This Privacy Policy explains how GAN Technologies Private Limited (“we”, “us”) collects, uses, and protects personal data when you use Smart QR Ordering — including the public website, shop QR menus, vendor web dashboard, and Vendor mobile app.
We process personal data in India in line with the Digital Personal Data Protection Act, 2023 (DPDPA) and other applicable laws.
1. Who we are
Data Fiduciary: GAN Technologies Private Limited operates the platform.
Contact / grievance: support@simplebusiness.in
When a customer orders from a shop, that shop is primarily responsible for fulfilling the order and handling customer complaints. We act as a technology provider and, for order data, as a data processor helping the shop run its digital menu.
2. Data we collect
2.1 Shop owners and staff
- Shop name, URL slug, shop type, address, tagline
- Owner name, email, mobile / WhatsApp number
- Password (stored in hashed form only)
- UPI ID for customer payments to your shop
- Menu items, prices, categories, stock, product images
- Optional staff PIN (stored in hashed form)
- Device push token (FCM) for new-order alerts on the Vendor app
- Subscription and trial status, login and order activity logs
2.2 Customers (QR menu)
- Mobile number — required to place an order and receive status or bill links
- Name — optional, for pickup or counter identification
- Order details — items, quantities, amounts, table number (if dine-in), payment method
- Browser local storage — we may remember your name and phone on your device for faster reordering at the same shop (you can clear this by clearing site data in your browser)
2.3 Technical data
- IP address, browser or app type, timestamps, and security logs
- Payment webhook references (transaction IDs, status) when UPI webhooks are enabled — we do not store your UPI PIN or full bank credentials
3. Why we use data
- Provide QR menus, order placement, live order boards, and reports
- Send order confirmations, bill links, and status updates (SMS, WhatsApp, email, or push when enabled)
- Authenticate shop owners and staff
- Manage trials, subscriptions, and support
- Prevent fraud, abuse, and security incidents
- Improve reliability and fix errors
4. Legal basis (DPDPA)
We process personal data based on:
- Consent — e.g. when a customer enters a phone number to place an order, or a shop registers an account
- Legitimate uses — operating the service, security, and complying with law
- Contract — providing the platform to shops that sign up
5. Who we share data with
- The shop you order from — order and contact details appear on that shop’s dashboard
- Cloud hosting — e.g. Microsoft Azure (application and database hosting; images may use Azure Blob Storage when enabled)
- Messaging providers — e.g. MSG91 (SMS), WATI or similar (WhatsApp), Firebase (push), when configured
- Payment partners — e.g. Razorpay or other PSP webhooks when UPI automation is enabled
- Law enforcement or regulators — when required by valid legal process
We do not sell personal data to advertisers.
6. Data retention
- Active shop accounts — data kept while the account is in use
- Orders — kept for business and tax records of the shop and platform (typically up to several years unless deletion is requested and permitted by law)
- Deleted shop accounts — we remove or anonymise personal data where possible; some logs may be retained for security and legal compliance
- Customer phone on device — stored in your browser’s local storage until you clear it
7. Security
We use HTTPS, access controls, hashed passwords and staff PINs, and industry-standard hosting practices. No method of transmission or storage is 100% secure. Please use strong passwords and keep staff PINs private.
8. Your rights
Under applicable Indian law, including the DPDPA, you may have the right to:
- Access personal data we hold about you
- Correct inaccurate data
- Withdraw consent where processing is consent-based
- Request erasure (subject to legal and business record requirements)
- Nominate another person to exercise rights on your behalf in certain cases
Customers: contact the shop first for order-related data. You may also contact us at support@simplebusiness.in.
Shop owners: update profile data in Settings, or request account deletion via the Vendor app (when available) or by emailing us.
9. Children
The service is intended for businesses and adult customers placing food or retail orders. We do not knowingly collect data from children under 18 without parental involvement.
10. Cookies and local storage
We use essential session cookies for vendor login and security. Customer QR menus may use local storage on your device to remember your name and phone for convenience — not for cross-site advertising.
11. International processing
We aim to host production data in India (Azure regions) where possible. Some support or backup services may process data in other countries under appropriate safeguards offered by our providers.
12. Changes to this policy
We may update this Privacy Policy. The effective date at the top will change. Significant changes may be communicated through the website or app.
13. Contact and grievances
For privacy questions, corrections, or complaints:
support@simplebusiness.in
If you are not satisfied with our response, you may escalate to the Data Protection Board of India when its grievance mechanisms are operational under the DPDPA.