Privacy Policy

1. Data we collect

• Account & business data: vendor name, phone number, email, business name, outlet locations, city and billing details.
• Catalog & operational data: catalog items, categories, combos, prices, photos of menus, price lists or catalogs you upload for AI scanning, brand story and gallery media, tables, orders, order status history, staff roles and activity logs.
• End-customer data (your customers): customers can browse storefronts and place orders without creating an account. We process only what is needed for the order: items, table/session or delivery details, and any name or phone number a vendor records at the counter for order lookup. Customers may optionally create an account by verifying their mobile number with a one-time password (OTP); for account holders we store the mobile number, order history and saved favorite stores. Ordering never requires an account.
• Dashboard usage: which dashboard screens you and your staff open, how long they are in use, and where an action is blocked or fails, recorded against the owner login or staff account that performed it. We do not record what you type, your catalog text or any customer details as part of this.
• Support & diagnostics: messages you send us, crash reports, device/browser information, IP address and usage analytics.

2. How we use data

• Provide, operate, secure and improve the Service: building your digital storefront, routing orders, powering dashboards, fulfilment boards and kitchen screens, and sending order OTPs and status updates.
• Set up accounts, process billing and communicate about service changes, onboarding and support (typically via WhatsApp, SMS or email).
• Send product news and offers, only with your consent, which you can withdraw anytime.
• Prevent fraud and abuse, enforce our Terms and comply with legal obligations.
• Understand how the Service is actually used, so we can fix and prioritise what gets in your way. Dashboard usage is linked to the staff account that performed it while we hold the detailed records; we use it to improve the product, and we do not sell it or use it to profile individual staff members.
• Aggregate and de-identify data for wider product analytics and research. We never identify your business in published material without consent.

3. Legal bases & compliance

We process data to perform our contract with you, to meet legal obligations, and for legitimate interests such as service security and improvement. Where consent is required (for example, marketing messages) we ask for it first. We process personal data in accordance with applicable Indian law, including the Digital Personal Data Protection Act, 2023.

4. AI catalog scanning

When you use the AI catalog scan, your menu, price list or catalog photo is processed by our AI service providers solely to extract items, prices and categories. Photos and extracted text are used only to build your catalog and, by our instruction, are not used to train third-party AI models.

5. The KioSnap vendor app (Android)

The KioSnap Vendor app is a secure wrapper around the same vendor dashboard you use on the web, signed in with the same account. It exists so that new orders can ring your phone until a staff member acknowledges them. In addition to the data described above, the app involves:

• Device notification token: to deliver order alerts we register a Firebase Cloud Messaging (FCM) token for your device and store it against your vendor account. It identifies the device, not you personally. It is removed when you sign out, uninstall the app, or delete the device from your notification settings.
• Device details: app version, device model and platform, used to deliver alerts correctly and to help us diagnose missed-alert reports.
• Permissions we request: notifications (to show order alerts), full-screen alerts and vibration (so an alert is visible and audible on a locked screen), and a foreground service (so the alert sound keeps playing until acknowledged). We may also ask you to exempt the app from battery optimisation so alerts still arrive when the phone is idle. All are optional and can be changed in Android settings at any time; declining them means order alerts may be delayed or silent.
• Permissions we do NOT request: the app does not access your location, contacts, SMS, call logs, microphone or health data. Photos are only read when you actively choose to upload an image or scan a catalog.
• No advertising: the app contains no advertising SDKs, no third-party ad tracking and no cross-app tracking identifiers. We do not sell or share app data with data brokers.
• Order alerts may display order details (such as an order number and items) on your lock screen. If your device is shared, adjust Android's lock-screen notification settings.

6. Data sharing

• Service providers: hosting, storage, AI processing, push-notification delivery, analytics and communication tools, used only to perform services on our behalf, under contracts that limit their use of the data.
• Professional advisors and authorities: where required for business operations, compliance or by law.
• We do not sell personal data, and we do not run third-party advertising on the platform.

7. Storage & international transfers

Data may be processed or stored on servers located in India or other countries, with reputable cloud providers. Where data crosses borders, we implement appropriate safeguards.

8. Security

We apply administrative and technical safeguards proportionate to risk: encryption in transit, access controls, audit logging and backups. No system is 100% secure; please also keep your own devices, PINs and staff access hygiene in order.

9. Data retention

We retain data while your account is active, including while paused. If you delete your account, we delete or de-identify personal data within a reasonable period, except where retention is required by law (for example, tax records). Device notification tokens are deleted as soon as you sign out or remove the device.

Detailed dashboard usage records are kept for 90 days and then deleted. What remains after that is daily summaries: totals per screen and per staff role, with no individual staff identities.

10. Your responsibilities as a vendor

For data about your own customers and staff, you act as the data controller. Obtain any necessary notices or consents before collecting their data through KioSnap, configure staff access responsibly, and respond to your customers' privacy requests. We assist where legally required and technically feasible.

11. Cookies & similar technologies

We use necessary cookies for authentication and security, and functional/analytics cookies to improve the Service. Browser settings can limit cookies, which may affect functionality.

12. Your choices & rights

• Access, correct, export or delete your personal data via the dashboard or by contacting us.
• Opt out of non-essential marketing communications at any time.
• Export your data before closing your account.
• Request deletion of your account and associated personal data by emailing hello@kiosnap.com from your registered email address with the subject “Delete my account”. We confirm the request, then delete or de-identify your data as described in section 9. Deleting the app from your phone alone does not delete your account.

13. Children

The Service is not directed to individuals under 18.

14. Changes to this policy

We may update this policy periodically and will revise the “Last updated” date when we do. For significant changes we will notify vendors directly.

15. Contact us

For any privacy question, data request or grievance, email hello@kiosnap.com. We acknowledge requests and respond within the timelines required by applicable law. If you are not satisfied with our response, you may escalate to the relevant data protection authority.