Privacy Policy

VAQENO is an independent restaurant-operations software product. In this policy, “VAQENO”, “we”, “us” and “our” refer to the VAQENO service and the team responsible for operating it. This policy covers our website, restaurant dashboard, QR ordering, staff workflows, customer-management features, messaging integrations, billing features and AI tools.

For privacy questions, write to getvaqeno@gmail.com. Please do not send passwords, payment credentials or sensitive customer information by email.

• Account and workspace data: account email, authentication identifiers, restaurant name and ordering slug, workspace/outlet membership, roles and access/security events. Authentication is handled through our configured authentication provider; VAQENO does not ask you to send us your password by email.
• Restaurant operations: menus, item descriptions and prices, tables and QR identifiers, orders, order status, sales summaries, loyalty and campaign configuration, staff access and workspace settings.
• Guest/customer information: information a restaurant or guest submits, which may include name, phone number, order details, visit history, delivery details when collected, marketing preferences and messaging consent records.
• Billing records: subscription/plan information, payment status, transaction references and billing events. Where Razorpay is enabled, payment credentials are handled by the payment provider; VAQENO receives the transaction information needed to manage the service and reconcile payments.
• AI and Restaurant Brain data: messages you send to the assistant, assistant responses, conversation history, explicitly saved restaurant notes/decisions, and limited tool/audit metadata needed to provide and secure AI features.
• Integration information: settings and provider identifiers for integrations you enable, such as WhatsApp messaging. Integration credentials are handled by the application to perform the requested integration and are not displayed as plaintext after saving.
• Technical and security information: session cookies, request/device information, error and security logs, and a keyed hash of a signup network address used by the trial-abuse review workflow. That workflow is designed to clear the network-address hash after 90 days.
• Optional browser notifications: if a guest chooses to enable order notifications, the browser push subscription and a local browser reference may be stored to deliver order-status updates.

Information depends on the features a restaurant enables and what users submit. Do not put card numbers, passwords or unnecessary customer/staff personal details into AI prompts or saved Restaurant Brain notes.

We receive information directly from account holders, restaurant staff and guests; from restaurant records entered or uploaded by the restaurant; from service providers when needed to authenticate users, process subscriptions or deliver integrations; and automatically from normal application use for security, service operation and troubleshooting.

• Create and secure accounts, authenticate users, provision workspaces and enforce role-based access.
• Run restaurant menus, QR ordering, order queues, customer records, loyalty, campaigns and operational reporting.
• Display account and subscription status, reconcile transactions and respond to billing/support requests.
• Generate requested analytics and AI assistance, maintain conversation history, and remember restaurant context explicitly saved by authorized users.
• Send a message or campaign only through an integration the restaurant configures and when the applicable channel consent, provider template and platform rules permit it.
• Prevent abuse, enforce plan limits, diagnose failures, protect the service, meet legal obligations and resolve disputes.

Restaurant owners control the customer and operational data they choose to enter into VAQENO. Depending on the activity and applicable law, the restaurant may be responsible for deciding why guest/customer data is collected, giving its customers appropriate notices, collecting required permissions, honoring communication opt-outs, and responding to requests about its customer records. VAQENO processes this information to provide the restaurant's configured service and to maintain security and reliability.

VAQENO separately handles limited account, subscription, security and service-usage information for operating our platform. Restaurant owners should give staff access only when needed and should not save customer names, phone numbers, email addresses or other personal details in shared AI memory notes.

We do not sell personal information as a business model. We share or make data available only as reasonably needed to operate the service, follow instructions from the restaurant, complete a user-requested transaction, protect the service or meet legal requirements. Depending on enabled features and deployment settings, providers may include:

• Supabase: authentication, database, storage and related application infrastructure.
• Vercel: application hosting and deployment infrastructure.
• Razorpay: subscription/payment processing and payment-status events where configured.
• Google Gemini and optional AI providers: the AI prompt and relevant, retrieved context needed to generate a response when the relevant AI feature is enabled. Optional Jev/decision-provider integrations may process limited aggregate opportunity data when explicitly configured.
• Meta WhatsApp Cloud API: message delivery and provider status for restaurants that configure and use WhatsApp features.
• Browser push services: delivery of order-status notifications when a guest opts in through a supported browser.

Provider terms and privacy practices also apply to their services. Provider infrastructure or support operations may process information in other jurisdictions; the actual location depends on the provider, its subprocessors and the deployment configuration. We do not claim that every provider processes all data exclusively in India.

When you use AI features, VAQENO may send your prompt and relevant restaurant facts retrieved by authorized tools to the AI provider configured for that feature. The assistant is designed to use scoped business data and avoid sending customer names or phone numbers through its structured analytics tools, but text you choose to type into a prompt may contain personal information. Avoid entering personal data that is not necessary for your question.

AI outputs can be incomplete or incorrect and should be checked before business decisions. The AI does not independently authorize actions such as sending campaigns or changing settings; actions requiring confirmation remain subject to the application's controls.

VAQENO uses session/authentication cookies and similar browser storage needed to keep users signed in, protect account flows and operate selected features. Optional browser push notifications use browser permission and subscription mechanisms. Blocking essential cookies or storage may prevent parts of the service from working. This policy does not promise that every third-party provider uses no cookies of its own; check the provider's notices where relevant.

We use safeguards appropriate to the service, including authenticated access, role and restaurant scoping, database access policies, server-side validation, protected integration credentials, rate limits, security logging and maintenance workflows. No internet service can guarantee absolute security, so account holders should use strong unique passwords and protect their sessions and integration access.

We retain information for as long as needed to provide the service, maintain account and transaction records, honor restaurant configuration, investigate security issues, resolve disputes and meet applicable legal requirements. Retention differs by data type. Some records may remain for a legally required period or in backups/logs for a limited period after deletion from the live service. The trial-abuse address hash has a 90-day clearing workflow, as described above.

You can correct many account or restaurant details through the application or ask us for help. Requests involving guest/customer records should ordinarily be directed to the restaurant that collected those records; we will support the restaurant as appropriate under our service arrangements. You may also contact us to ask about personal data associated with your VAQENO account, request correction or deletion where available, raise a concern, or ask how to withdraw a permission. Some records may need to be retained for security, accounting, legal obligations or dispute handling.

We will verify the requester's identity and authority before disclosing or changing data. We will update this policy and operational procedures as applicable Indian data-protection provisions and rules enter into force under their notified commencement schedule.

VAQENO workspace accounts are intended for adults acting for a restaurant or business. The service is not designed as a children's account service. Restaurant owners who use VAQENO to process information about children or other vulnerable persons must independently assess and meet the legal requirements applicable to that processing and should not collect more information than is needed.

We may revise this policy when the service, providers, data practices or legal requirements change. We will update the version and effective date shown at the top. For material changes, we will use an appropriate in-product or account communication where practical. Where a new or changed processing activity requires fresh consent under applicable law, a policy update alone will not substitute for that consent.

For privacy questions, correction/deletion requests, or complaints about how information is handled, contact getvaqeno@gmail.com with the subject “VAQENO Privacy Request”. Do not include passwords, full payment-card information or unnecessary guest data in the request.