Privacy Policy

1. Who we are

Dhaba.ai is a restaurant billing and management service run by AiQuiver Vision LLP (brand: QverLabs), 48B Sports Villa, Jaypee Greens, Greater Noida, Uttar Pradesh 201310, India (“we”, “us”). You can reach us at [email protected] or on WhatsApp at +91 96258 87090.

We follow the Information Technology Act, 2000 and its rules on sensitive personal data (the SPDI Rules, 2011), and the Digital Personal Data Protection Act, 2023 and its rules as they come into force.

2. Your data, and your diners’ data

For the details of your business, your account and your staff, we decide how the data is used, so we are the data fiduciary under the DPDP Act.

For your diners’ details (names, phone numbers, orders, loyalty points, feedback), your restaurant decides why they are collected and how they are used. Your restaurant is the data fiduciary, and we are its data processor: we store and process that data only to run Dhaba.ai for you and on your instructions. We never sell it, never use it to market our own services, and never show your diners anyone else’s ads. A diner who wants to see, correct or delete their details should ask the restaurant; we help the restaurant answer.

If you use Dhaba.ai to send marketing messages, you are responsible for having your diners’ consent and for stopping messages to anyone who opts out.

3. What we collect

When you apply: your name, phone number and email; your restaurant’s name, address and number of outlets; your GSTIN, FSSAI licence number and PAN; your type of ownership; how you bill today and a rough revenue range; and how you found us (for example, the ad or page you came from).
Payments: the amount, date, status and reference of each payment. Card, UPI and bank details are handled by our payment provider, Razorpay; we never see or store your full card number.
When you use the app: your account and staff details (names, emails, phone numbers, roles and PIN logins), your menu, orders, bills, payments you record, stock and reports, the messages you send, and settings.
Your diners’ details that you or your staff enter, or that diners give through your table QR or feedback link (see section 2).
Technical data: IP address, browser and device type, and logs of sign-ins and errors, which we use to keep the service secure and working.
In the Android app: the same account and business data as the web app, plus a push notification token for the device, so we can alert your staff about new orders, kitchen tickets and QR orders (see section 11).

Your PAN and your account password are sensitive personal data under the SPDI Rules. We collect them only because we need them: PAN for checking your business and for tax records, the password to protect your account.

4. Why we use it

To check your application: an automated check of your GSTIN, FSSAI and PAN details, with a review by our team where needed (usually about 15 minutes), and to prevent fraud.
To set up and run your account: billing, kitchen tickets, stock, reports, messages and everything else you use in Dhaba.ai.
To take payments, keep your wallet, and issue GST invoices and credit notes.
To support you, and to tell you about your application, your account, payments and changes to our service or prices. With your consent, we message you on WhatsApp about your application.
To keep the service secure, fix problems and improve it, and to meet our legal and tax obligations.
To measure how well our ads work, on our ad landing page (dhaba.ai/get-now) only, with the Meta Pixel and the Meta Conversions API (see section 10).

We use your data only for these purposes. We rely on the consent you give when you apply and sign up, and on the legitimate uses the DPDP Act allows, such as meeting a legal obligation. You can withdraw your consent at any time (see section 9); this does not affect what we did before, but we may then be unable to provide the service.

We use trusted service providers to run Dhaba.ai. They process data only on our instructions and under contracts that require them to protect it:

Razorpay: payments (onboarding fee, support renewal and wallet top-ups) and refunds.
Resend: sending emails, such as your login details and invoices.
Gupshup and Meta (WhatsApp Business Platform): sending WhatsApp bills and messages.
Amazon Web Services (AWS): storing media and files.
Railway: hosting our servers, databases and files.
Tigris: storing invoice files.
OpenAI: reading the menu photos or PDF you upload, so your menu is filled in for you to check.
Google, only if you choose it: signing in with Google, and replying to Google reviews when you connect your Business Profile.
Google Firebase Cloud Messaging: delivering push notifications to the Android app (the device’s notification token and the text of the alert).
Paytm, only if you connect a Paytm card machine: sending card payments to the machine and reading the result.
Meta Platforms (Meta Pixel and Conversions API), on our ad landing page only: measuring how many visits, sign-ups and payments our Facebook and Instagram ads bring. Meta receives the steps you take on that page, your device’s IP address and browser type, and its own cookie (_fbp), but never your name, phone number or email.

We may also share information with our professional advisers, with a buyer or successor if our business changes hands (who must keep this policy), and with government authorities or courts when the law requires it. We share PAN and other sensitive data with third parties only as the SPDI Rules allow: with your consent, to run the service, or when the law requires it. We do not sell personal data.

