Privacy notice

This notice describes personal data and restaurant records handled by QUICKKOT TECHNOLOGIES LLP (“we”, “us”) when you use the websites quickkot.com and app.quickkot.com, the point of sale, the Android and iOS staff apps, a guest QR menu or kiosk, the Partners & Affiliates programme, or support. It sits with the Terms of Service and the Legal notice.

Who we are

QUICKKOT TECHNOLOGIES LLP operates those sites and apps. QUICKKOT TECHNOLOGIES LLP is incorporated pursuant to section 12(1) of the Limited Liability Partnership Act 2008, Government of India, with LLP identification number: ADC-1718. GSTIN: 02AABFQ5082D1ZP. For privacy requests: support@quickkot.com. The notice is interpreted under the laws of India, except where a mandatory local privacy law gives you a right this page cannot take away.

Accounts and sign-in

A restaurant account asks for a name, email, phone number, and password. The password is stored as a hash. We do not keep the plain password on our servers. Staff you invite have a name, email, role, and their own password. A sign-in code sent by email is kept only long enough to check it.

Continue with Google opens Google in the browser and returns to QuickKOT. We receive the email (and name, when Google sends it) needed to match or open the account. We do not receive your Google password. A Google account that is not on QuickKOT yet is sent to sign up on the website first.

After sign-in, a session cookie named qk_session keeps that login for up to 14 days. One live session applies to a login: a new sign-in can ask before it signs the other session out. Signing out clears the session cookie.

On the Android and iOS staff apps, Remember me keeps the email and password on that device so the login screen can fill them after a sign-out. Android keeps them in the app’s private storage. iOS keeps the email in app preferences and the password in the Keychain. That copy is not sent to us except when you sign in. A successful sign-in with Remember me turned off clears it. Removing the app clears it.

The restaurant’s records

The account holds what the restaurant puts in so the floor can run: restaurant name, address, phone, time zone, bill currency, FSSAI number, GSTIN or other tax number, website, logo, bill-header lines, and bill disclaimer. Menus, item photos, prices, taxes, categories, tables, customers, orders, kitchen tickets, bills, discounts, tokens, and reports stay on the account. Inventory, when it is on, holds suppliers, purchase bills, materials, recipes, and the cost and gross-profit figures drawn from those bills.

A customer saved at the counter or from a QR checkout has the name and phone the restaurant or the guest entered, and counts of drafts and orders. Payment mode on a ticket (cash, card, UPI, or bank) is the restaurant’s record of how that bill was taken. We do not receive the guest’s card number from the counter.

Dish and menu photos the restaurant uploads are stored so POS, the QR menu, and the kiosk can show them. The staff apps may keep a copy on the device after the first load.

Guests on the QR menu and the kiosk

A guest does not need a QuickKOT account. The menu they open, the cart, and the order are stored for that restaurant. A short session id counts a menu open and a first add-to-cart. It is not the guest’s name.

If the guest leaves a phone number, we store it on that restaurant’s customer list. If they ask for the bill on WhatsApp, that number and the bill are sent through our messaging provider. Pay now on the kiosk uses the payment gateway that restaurant has configured. Card and UPI details on that payment are collected by that gateway under its own terms. Cash stays at the counter and is recorded as cash.

QuickKOT subscription payments

The house manager pays for Economy, Premium, Enterprise, and add-ons. Checkout sends the account name, email, and phone to Razorpay so Razorpay can create the customer. The card number and CVV are entered on Razorpay’s page. QuickKOT does not receive them and does not store them.

When a card, UPI, or netbanking mandate is confirmed, we store the payment token Razorpay returns, the last four digits, the network, and for UPI the UPI id, so a later renewal can be charged. A card that was only saved, and not confirmed as a mandate, is not kept as a standing instruction. A saved card used to pay an add-on now is confirmed by the buyer on Razorpay’s page and does not by itself register a new mandate.

Invoices (plan, amount, tax, and the payment reference) are stored. A card renewal is notified to the bank before the debit. The bill-to name, email, phone, and address already on the account are what that charge uses. Stopping automatic renewal keeps the plan until the period ends. Those rules are in the Terms of Service.

If the restaurant turns on its own Razorpay keys for the kiosk, the Key ID is stored and the key secret and webhook secret are stored encrypted. The secret is not sent back to the browser.

Partners & Affiliates

The public apply form asks for first name, last name, company, website, work email, phone, and country. We keep that enquiry, and the review of it, so we can invite or decline.

An invited partner has a separate login: name, email, phone, city, and a password hash. The partner portal shows referred restaurants, commission lines, and payouts. It does not open kitchen tickets or staff logins. Payout details the partner enters — account name, account number, IFSC, and UPI id — are stored so a payout can be made. Commission and tax treatment stay as agreed on the partner file and in the Terms. We do not publish a commission rate on this page.

