Privacy Policy

This Privacy Policy explains how Inovite Services Private Limited (CIN U63114MH2025PTC439703), which runs Quackzo ("we", "us"), handles personal data.

It covers: • owners of businesses that use Quackzo, and the staff they add; • people who visit quackzo.com or contact us; • guests and diners whose details a business enters into Quackzo (see section 2).

This is a notice, not a contract. It is written to meet the Information Technology Act, 2000 and the rules under it, and the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the DPDP Rules, 2025 as their provisions come into force.

For business owners' accounts, website enquiries and our own billing, we decide why and how data is used. For that data we are the Data Fiduciary.

For guests and diners, the business that uses Quackzo decides. A hotel or restaurant enters its guests' details to run its own business, so the business is the Data Fiduciary and we are its Data Processor. The same applies to staff accounts: the business creates them as the staff member's employer, and we act on its behalf, apart from the security records we keep about sign-ins. We use this data only to provide Quackzo to that business, on its instructions, under section 9 of our Terms & Conditions.

If you were a guest or diner, please contact the business first: it controls your data and must answer you. If you write to us instead, we will pass your request to the business and help it reply.

From business owners and staff: • name, email address, phone number and role; • password, stored only as a bcrypt hash that cannot be turned back into the password; • if you sign in with Google: your name, email address and profile picture from Google; • business details you enter, such as the business name, address, GSTIN, FSSAI number and logo; • what you bought from us: plan, amount, dates and payment reference (Razorpay handles card, UPI and bank details; we never see full card numbers); • sign-in sessions on up to three devices per person, and when each staff account was last active; • what staff do in the business's records, such as who cancelled an order, took a returned dish off a bill, changed a price on a bill, corrected or cancelled a bill, issued a credit or debit note, changed or deleted an expense line, or added or recounted stock, and the reason given; • emails and messages you send us.

About guests and diners, entered by the business: • names, phone numbers and email addresses, and a hotel guest's postal address where the business records one, which is printed on the guest's bill; • for hotel stays and hall bookings: dates and times, rooms and halls, charges and payments, and the identity document number of the main guest (for a hall, the person who books it) and of each co-guest where the business records one; • orders, table reservations and party sizes; • bills, receipts and invoices, including a guest's company name and GSTIN if given; • WhatsApp messages sent through our add-on, with their delivery status; • booking requests that a business's own website sends us through our Website Booking API: the guest's name, phone number, number of people, dates, the places asked for and any note, and the website visitor's IP address.

Files: menu photos and logos, housekeeping photos of rooms, and booking documents such as vouchers. Quackzo does not accept photos or scans of identity documents.

From visitors to quackzo.com: if you use our contact form, your name, business name, email address and message, with your IP address and browser type to help us stop spam.

Technical data: IP address, browser and device type, and technical details of errors when something breaks.

We do not collect biometric or health data. We do not offer accounts to anyone under 18. Details that businesses enter about their guests can include children; the business is responsible for that data, including any consent a parent must give.

We use personal data to: • create your account, sign you in and keep the account secure; • run the features your business uses: menus, orders, bookings, billing, reports and exports; • send service emails: the nightly sales report, reminders before a plan ends, notices before old bills are deleted, and security messages; • take payment and keep our accounts; • answer support requests and grievances; • prevent abuse and fraud, and find and fix errors; • meet our legal duties, such as tax and company law, court orders, and reporting cyber incidents to CERT-In.

Legal basis. Under the DPDP Act we process personal data only with consent or for a "legitimate use" the Act permits. You consent when you create an account and accept these policies. Data you give us to use a feature is used for that feature (section 7(a) of the DPDP Act). Where a law requires us to keep or share data, we do so to meet that law.

You may withdraw consent at any time by writing to connect@inovite.in. We will stop the processing that relies on it, but we may then be unable to provide Quackzo, and we will still keep what the law requires.

We do not sell personal data. We do not use it for advertising or share it with advertisers. We do not use guest or diner data for any purpose of our own. We send marketing emails only to people who have asked for them.

We use these service providers to run Quackzo. Each receives only what its job needs and is bound by its own terms to protect it: • Neon (database): all account, guest, diner and billing data. Singapore. • GitHub (backup job): each night a temporary GitHub machine copies the database and locks the copy with our own encryption keys before it leaves that machine, which is wiped after every run. United States. • Cloudflare (backup storage): the locked nightly copies of the database. Cloudflare cannot open them; only our founders' keys can. Asia-Pacific. • Vercel (hosting): all data as it passes through our servers, and short-lived request logs. Singapore. • UploadThing (file storage): menu photos, logos, housekeeping photos and booking documents. United States. • Resend (email delivery): the emails we send, including the nightly sales report. United States. • Sentry (error reports): technical details of errors, such as the page and browser involved. Germany (European Union). • Upstash (abuse protection): IP addresses and account IDs used to limit repeated requests, and for website booking requests the guest's phone number. Singapore and United States. • Pusher (live updates): order and table updates sent to the business's screens. India. • Razorpay (payments): payments made to us online. India. • Google (Sign in with Google): only if you choose to sign in with Google. • Meta Platforms (WhatsApp): only for businesses that switch on our WhatsApp add-on — the guest's name, phone number, stay and bill details, and the bill as a PDF. The business holds its own account with Meta. • Cloudflare (bot check): only for a business that asks us to check the captcha on its own booking page — the captcha token and the website visitor's IP address. Cloudflare's global network.

We will update this list, and email account owners, at least 14 days before a new provider starts receiving personal data.

We also disclose personal data when the law requires it — for example under a court order, a lawful request from a government agency, or a direction from CERT-In — and, if our business is sold or merged, to the new owner, who must keep this policy's promises.

