Privacy Policy
Effective Date: October 16, 2026 | Compliant with GDPR, CCPA & DPDP
1. Overview and Scope
MR.Genious Technologies ("we", "us", or "our") is dedicated to protecting the privacy and security of merchants, employees, riders, and dining customers whose data is processed through our Restaurant ERP suite. This Privacy Policy explains what personal and operational information we collect, why we collect it, how it is safeguarded, and your statutory data rights.
2. Categories of Information Processed
A. Restaurant Merchant & Staff Data
Business names, registered GST/VAT tax identification numbers, store manager contact emails, cashier PINs, role entitlements, employee clock-in/out timestamps, and operational audit logs.
B. Dining Guest & Customer Data
Phone numbers collected during queue token check-in, delivery customer addresses, order histories, table notes, and dietary allergy tags. Note: Payment card details are tokenized by PCI-DSS Level 1 compliant gateways; MR.Genious never stores raw CVVs or card numbers.
C. Rider Fleet Geolocation Data
Real-time GPS telemetry from active delivery riders for live dispatch tower tracking and accurate estimated delivery times (ETA). Location tracking is deactivated once the delivery shift is ended.
3. Purpose of Processing
We process operational data strictly to:
- Facilitate real-time kitchen display routing, bill splitting, and tax invoice generation.
- Power automated SMS notifications for table queue token updates and delivery OTP verification.
- Detect billing anomalies, internal inventory shrinkage, and cash drawer discrepancies.
- Ensure multi-tenant isolation through Postgres Row-Level Security (RLS) policies.
4. Data Sharing & Third-Party Processors
We do not sell, rent, or trade merchant or patron data. Data is shared solely with vetted sub-processors essential for service execution:
- Cloud Infrastructure: High-availability secure cloud hosting in enterprise data centers.
- SMS/Communication: Telephony providers for token waitlist and dispatch updates.
- Payment Processors: Secure tokenized gateways for card, UPI, and digital wallet settlements.
5. Data Retention & Merchant Rights
Order transactions and tax invoices are retained in accordance with statutory accounting requirements (typically 7 years). Merchants and patrons retain the right under GDPR/DPDP to request export of their personal data or request anonymization upon business closure.
6. Data Protection Officer (DPO)
For privacy concerns, data subject access requests (DSAR), or regulatory inquiries, contact our Privacy Office:
privacy@mrgenious.com | MR.Genious Data Protection Office