A signup link that contains a partner code sets a cookie named qk_sp_ref for 90 days. The restaurant is attached when the account is created, and only if that partner login is Active. Opening the login page does not attach a restaurant.

Support, appeals, and disputes

The contact form and mail to support@quickkot.com store the name, phone, email, company if you give one, subject, and message, plus later replies on that ticket. A disabled restaurant can send an appeal; the appeal text is stored on the account. On Multi-Outlet, an outlet manager can ask us to review separating that outlet from the house. That request is stored on the outlet and shown in Control Panel. It does not by itself move the subscription.

Email and messages we send

Transactional mail (sign-in codes, invitations, invoices, renewal reminders, security, and partner mail) goes through our email provider, Brevo. Signup and trial progress may be recorded there as a contact and a deal so we can send that mail. Sign-in codes, password reset, security mail, and mail about a disabled account are sent. WhatsApp bill messages, when the guest asked for one, also go through Brevo.

Staff apps and printers

The Android app and the iOS app load the same account in a web view. They tell the site they are the staff app. They do not include an advertising SDK.

Settings can look for a receipt printer. Android lists USB printers, paired and nearby Bluetooth printers, and printers on the current Wi‑Fi network at port 9100. iPhone and iPad open the system printer list and can show nearby Bluetooth printers. The printer you choose (USB identity, Bluetooth address, Wi‑Fi host, or the system printer) stays on the device and is used to send the next ticket. We do not upload the list of printers we find.

Android 11 and older asks for location permission only because that Android version requires it to scan for Bluetooth devices. The scan is marked not to use location. We do not collect your location and we do not upload it. Newer Android versions ask for Bluetooth permission instead. iOS asks for Bluetooth and local network permission so it can see printers. Those results stay on the device.

Cookies and storage on the device

We use the session cookie and the partner-code cookie described above. A short-lived cookie holds the Google sign-in return so the browser can finish that login. The website stores the chosen theme in local storage on that browser. The staff apps store the remembered login and the chosen printer as described above. Marketing pages load the scripts named in the next section, which can set their own cookies.

Measurement on the websites

quickkot.com, including this page, and the signup page on app.quickkot.com use Google Ads measurement and Vercel Analytics. They count visits and whether a visit reaches signup. The Android and iOS apps do not include those measurement tools. Pages opened inside the app are the QuickKOT site, which uses the session cookie and does not add a separate advertising SDK in the app.

We do not sell personal information. We do not show third-party ads inside the staff apps.

Who else handles data

Razorpay handles subscription checkout and, when a restaurant has connected it, kiosk payments. Google handles Google sign-in, and Google Ads measurement on the marketing site and the signup page. Brevo handles email and WhatsApp bill messages. Vercel hosts the sites and provides analytics on the marketing site. A guest’s WhatsApp app receives the bill when they asked for it. A bank or UPI app receives a mandate or a payout under its own terms. We share data when the law requires it, or to protect the service and our users.

Those providers may process data in India and in other countries where they operate. Their own terms apply to the part they handle.

How long we keep it

Account, menu, order, inventory, and invoice records stay while the account is open, and afterwards for as long as tax, accounting, or a dispute needs them. A disabled account keeps kitchens, outlets, and past orders so it can be paid and turned back on. After the account ends, we may delete data once a reasonable retention period has passed, unless the law requires us to keep it. Payment tokens stay until the saved payment is removed or the account ends. Support tickets and partner enquiries stay for as long as we need them to handle the request and our own records. The partner-code cookie lasts 90 days. Remember me and the printer choice last until you clear them or remove the app.

Security

The sites are served over HTTPS. Passwords are hashed. Razorpay key secrets for a restaurant’s kiosk are encrypted at rest. No method of storage is perfect. You are responsible for keeping staff passwords and the devices that remember a login under your control.

Your requests

You can ask for a copy of your personal data, a correction, or deletion by writing to support@quickkot.com. We may need to confirm you control the account. We can refuse or limit a request where the law allows it, including where we must keep an invoice, a payment record, or a record of abuse. Closing a staff login or a partner login is done in the product or by that same email. Guest data held for a restaurant is that restaurant’s record; the restaurant handles guest requests, and we help the account owner when they ask.

This service is for restaurant staff, guests ordering food, and business partners. It is not directed at children.

Changes

We will update this page when the practices change, and change the date at the top. Continued use after that date is how you see the current notice. A material change may also be sent to the account email.

Contact

Privacy questions and requests: support@quickkot.com.