LEGAL
Privacy Policy
Effective date: August 26, 2026 · Last reviewed: August 26, 2026
OutletOps (“OutletOps”, “we”, “us”) provides point-of-sale, staff management, and ordering software for restaurants, cafés, and retail outlets. This policy explains what personal data we collect, why, how it’s used and protected, and the rights you have over it — in line with India’s Digital Personal Data Protection Act, 2023(the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025 made under it.
1. Who this policy covers
This policy applies across the OutletOps website, web application, and mobile app, and covers three groups of people differently:
- Outlet Partners — the restaurants/outlets and their staff/admin users who sign up for and operate OutletOps. For this data, OutletOps is the Data Fiduciary under the DPDP Act.
- End Customers— people who place an order through an Outlet Partner’s QR-code menu or in-store POS. For this data, the Outlet Partner is the Data Fiduciary(it’s their customer, their relationship) and OutletOps acts as a Data Processor operating the software on their behalf.
- Website Visitors — anyone browsing outletops.com or submitting our contact form.
2. What we collect
From Outlet Partners (staff/admin accounts):
- Business name, address, contact email and phone number
- Staff names, roles, and login credentials
- Employee HR records where the outlet uses those modules — attendance, leave requests, salary/advance records
From End Customers (ordering via QR menu or in-store):
- Name and mobile number, provided at checkout
- Order details — items, quantities, table/order type
- Payment status and a transaction reference — see §3, we do not collect or store your card, UPI PIN, or bank details ourselves
From Website Visitors:
- Name, email, phone number, and message — only if you submit our contact form
- Standard web server logs (IP address, browser type, pages visited)
3. How payments are handled
When an Outlet Partner enables online payment collection, checkout is handled directly by our licensed payment gateway partners — currently Razorpay and PayTM. Card numbers, UPI PINs, and bank credentials go straight to that provider’s own secure checkout; OutletOps never receives, sees, or stores them. We store only the payment status and a transaction reference the provider returns, confirming whether an order was paid. Gateway credentials that an outlet configures are encrypted at rest before being stored.
4. Why we process this data
- To operate ordering, billing, and payment collection for an outlet
- To run staff scheduling, attendance, and payroll where those modules are used
- To send order confirmations and updates (e.g. via WhatsApp, where an outlet enables it)
- To respond to enquiries submitted through our website
- To maintain records required under applicable tax and business law (e.g. GST invoicing)
- To detect and prevent fraud or misuse of the platform
- To improve the product based on aggregated, non-identifying usage patterns
5. Who we share data with
We do not sell personal data to anyone, for any reason. Data is shared only where necessary to run the service:
- With the specific Outlet Partner you ordered from (for End Customer data)
- With Razorpay / PayTM, solely to process a payment (§3)
- With Meta’s WhatsApp Business platform, only if an outlet has enabled WhatsApp order updates
- With our infrastructure providers, strictly to host and run the service — database hosting, application hosting, image storage, and transactional email delivery
- Where required by law, court order, or a government authority
Some of these providers may process data on servers located outside India as part of how they operate globally. Where that happens, it’s solely to provide the service described above, not for any independent use of your data.
6. How long we keep it
We keep personal data only as long as it’s needed for the purpose it was collected for: account data for as long as an Outlet Partner’s account is active, order and transaction records for as long as applicable tax/business record-keeping law requires, and contact-form submissions until your enquiry is resolved plus a reasonable period after. When data is no longer needed, it is deleted or anonymized.
7. Security
All traffic to OutletOps is encrypted in transit (HTTPS). Sensitive stored values — including payment gateway credentials an outlet configures — are encrypted at rest. Access to customer and outlet data is restricted to what a given staff role actually needs. No method of storage or transmission is 100% secure, but we treat this as an ongoing responsibility, not a one-time checkbox.
8. Your rights as a Data Principal
Under the DPDP Act, you have the right to:
- Access a summary of the personal data we hold about you and how it’s processed
- Request correction or completion of inaccurate or incomplete data
- Request erasure of your data, once it’s no longer needed for the purpose it was collected for
- Withdraw consent at any time, as easily as you gave it — this doesn’t affect processing already carried out lawfully before withdrawal
- Nominate another individual to exercise these rights on your behalf in the event of death or incapacity
- Register a grievance, and escalate to the Data Protection Board of India if unsatisfied with our response
If you placed an order through an outlet’s QR menu, the fastest path is usually contacting that outlet directly, since they hold the primary relationship with you — but you’re welcome to contact us directly too, and we’ll route it appropriately.
9. How to reach us
To exercise any of the rights above, or with any question about this policy, contact our Grievance Officer:
OutletOps Privacy Team
Email: privacy@outletops.com
Email: privacy@outletops.com
We aim to resolve every request within 90 days.
10. Children's data
OutletOps is built for use by adults operating or ordering from a restaurant/outlet, and the DPDP Act treats anyone under 18 as a child requiring verifiable parental consent before their data can be processed. We don’t knowingly collect data from children, and don’t currently run age-verification on the ordering flow. If a parent or guardian believes a child’s data has been collected through OutletOps, please contact us (§9) and we’ll delete it.
11. Changes to this policy
We may update this policy as the product, our providers, or applicable law changes. Material changes will be reflected here with an updated effective date; continued use of OutletOps after a change means you accept the updated policy.