Privacy Policy
Version 1 · Last updated: 16 October 2026
DRAFT FOR LEGAL REVIEW. This version is being reviewed by our lawyer and is not yet in force. The open questions for the review are listed at the end of the English text.
The English text is the binding version. The Telugu text below is a summary, not a full translation.
Qflow is a queue and booking service for Indian businesses and organizations: salons, clinics, hospitals, restaurants, temples, banks, government and service centres, schools and colleges, corporate desks, retail stores and events. It is built and run by Sri Moksha Software Developers, a sole proprietorship based in Guntur, Andhra Pradesh, India, registered as an MSME ("Qflow", "we"). This policy explains what personal data we collect, why, who sees it, how long we keep it and your rights. It follows India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"). By signing in you consent to the processing described here for these purposes; you can withdraw consent at any time (section 7).
1. What we collect
- Your mobile number. You sign in with a one-time password sent to it. We do not use passwords.
- Your name, if you add one, so the business can call you by name.
- Your location, only when you allow it on your phone or browser, to show businesses near you. It is used only to look up businesses near you (the search sends an approximate area, not your exact position) and is not saved to your account; we do not keep a history of where you have been. You can say no and search by area instead.
- A device token for your phone or browser, so we can send notifications such as "you are next". You can switch notifications off at any time.
- A mobile number typed at the counter. When you join a queue or book at a business's counter, its staff may type your mobile number for you, even if you have no Qflow account. It is used to send you your token on WhatsApp and, if you later sign in to Qflow with that number, to move the token or booking into your account. If nobody signs in with it, it is deleted automatically within 7 days.
- Your tokens and bookings: which business, which service, the date and time, your party size if any, and what happened (served, cancelled, missed).
- Payment references. Payments are handled by our payment gateway, Razorpay. We never see or store your card number, UPI PIN or bank login; we keep only the payment reference, the amount, refunds and whether the payment succeeded.
- If you run or work for a business on Qflow: the business's name, address and map location, opening hours, services and prices, staff names and mobile numbers, and, if it takes deposits, the bank payout details it gives Razorpay (we keep only Razorpay's account reference and status).
- Technical data needed to keep the service working: device type, app version, error reports and security logs, including an audit record of actions taken in the business console. We do not use advertising trackers.
2. Why we use it
- To issue your token or booking and show the business that you are coming.
- To tell you when your turn is near, and about changes (the queue was paused, closed or reopened, or the business cancelled).
- To show you businesses near you, when you allow location.
- To collect the Qflow platform fee and any deposit or prepayment a business asks for, and to issue refunds and credit.
- To keep Qflow secure, prevent abuse (for example repeated no-shows or fake bookings) and fix faults.
- To meet legal duties, such as keeping payment and tax records and answering lawful requests.
We do not sell your personal data, and we do not use it for third-party advertising or share it with data brokers.
3. Who can see it
- The business you take a token or booking with, and its staff: your name, your token or booking, whether you turned up, and your mobile number. On queue tokens they see the number only partly hidden (for example 98•••••001); on bookings they see it in full. They need this to serve you and to reach you about your visit, and may use it only for that purpose (our Partner Terms require it). The TV display board in the business shows only your token number, not your name or number. When staff send you your token on WhatsApp, your full number is used once to open the chat on their device; Qflow does not send you advertising.
- Our service providers, who process data only on our instructions: Google Firebase and Google Cloud (hosting, database and notifications, in the Mumbai region), the SMS provider that sends one-time passwords, and Razorpay for payments.
- Authorities, only when the law requires it.
4. Where it is stored
Our database and servers are in Google Cloud's Mumbai region in India. Some of our providers may process data outside India where the law allows it.
5. How long we keep it
| Data | How long |
|---|---|
| Your account, name and number | While your account is active; deleted or anonymised within 30 days of a deletion request. You can cancel during those 30 days. |
| Token and booking history | While your account is active; the business's copy is anonymised when you delete your account |
| A mobile number typed at the counter for someone who has not signed in | Up to 7 days, then deleted automatically |
| Device tokens | Until you sign out, switch notifications off or the token expires |
| Location | Not stored by us |
| Payment and refund records | Up to 8 years, as tax and payment law requires |
| Security and audit logs | [RETENTION PERIOD] |
We may keep records needed to resolve an open dispute or complaint until it is closed.
6. Security
Data is encrypted in transit and at rest, access is limited by role (a business sees only its own customers; staff see only their branch), and every change to tokens, bookings and payments is made by our servers and logged. If a breach affects you, we tell you and the Data Protection Board as the DPDP Act requires.
7. Your rights
- See a summary of the personal data we hold about you and who it was shared with.
- Ask us to correct, complete or update it.
- Ask us to delete your account and data (subject to the records the law requires us to keep): in the app (Profile → Delete my account) or at qflow.in/delete-account.
- Withdraw consent at any time: switch off location or notifications in your phone settings, or delete your account. Withdrawing does not affect what was done before.