6. Where your data is stored

Our servers are hosted on cloud servers in Singapore, so your data is transferred outside India. Some of the providers in section 5 may also process data in other countries, such as India or the United States. We transfer data abroad only as Indian law allows, and only to providers who protect it at least as well as this policy requires.

7. How long we keep it

While your account is open, we keep your data so the service works.
When you close your account, you have 30 days to ask for an export of your data. After that we delete it or make it anonymous, except what the law requires us to keep.
Invoices, payments, bills and other tax and accounting records are kept for as long as GST, income-tax and other laws require, generally 8 years.
If your application is not accepted or you withdraw it, we keep its details only as long as we need them to complete the refund, handle any dispute and meet legal requirements.

8. How we protect it

We use reasonable security practices as the SPDI Rules require: data is encrypted in transit (HTTPS); the PAN you give when you apply is stored encrypted; access to personal data is limited to the people who need it for their work; staff sign in with their own PINs; and owners can turn on an authenticator app. No system is perfectly secure. If a personal data breach affects you, we will tell you, and the authorities, as the law requires.

9. Your rights and choices

You can ask us to:

tell you what personal data we hold about you and how we use it;
correct, complete or update it;
delete it, unless we must keep it by law;
stop using it, by withdrawing your consent;
record a person who can use these rights for you if you die or cannot act; and
hear and resolve a complaint about how we handle your data.

Write to [email protected] or to our Grievance Officer (section 14). We may ask you to confirm who you are. Diners should contact the restaurant (see section 2).

Deleting your account. To delete your Dhaba.ai account and its data, whether you use the web app or the Android app, email [email protected] from the email address you sign in with, or WhatsApp +91 96258 87090, with your restaurant name. We confirm the request, give you 30 days to ask for an export of your data, and then delete your account, your staff logins and your business data, or make them anonymous. We keep only what the law requires, such as invoices and tax records (section 7). To remove just one staff member, the owner or an admin can delete that staff login in the app.

10. Cookies, analytics and ad measurement

The website uses one cookie to remember your language. Your browser also stores a few settings on your device: whether animations are paused, your sign-up form progress, and the page or ad that brought you to us. We use website analytics only if we switch it on; when we do, it counts visits and clicks without your name, phone number or email, and we will name the provider here.

On our ad landing page (dhaba.ai/get-now), and nowhere else on the site, we use the Meta Pixel and the Meta Conversions API to measure our Facebook and Instagram ads. On that page Meta sets its cookie (_fbp) in your browser, and Meta receives the steps you take there (opening the page, completing the first step of the form, opening the payment, completing the payment and the amount paid, tapping our WhatsApp link), together with your device’s IP address and browser type, both from your browser and from our server. We never send Meta your name, phone number, email or anything else you type into the form. Meta uses this data under its own privacy policy. You can limit ad tracking in your Facebook or Instagram ad settings, or block cookies in your browser. We use no other advertising cookies.

11. The Android app

The Dhaba.ai app for Android (package ai.dhaba.pos) is our point-of-sale app for phones and tablets. Your restaurant’s staff use it to take orders, print bills and kitchen tickets, and manage tables, bookings, menu and stock. It works with the same account and the same data as the web app, and everything in this policy applies to it. In particular:

Signing in: with your Dhaba.ai email and password, or with Google if you choose; staff then use their own PIN. Your login is kept on the device so you stay signed in; signing out removes it.
Notifications: if you allow notifications, the app registers the device with Google Firebase Cloud Messaging and sends us its token, so we can alert your staff about new orders, kitchen tickets and QR orders. You can turn notifications off in your phone’s settings at any time.
Bluetooth: used only to connect to the receipt and kitchen printers you pair with the device. The app does not scan for or track other devices, and printer details stay on the device.
What the app does not do: it does not access your location, contacts, camera, microphone, photos or files (except reports you choose to export and share), it shows no ads, it does not use the advertising ID, and it has no third-party analytics or tracking. Its data is not included in your phone’s cloud backup.
Security: everything the app sends and receives is encrypted in transit (HTTPS).
Deleting your account and data: see “Deleting your account” in section 9. Uninstalling the app removes its data from the device, but not your Dhaba.ai account.

12. Children

Dhaba.ai is a service for businesses. You must be 18 or older to sign up, and we do not knowingly collect personal data from children. If a restaurant records a diner who is a child, the restaurant is responsible for any consent the law requires from a parent.

13. Changes to this policy

We may update this policy. The date at the top shows the latest version. If a change matters to you, we tell you by email or in the app before it takes effect.

14. Grievance Officer and contact

If you have a question or complaint about your data, write to our Grievance Officer, AiQuiver Vision LLP, 48B Sports Villa, Jaypee Greens, Greater Noida, Uttar Pradesh 201310, at [email protected]. We acknowledge your complaint within 48 hours and resolve it within one month. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.