Privacy Policy

This policy explains what personal data Zxro, India ("we", "us") collects when you visit myrestos.com (the "Website") or buy myrestos, why, and what rights you have. We are the data fiduciary under India's Digital Personal Data Protection Act, 2023, and the data controller under the EU and UK GDPR, for the data described here.

This policy doesn't cover your own deployment of myrestos. The Software runs on your infrastructure, and we have no access to the data it collects about your restaurants or their customers. For that data, you are the data fiduciary or controller and need your own privacy policy.

1. What we collect

• Purchase details. When you buy, Dodo Payments (our Merchant of Record) collects your name, email address, billing address and payment details. We receive your name, email, country, order details and tax information from Dodo Payments. We never see or store your full card, UPI or bank details.
• Messages you send us. If you email us, we keep the conversation and your contact details.
• Technical data. Our hosting provider automatically records standard server logs, such as your IP address, browser, device type, pages requested and timestamps, for security and reliability.

We don't collect sensitive data such as health, biometric or financial account data.

2. Why we use it, and our legal basis

• To process your order, deliver the code and handle refunds: needed to perform our contract with you.
• To answer your questions and send important messages about your purchase: performing our contract, or our legitimate interest in supporting customers.
• To keep tax, invoicing and accounting records: a legal obligation.
• To keep the Website secure and prevent fraud: our legitimate interest, and a legitimate use permitted under the DPDP Act.

By buying or contacting us you give us the data for these purposes. We don't send marketing emails, and we don't sell, rent or trade your personal data, or use it for automated decisions or profiling.

3. Who we share it with

We share personal data only with service providers that help us run the business, and only as needed:

• Dodo Payments: checkout, payments, invoicing, tax and fraud prevention (their privacy policy).
• Our hosting provider: to serve the Website and keep its logs.
• Our email provider: to send and receive support email.
• Embedded content: if you play the demo video, it loads from YouTube in privacy-enhanced mode (youtube-nocookie.com), and the footer avatar loads from unavatar.io. These services receive your IP address and browser details when the content loads.
• Authorities and advisers: when required by law, court order or a valid government request, or to our accountants and lawyers to meet our obligations or protect our rights.

4. International transfers

Our service providers may store or process data outside your country, including in India, the United States and the EU. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses, and we don't transfer data to any country restricted by the Government of India.

5. How long we keep it

• Order and invoice records: as long as tax and accounting laws require, generally up to 8 years, and as long as needed to confirm your License.
• Support emails: up to 3 years after our last conversation, unless you ask us to delete them sooner.
• Server logs: kept by our hosting provider for a short period, typically no more than 30 days.

6. How we protect it

We use reasonable security practices, including HTTPS everywhere, reputable providers with strong security programmes, and limited access to personal data. No system is completely secure, but if a breach affects your data, we'll notify you and the relevant authorities as the law requires.

7. Cookies

The Website doesn't use advertising, analytics or tracking cookies. Dodo Payments' checkout pages and the embedded video may set their own cookies, governed by their policies. You can block or delete cookies in your browser settings.

8. Your rights

Depending on where you live, you can ask us to:

• give you a summary or copy of the personal data we hold about you and who we've shared it with;
• correct, complete or update it;
• delete it, unless we have to keep it by law;
• restrict or object to how we use it, or give it to you in a portable format;
• withdraw consent you have given, without affecting what we did before;
• let someone else exercise your rights if you die or become incapacitated (nomination under the DPDP Act).

Email [email protected] from the address linked to your purchase. We may need to verify your identity, and we'll respond within 30 days. If you're not satisfied, you can complain to the Data Protection Board of India or, in the EU or UK, to your local data protection authority. We'd appreciate the chance to resolve it with you first.

9. Children

The Website and the Software are for adults and businesses. We don't knowingly collect personal data from anyone under 18. If you think a child has given us data, email us and we'll delete it.

10. Links to other websites

The Website links to other sites, such as X and Dodo Payments. We're not responsible for their privacy practices, so please read their policies.

11. Changes to this policy

We may update this policy, and the date at the top shows the latest version. If we make a significant change that affects you, we'll tell you by email.

12. Contact and grievances

For questions, requests or complaints about your personal data, contact our Grievance Officer:

• Seller: Zxro, India
• Email: [email protected]
• Grievance Officer: Zxro, reachable at [email protected]. We acknowledge complaints within 48 hours and aim to resolve them within one month of receipt.