- Nominate someone to exercise these rights for you if you die or become unable to.
- Complain to our Grievance Officer (section 10). If you are not satisfied with our answer, you may approach the Data Protection Board of India.
8. Children
Qflow accounts are for people aged 18 and above. We do not knowingly create accounts for children, and we do not track them or target them with advertising. A parent or guardian may take a token or booking for a child (for example at a clinic or school) from their own account; the child's name, if entered, is processed on the parent's or guardian's instruction. If you believe a child has an account, contact us and we will delete it.
9. Cookies and storage
Our website keeps a small amount of information in your browser so that you stay signed in and the app loads faster. We do not use cookies to track you across other websites.
10. Grievance Officer
Sri Moksha Software Developers
Attn: Grievance Officer, [GRIEVANCE OFFICER NAME]
[REGISTERED ADDRESS], Guntur, Andhra Pradesh, India
Email: [CONTACT EMAIL] · Phone: +91 93912 48520 (Monday to Saturday, 10:00 to 18:00 IST)
We acknowledge every complaint within 48 hours and resolve it within 30 days.
11. Changes
When we change this policy we update the date at the top and, for important changes, tell you in the app before they apply. The current version is always at qflow.in/privacy.
Open questions for legal review
- Phone number shared with businesses. The product brief said partners see "name and token only", but today the business console stores and shows the customer's mobile number on queue tokens and bookings (to call a customer who is late, and to find a booking). This draft discloses that accurately. Should we keep it (and is "serving you" a sufficient purpose), restrict it to bookings, or mask it in the console?
- Is the business a separate data fiduciary for its customers' data, or is Qflow processing for it? This decides who answers access and deletion requests for a business's copy.
- Consent: is sign-in consent with this notice enough under the DPDP Act and Rules, or do we need a separate, itemised consent screen (and a consent manager)?
- Retention: are 30 days for deletion and up to 8 years for payment records right? What period should we state for security and audit logs?
- Children: is 18+ for accounts, with parents taking tokens for children, acceptable, or does verifiable parental consent apply when a parent enters a child's name (clinics, schools)?
- Walk-ins (added for version 1): staff may type the mobile number of a person who has no Qflow account and never saw this notice. Is the notice at the counter enough? Should the WhatsApp token message carry the link qflow.in/privacy (recommended in ADR-014 Q9), and does the counter need a printed notice as well?
- Hospitals and clinics: does a token or booking at a clinic (which reveals a visit, not a diagnosis) need extra care?
- Location: we describe it as used only for the nearby search (an approximate area is sent with the query) and not stored. Please confirm the wording before we add any feature that stores it.
- Cross-border processing by providers (SMS, Razorpay, Google): any notice or restriction needed?
- Breach notification: the timeline and form we commit to.
- Telugu (owner decision, 15 October 2026): a full Telugu translation of the Terms and the Privacy Policy is commissioned for version 1; until it exists, the English text is the binding version and the Telugu text is labelled a summary. Please confirm this is acceptable, and whether consent given in Telugu on the summary is valid.
గోప్యతా విధానం
వెర్షన్ 1 · చివరి మార్పు 16 అక్టోబర్ 2026
చట్టపరమైన సమీక్ష కోసం ముసాయిదా. ఈ వెర్షన్ మా న్యాయవాది సమీక్షలో ఉంది, ఇంకా అమలులోకి రాలేదు.
ఇది తెలుగు సారాంశం. పూర్తి పాఠం ఆంగ్లంలో ఉంది; ఆంగ్ల పాఠమే చెల్లుబాటు అవుతుంది.
Qflow ను గుంటూరు, ఆంధ్రప్రదేశ్ లోని Sri Moksha Software Developers నడుపుతుంది. మేము ఏ వ్యక్తిగత సమాచారం సేకరిస్తాము, ఎందుకు, ఎవరు చూస్తారు, ఎంత కాలం ఉంచుతాము, మీ హక్కులు ఏమిటో ఈ విధానం వివరిస్తుంది. ఇది డిజిటల్ వ్యక్తిగత సమాచార రక్షణ చట్టం, 2023 ను అనుసరిస్తుంది.
1. మేము సేకరించేది
- మీ మొబైల్ నంబర్ (OTP తో సైన్ ఇన్). పాస్వర్డ్లు వాడము.
- మీ పేరు, మీరు జోడిస్తే.
- మీ లొకేషన్, మీరు అనుమతిస్తేనే, దగ్గరలోని వ్యాపారాలు చూపడానికి. దగ్గరలోని వ్యాపారాల వెతకడానికి మాత్రమే వాడతాము, మీ ఖాతాలో సేవ్ చేయము; మీరు ఎక్కడ ఉన్నారో చరిత్ర ఉంచము.
- పరికర టోకెన్, "మీ వంతు దగ్గరలో ఉంది" వంటి నోటిఫికేషన్ల కోసం.