Most Quackzo data is stored and processed outside India: the database and servers are in Singapore, nightly backups are made in the United States and kept, encrypted, in the Asia-Pacific region (weekly copies may also be kept, encrypted, in India), files and emails pass through the United States, and error reports go to the European Union.

The DPDP Act allows personal data to be transferred to any country unless the Government of India restricts it. If a country we use is restricted, we will move the data or stop the transfer.

We keep personal data only as long as it is needed, then delete it automatically: • Orders: 24 hours after they are completed. A cancelled order, and the record of a dish returned at billing, is kept until that day's sales report has been emailed, and at most 7 days. • Bills, receipts and completed hotel stays, with guest and diner names, phone numbers, addresses and GSTINs, and each bill's correction history: the current financial year and the three before it. A bill that was cancelled and replaced, or that a note or refund was issued against, is kept as long as the document that followed it. The oldest year is deleted on 1 April; the owner is emailed 60 days and 7 days before and can download every bill until then. • Cancelled and no-show bookings, and table reservations: 1 year. • Identity document numbers of guests: in full for 1 year after checkout, then shortened to the last four digits. • Booking documents: 24 hours after the stay ends. Housekeeping photos: 7 days. • Expense book and cash records, with each expense line's history of changes: the current financial year and the three before it. • WhatsApp message history: 1 year. • Stock counts' history (each delivery, recount and order that moved a count, and who added or recounted): 1 year. • Website booking requests: 1 year after the business accepts or declines them, or after they expire unanswered. An accepted request's guest is kept with the booking it made. The visitor's IP address and the guest's phone number used to limit repeated requests: 15 minutes. • Staff accounts nobody has used for 15 days are switched off, and removed 15 days later. While a business's plan has no staff logins, its staff accounts cannot be used to sign in and are kept as they are, not switched off or removed, until staff logins return or the owner asks us to remove them. • Records of actions our team takes on accounts: 2 years. • Website contact-form enquiries: 1 year. • Error reports: up to 90 days, under Sentry's settings. Server request logs: a few days, under our hosting provider's settings. • Backups: our database provider's restore history covers the last 7 days. Our own encrypted nightly backups are kept for up to 90 days (daily copies for 7 days, Sunday copies for 4 weeks, first-of-the-month copies for 3 months), then deleted automatically. We may also keep the Sunday copies, still encrypted, on a computer held by one of our founders in India, for up to 3 months. Backups hold whatever the database held on the night they were made. • Our records of what a business paid us: 8 years after its account closes, as the Companies Act, 2013 requires.

Everything else in an account is kept while the account exists. When an owner deletes the account, its data is deleted at once, apart from our payment records above; copies already in backups expire on the schedule above, within 90 days at most, and we use backups only to recover from a fault. If a plan ends and is not renewed, we may delete the account after the grace period in our Terms & Conditions.

Keeping bills and accounts for the periods tax law sets — for example 72 months under section 36 of the CGST Act — is the business's own duty. Quackzo is not a business's record-keeper; owners can download their records at any time from Settings → Export.

We protect personal data with: • encrypted connections (HTTPS) for all traffic; • passwords stored only as bcrypt hashes; • access by role, so each staff member sees only what their job needs; • identity document numbers masked on screen and on bills, with every reveal recorded; • limits on repeated sign-in attempts and other sensitive actions; • WhatsApp access keys stored encrypted and never sent to the browser; • automatic deletion on the schedule in section 7; • encrypted nightly backups kept with a separate provider, read through a database login that cannot change data; • a record of actions our own team takes on customer accounts.

No system is completely secure. Keep your password private, and remove staff who leave; Quackzo also switches off staff accounts that go unused.

If we learn of a breach affecting personal data, we will: • report it to CERT-In within 6 hours, as the CERT-In Directions of 28 April 2022 require; • once the DPDP Rules on breaches apply, inform the Data Protection Board of India without delay and send it a detailed report within 72 hours; • tell each affected account holder what happened, what data was involved, what we have done and what they should do; • for guest and diner data, tell each affected business within 24 hours of confirming the breach, and help it inform its guests.

You can ask us to: • tell you what personal data we hold about you, how we use it, and who we have shared it with; • correct, complete or update it; • delete it, unless a law requires us to keep it; • let someone you nominate exercise these rights if you die or become unable to; • stop the processing that relies on your consent.

We also offer two things the DPDP Act does not require: a copy of your data in a common format (owners can export most of it themselves from Settings → Export), and, while a complaint about the accuracy or use of your data is being resolved, a pause on that use where we can do so without stopping the service.

To ask, email connect@inovite.in from the email address on your account, or contact our Grievance Officer (section 13). We may ask you to confirm who you are. We acknowledge requests within 48 hours and answer within 30 days.

If you are a guest or diner, please ask the business first; we will help it answer.

If you are not satisfied with our answer, you may complain to the Data Protection Board of India once you have used our grievance process, as the DPDP Act requires.

We use only the cookies needed to sign you in, keep your session secure and remember your settings. We do not use advertising or tracking cookies, and we do not record your screen. Our Cookie Policy lists each one.

Before a material change takes effect, we will tell account owners by email or in the app at least 14 days ahead, and ask them to accept the new version in the app. The version number and effective date are at the top of this page. We keep every version and will send you an earlier one on request.

Privacy questions and requests: connect@inovite.in

Grievance Officer: Mr. Raj Patil Email: connect@inovite.in Phone: +91 74477 06777 (Monday to Friday, 10:00 AM to 6:00 PM IST, except public holidays) Post: Inovite Services Private Limited, 869 Balaji Nagar, Borgaon Manju, Akola, Maharashtra 444102, India

We acknowledge grievances within 48 hours and resolve them within 30 days.