disclosures required to comply with statutory legal mandates, tax audits, or public safety regulations.

Regulatory Onboarding Compliance

Pursuant to food safety regulations and commercial standards, restaurant partner applications require submission of valid FSSAI licenses and GST certificates.

Document Protection

Uploaded onboarding documentation is stored in encrypted cloud storage accessible exclusively to authorized RestroXa compliance administrators.

RestroXa employs enterprise-grade technical and organizational security controls to protect user data:

• Data Transmission Encryption: TLS 1.3 cryptographic protection across all browser-to-server traffic.
• Database Security: Passwords and sensitive tokens are hashed using salted cryptographic algorithms.
• Role-Based Access Control (RBAC): Strict administrative permissions ensuring staff access data strictly aligned with their assigned role (Owner, Manager, Cashier, Chef).
• Sliding-Window Rate Limiting: IP-based rate limiting safeguards public endpoints and demo booking forms against automated abuse.

Subject to applicable data protection laws, users possess specific rights regarding their personal data:

• Right to Access: Request a copy of personal information or demo request records held by RestroXa.
• Right to Rectification: Correct inaccurate account or restaurant profile details.
• Right to Erasure: Request deletion of user accounts or demo lead records, subject to legal tax retention mandates.
• Opt-Out Controls: Unsubscribe from sales outreach emails at any time.

RestroXa uses essential session cookies and browser storage mechanisms required for core platform functionality:

• Session Authorization Cookies: Preserve log-in state and authentication tokens across dashboard sessions.
• Table & Cart Storage: Maintain live table cart items in diner browser storage during meal sessions.
• UI Preference Storage: Store theme settings, sidebar state, and language preferences.

Order & Demo Lead Records

Order transaction logs and demo request inquiries are retained for accounting accuracy, audit reporting, and customer service continuity in compliance with statutory requirements.

Permanent Account Erasure

Upon confirmed account deletion requests, personal identifiers are permanently scrubbed or anonymized in operational databases within 30 days.

We may update this Privacy Policy periodically to reflect platform enhancements, feature updates, or regulatory statutory changes.