- కౌంటర్ వద్ద టైప్ చేసిన మొబైల్ నంబర్: మీకు Qflow ఖాతా లేకపోయినా, సిబ్బంది మీ నంబర్ టైప్ చేయవచ్చు. మీ టోకెన్ను WhatsAppలో పంపడానికి, తర్వాత మీరు ఆ నంబర్తో సైన్ ఇన్ చేస్తే టోకెన్ను మీ ఖాతాకు మార్చడానికి వాడతాము. ఎవరూ సైన్ ఇన్ చేయకపోతే 7 రోజుల్లో ఆటోమేటిక్గా తొలగిస్తాము.
- మీ టోకెన్లు, బుకింగ్లు, మరియు చెల్లింపు రిఫరెన్స్లు (కార్డ్ నంబర్, UPI PIN ఎప్పుడూ చూడము).
- వ్యాపారం నడిపితే: వ్యాపారం పేరు, చిరునామా, మ్యాప్ లొకేషన్, సేవలు, సిబ్బంది పేర్లు, నంబర్లు.
2. ఎందుకు వాడతాము
మీ టోకెన్ లేదా బుకింగ్ ఇవ్వడానికి, మీ వంతు గురించి తెలియజేయడానికి, ఫీజులు, అడ్వాన్స్లు, రీఫండ్లు నిర్వహించడానికి, Qflow ను సురక్షితంగా ఉంచడానికి, చట్టపరమైన బాధ్యతలకు. మీ వ్యక్తిగత సమాచారాన్ని మేము అమ్మము, ప్రకటనల కోసం వాడము.
3. ఎవరు చూస్తారు
మీరు టోకెన్ లేదా బుకింగ్ తీసుకున్న వ్యాపారం, దాని సిబ్బంది: మీ పేరు, టోకెన్ లేదా బుకింగ్, మీరు వచ్చారా లేదా, మీ మొబైల్ నంబర్. క్యూ టోకెన్లపై నంబర్ కొంత దాచి (ఉదా. 98•••••001) కనిపిస్తుంది; బుకింగ్లపై పూర్తిగా కనిపిస్తుంది. టీవీ బోర్డు టోకెన్ నంబర్ మాత్రమే చూపిస్తుంది. సిబ్బంది మీ టోకెన్ను WhatsAppలో పంపినప్పుడు, వారి ఫోన్లో చాట్ తెరవడానికి మాత్రమే మీ పూర్తి నంబర్ ఒకసారి వాడతాము. మా సేవా ప్రదాతలు (Google Firebase/Cloud ముంబై, OTP SMS ప్రదాత, Razorpay) మా సూచనల మేరకే. చట్టం కోరినప్పుడు అధికారులు.
4. ఎంత కాలం ఉంచుతాము
ఖాతా సక్రియంగా ఉన్నంత వరకు. తొలగించమని కోరితే 30 రోజుల్లో తొలగిస్తాము లేదా అనామకం చేస్తాము, ఆ 30 రోజుల్లో మీరు రద్దు చేసుకోవచ్చు; పన్ను చట్టం కోరే చెల్లింపు రికార్డులు 8 సంవత్సరాల వరకు. లొకేషన్ మేము నిల్వ చేయము. ఖాతా లేనివారి కోసం కౌంటర్ వద్ద టైప్ చేసిన నంబర్ 7 రోజుల్లో తొలగిపోతుంది.
5. మీ హక్కులు
మీ సమాచారం సారాంశం చూడటం, సరిచేయించడం, తొలగించమని కోరడం, ఎప్పుడైనా అనుమతి ఉపసంహరించడం (లొకేషన్/నోటిఫికేషన్లు ఆఫ్ చేయడం లేదా ఖాతా తొలగించడం), మీ తరఫున ఒకరిని నామినేట్ చేయడం, ఫిర్యాదు చేయడం. ఖాతా తొలగింపు యాప్లో (ప్రొఫైల్ → నా ఖాతాను తొలగించండి) లేదా qflow.in/delete-accountలో కోరవచ్చు. మా సమాధానం సంతృప్తి కలిగించకపోతే డేటా ప్రొటెక్షన్ బోర్డ్ ఆఫ్ ఇండియాను సంప్రదించవచ్చు.
6. పిల్లలు
Qflow ఖాతాలు 18 సంవత్సరాలు పైబడినవారికి. తల్లిదండ్రులు లేదా సంరక్షకులు తమ ఖాతాతో పిల్లల కోసం టోకెన్ లేదా బుకింగ్ తీసుకోవచ్చు.
7. ఫిర్యాదుల అధికారి
[GRIEVANCE OFFICER NAME], Sri Moksha Software Developers, [REGISTERED ADDRESS], గుంటూరు, ఆంధ్రప్రదేశ్. ఈమెయిల్: [CONTACT EMAIL] · ఫోన్: +91 93912 48520. ప్రతి ఫిర్యాదును 48 గంటల్లో స్వీకరించి 30 రోజుల్లో పరిష్కరిస్తాము.