Privacy Policy

This Privacy Policy explains how Ashok Infotech ("we", "us") handles personal data in QuickQueue (the "Service"). It follows India's Digital Personal Data Protection Act, 2023 ("DPDP Act").

1. Whose data, and our role

• Businesses and their staff who sign up and sign in. For this data, we decide how it is used, so we are the Data Fiduciary.
• Customers of those businesses — for example patients or clients who take a token at a kiosk, at the reception desk or through a tracking link. The business decides what it collects about them, so the business is the Data Fiduciary and we are its Data Processor. If you are a customer, the business you visited is your first point of contact for your data; we will help them respond to you.

2. What we collect

• Account details: name, email address, phone number, business name and address, and your password (stored only in encrypted, hashed form).
• Usage and security records: IP address, browser type, sign-in times, and a log of important actions taken in an account.
• Queue data entered by businesses: a customer's name, phone number or email address (all optional), token numbers, service chosen, times of arrival, call and completion, and any notes the business adds.
• Device data: the name and last-seen time of screens and kiosks a business connects.

We do not ask for payment card details, government ID numbers or health records.

3. How we use it

• to run the Service: queues, screens, kiosks and tracking pages;
• to send service messages, such as email confirmation, password resets, token tracking links and a one-time reminder to an account owner who has not started using the Service a day after signing up;
• to keep the Service and accounts secure and to prevent misuse;
• to provide support when you ask for it;
• to understand overall usage and improve the Service, using combined figures that do not identify anyone;
• to meet legal obligations.

We do not sell personal data, show advertising, or send marketing to businesses' customers.

4. Cookies

The Service uses the cookies it needs to work: a session cookie that keeps you signed in, and a security cookie that protects forms.

On our own website pages (the home, industry, pricing, FAQ, help, support, demo, sign-up and legal pages) we also use the Meta Pixel, run by Meta Platforms, and the Google tag, run by Google, to measure how well our advertising works. They set cookies and tell Meta and Google which of these pages you visited and whether you started the demo or created an account. We do not send them your name, email or phone number. Neither is ever loaded on a business's pages for its customers (booking, tracking, kiosk and display screens) or inside the staff area, so customers' visits to a business are never shared with Meta or Google. You can block them with your browser's privacy settings or an ad blocker, and manage how they are used in your Facebook, Instagram and Google ad settings.

5. Who we share it with

• Service providers who help us run the Service, such as our hosting and email providers, under contracts that require them to protect the data;
• Meta Platforms and Google, for visitors to our own website pages, as described in section 4;
• authorities when the law requires us to;
• a successor if the Service is transferred to another operator, who must keep this policy's promises.

Each business can see only its own customers' data. Businesses never see each other's data.

6. Where it is stored

Data is stored on servers operated by our hosting provider. If data is processed outside India, we do so only as permitted under the DPDP Act.

7. How long we keep it

• Account and queue data are kept while the business's account is open. When a business closes its account (the owner can do this in Settings), it is taken offline at once and its data is erased from the live system after 7 days. Remaining copies in backups are gone within 90 days, unless the law requires us to keep something longer.
• Security and activity logs are kept for up to 12 months.

8. How we protect it

We use HTTPS encryption, hashed passwords, access controls, strict separation between businesses' data, and activity logs. No system is perfectly secure; if a personal data breach happens, we will notify affected businesses and the authorities as the DPDP Act requires.

9. Your rights

You can ask to access, correct or erase your personal data, withdraw consent where we rely on it, nominate someone to act for you, and raise a grievance. Business account holders can write to us directly. Customers of a business should contact that business first; we will support it in responding. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

10. Children

The Service is meant for businesses, not children. When a business serves children, it is responsible for obtaining consent from a parent or guardian where the law requires.

11. Changes to this policy

We may update this policy. For important changes we will notify account owners by email or in the app before they take effect.

12. Grievance officer

Jenith Thakkar, care@quickqueue.in. We aim to respond within 7 days and resolve grievances within the time the law requires.