1. Overview & Roles
This Data Processing Policy ("Policy") establishes the data protection framework governing the relationship between restaurant operators ("Data Controller") and WaitQ ("Data Processor").
When a restaurant subscriber uses WaitQ to manage customer waitlists, issue KOTs, or send digital receipts, the restaurant operator retains full control over customer data instructions, while WaitQ acts as the processor.
2. Scope of Processing
WaitQ processes data solely to deliver restaurant POS, waitlist, and SaaS management services, including:
- Storing customer waitlist check-ins, party sizes, and phone numbers.
- Sending automated queue notifications and table readiness alerts via WhatsApp/SMS.
- Processing order line items, bill totals, tax details (GST), and KOT print queues.
- Managing staff permissions, roles, and transaction authorization logs.
3. Approved Sub-Processors
WaitQ engages vetted infrastructure sub-processors to fulfill platform functionality:
| Sub-Processor | Role & Function | Data Processed |
|---|---|---|
| Supabase | Cloud Database & Auth Infrastructure | Multi-tenant database records and encrypted user sessions |
| Razorpay | Subscription Billing & Payment Gateway | SaaS mandates, bill payment reference numbers, billing contacts |
| Resend | Transactional Email Delivery | Account verification emails and system alerts |
| Upstash | Redis Caching & API Rate Limiting | IP rate limits and session cache keys |
| WhatsApp Cloud API | Customer Messaging Infrastructure | Customer phone numbers and queue notification payloads |
4. Security Safeguards
WaitQ implements technical and organizational measures to ensure data confidentiality:
- Multi-tenant logical isolation enforced via Supabase Row-Level Security (RLS).
- HTTPS TLS 1.2+ encryption for all data in transit.
- Strict role-based access checks (`assertRole`, `requireStaffContext`) on server APIs.
- API key authentication for local desktop print bridge utilities.
5. Purging & Account Deletion
- Customer Phone Numbers: Queue phone numbers are automatically purged 30 days post-visit.
- Tenant Account Deletion: Upon restaurant owner deletion request, tenant data is permanently purged within 14 days.
6. Contact Us
For data processing inquiries or compliance requests:
Legal Entity: [LEGAL ENTITY NAME]
Privacy Desk: waitlist14@gmail.com
Support Email: waitlist14@gmail.com