Privacy Policy

From Business Accounts: email address and password (for login), business name, contact details including the owner's phone number, business address, business hours, GST identification number (GSTIN) where you enable GST, logo and banner images, and the products/categories you list.

From Customers: when placing an order on a Storefront, we collect the name, phone number, and (for delivery orders) delivery address and pincode needed to complete that order. Where a Storefront offers custom-order (quote) requests, a Customer may also upload one or more photos describing what they want. Customers do not need to create an account to order.

"Personal data" here means any information relating to an identified or identifiable person — for example, a name, phone number, or delivery address. We only collect personal data that is needed to operate a Business Account or fulfil an order, and we do not sell personal data to third parties.

Essential storage: QDroid uses browser local storage and session storage (not traditional cookies) to keep a Business Account signed in between visits and to hold transient state within a session (for example, an in-progress cart). This is strictly necessary — without it you would be signed out on every page load — and cannot be disabled without logging you out. QDroid also registers a service worker in your browser to enable offline caching and, where you allow it, push notifications (see Section 5).

Analytics cookies: QDroid uses Google Analytics 4 ("GA4") to measure aggregate site usage — which pages are visited and how often. GA4 sets its own cookies (typically prefixed _ga) to distinguish visitors between sessions. We only send GA4 the page path you visit (for example, /legal/privacy); we do not send form inputs, order details, or other personal data to GA4. Data collected by GA4 is processed by Google, subject to Google's own privacy policy.

QDroid does not use marketing, advertising, or retargeting cookies. If your browser or a tool you use (browser settings, Google's Analytics opt-out add-on, or a Global Privacy Control signal) blocks or limits analytics cookies, that choice is honoured for the analytics category; it has no effect on the essential sign-in storage described above.

Beyond the GA4 page-view measurement described in Section 3, QDroid does not use any other third-party analytics, tracking, or advertising service. The aggregate page-hit data we receive is used only for research and to improve the Platform — for example, to understand which pages are used most — and is never joined to a specific person's account or order. If this changes, this Policy will be updated before any new service is enabled.

Push notifications: if a Business Account enables browser notifications, QDroid stores a push subscription for that device (a push endpoint URL, the browser-supplied encryption keys, and the device's user-agent string), linked to the account, so we can alert the Merchant when a new order arrives. These are delivered through Amazon Web Services (see Section 11). You can turn this off at any time by revoking notification permission for the site in your browser, which removes the device's subscription.

Transactional SMS: QDroid can send order-related text messages — for example, an order confirmation or a status update — to the Customer's phone number and to the Merchant's phone number. These messages are transactional only; QDroid does not send promotional or marketing SMS. They are delivered through Amazon Web Services (Amazon SNS / AWS End User Messaging) using a DLT-registered sender ID ("QDROID") as required by Indian telecom regulations. The phone number is used solely to deliver these messages.

To help a Merchant recognise returning buyers, QDroid keeps a per-store customer list showing each Customer's name, phone number, most recent delivery address, and number of orders with that store. A Customer record is keyed on the phone number and is shared across the Platform: the name and address a Customer provides at one store can therefore appear to another store the same Customer later orders from. A Merchant may only use this data to fulfil orders and serve that Customer, as set out in our Acceptable Use Policy.

A Customer can look up their active orders on the public order-tracking page by entering the phone number they ordered with. This returns only a minimal summary of active orders (order number, status, total, order type, and the store/business name); it does not return the Customer's name or delivery address, and the phone number entered is used only as a lookup key for that request and is not stored by the tracker.

QDroid does not process online payments and does not collect or store card, UPI, or bank details. Orders are settled directly between Customers and Merchants (for example, cash on pickup or delivery), so no payment-processor data flows through the Platform today.

Business and order data is stored using Supabase (PostgreSQL database, authentication, and file storage) and served through Cloudflare's network, and order notifications are delivered through Amazon Web Services. These are our infrastructure sub-processors — we do not run our own physical servers. Images you or your Customers upload (logos, banners, product photos, and custom-order photos) are stored in Supabase Storage and served at public URLs so they can appear on the public Storefront.

Data is protected in line with our Security Policy, including row-level access controls that restrict a Business Account to its own data and encryption of data in transit via HTTPS/TLS.

We share data only with the infrastructure providers needed to run the Platform — Supabase (database, authentication, file storage), Cloudflare (hosting and content delivery), and Amazon Web Services (transactional SMS and push-notification delivery) — under their own data-processing terms, plus Google Analytics for the aggregate page-view measurement described in Section 3. We do not share Customer or Merchant data with advertisers or data brokers.

Subject to applicable law, you may request access to, correction of, or deletion of your personal data by writing to info@vanixqbit.com. Business Accounts can edit most of their own business/product data directly from the dashboard.

If you are located in the European Economic Area, you have rights under the General Data Protection Regulation, including the rights of access, rectification, erasure, data portability, and objection to processing. We honour these rights for any personal data we hold, to the extent applicable law requires, on request at info@vanixqbit.com.

If you are a California resident, you have rights under the California Consumer Privacy Act, including the right to know what personal information we hold about you and to request its deletion. We do not sell personal information. Requests can be sent to info@vanixqbit.com.

As VANIXQBIT is based in India and these Terms are governed by Indian law, QDroid processes personal data in line with India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"). We collect and use personal data for the specific purposes described in this Policy — operating a Business Account and fulfilling orders — and, where the law requires consent, we rely on the consent you give by creating an account or placing an order for those purposes.

As a Data Principal, you have the right to access a summary of the personal data we process about you, to seek its correction or erasure, to withdraw consent where consent is the basis for processing, and to grievance redressal. You can exercise these rights, or raise a grievance, by writing to info@vanixqbit.com, and we will respond within the timelines applicable under the DPDP Act.

We retain Business Account data for as long as the account is active. Order data is retained as needed for the Merchant's operational and legal record-keeping needs. If you close your account, we will delete or anonymise personal data within a reasonable period unless we are required to keep it for legal or accounting reasons.

QDroid is a business tool and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will remove it.

We may update this Policy as the Platform changes. If we make a material change, we will update the "Last updated" date above and, where reasonably practical, notify active Business Accounts (for example, by email). Continued use of the Platform after a change takes effect constitutes acceptance of the updated Policy.

Privacy questions or requests can be sent to info@vanixqbit.com.