Privacy Policy

Restaurant owners & staff are our direct customers. For account, billing, support, and staff data relating to your organisation, Shopifire is the Data Fiduciary (and "data controller" where that term applies).

Diner / end-customer data submitted through a restaurant's QR menu (orders, delivery address, optional sign-in) is processed on the restaurant's behalf to fulfil ordering. For that data the restaurant is usually the Data Fiduciary and Shopifire is a Data Processor, as described in section 6.

We collect the personal data listed below. We use it only for the purposes stated, and we do not sell it. Where we rely on consent, you may withdraw it at any time (section 5).

• Account & identity: name, email, hashed password or Google account identifier, country, locale, avatar — to create and secure your account.
• Restaurant profile & operations: restaurant name, address, phone, branding, menu content, staff invitations, order history, payment status (never full card numbers), WhatsApp settings, and dashboard activity — to provide and support the Service.
• Diner order data: items ordered, table/room identifiers, optional name, phone, delivery address, notes, payment method selection, and Razorpay payment references; for Google-signed-in delivery customers, name, email, and profile identifier — to let the restaurant prepare, deliver, and support the order.
• Communications: support tickets, marketing inquiries (name, phone, topic, message, page URL), and optional WhatsApp order updates — to respond and, where you opt in, to send updates.
• Technical & security data: IP address, browser/device information, scan analytics, and server logs — to operate, secure, and troubleshoot the Service and to prevent fraud or abuse.

We do not intentionally collect special-category data (such as health, biometric, caste, or religious data). Please do not submit it in order notes, support tickets, or menu content.

Providing account data is necessary to create an account and use the dashboard. Diner data is necessary to place and fulfil an order; without a phone number or delivery address, a delivery order cannot be completed.

Under the DPDP Act we process personal data on the basis of your consent, or for certain legitimate uses permitted by law (for example, performing a contract with you, complying with a legal obligation, responding to a medical emergency, or protecting safety). Where we rely on legitimate uses, we limit processing to what is necessary for that purpose.

• Provide, maintain, and improve the Service
• Authenticate users and prevent fraud or abuse
• Process orders and route payments through configured providers
• Send transactional email and optional WhatsApp updates you enable
• Provide AI features you request (menu import, translation, image generation)
• Respond to support requests and meet legal, tax, and accounting obligations
• Produce aggregated, non-identifying analytics for product improvement

We do not use your personal data for automated decision-making that produces legal or similarly significant effects, and we do not sell personal information to advertisers.

We use only strictly necessary cookies and local storage for login, security, language preference, and core functionality. We do not use third-party advertising, cross-site tracking, or profiling cookies on the dashboard or public menus. Because we do not use non-essential cookies, we do not show a cookie consent banner. See our Cookie Policy for the full list and how to clear them.

When you create an account, you accept the Terms and this Privacy Policy, and we process account data as necessary to perform that contract. Where the DPDP Act requires consent — for example, optional WhatsApp updates or marketing — we ask separately with a clear affirmative action, and those choices are never pre-ticked. We record the time of acceptance.

You can withdraw consent at any time, as easily as you gave it:

• Reply STOP to any WhatsApp message from us, or turn off the relevant toggle in the dashboard.
• Use the privacy request form and choose "Withdraw consent".
• Email privacy@shopifire.in from the address associated with your account.

Withdrawal does not affect processing already carried out, and does not stop processing that is required by law or necessary to provide a service you have asked for (for example, completing an order you placed).

We share data only as needed to operate the Service:

• Razorpay — diner online payments and PRO subscription billing (India)
• Google — optional OAuth sign-in for owners and delivery customers
• Resend (or similar) — transactional email delivery
• Meta / WhatsApp Business API — order alerts and inquiry messages you configure
• AI providers (e.g. OpenAI, Google Gemini, Groq) — menu OCR, translation, and image generation when you use those features; content is sent only for the requested task
• Hosting infrastructure — servers and PostgreSQL database used to run shopifire.in

Subprocessors are bound by contractual confidentiality and security obligations appropriate to their role. A current list is available on request at privacy@shopifire.in. We do not disclose personal data to government or law enforcement except where required by law or a valid legal order.

For restaurants (processor terms). When you use Shopifire to collect diner orders, you instruct us to process that data on your behalf. You agree to provide appropriate notice to your customers, collect only data you need, and comply with applicable privacy law. We will process diner data only on your documented instructions, apply appropriate security, assist with data-principal requests where technically feasible, notify you without undue delay of a breach affecting your diner data, and delete or return data when you delete the restaurant or your account ends, subject to legal retention. A written Data Processing Agreement is available on request at privacy@shopifire.in.

We keep personal data only for as long as needed for the purpose it was collected, or as required by law. We then delete it or anonymise it. Our current schedule:

Closing your account anonymises your profile and removes your contact details from past orders. Restaurants you still own must be transferred or deleted first.

We use technical and organisational measures including HTTPS, hashed passwords, access controls, encryption of payment credentials, signed webhooks, and isolated authentication for diner and owner sessions. Access to production data is limited to personnel who need it. No method of transmission or storage is 100% secure; please use strong passwords and protect staff access.

If we become aware of a personal data breach, we will take steps to contain it and assess its impact. Where required by the DPDP Act, we will notify the Data Protection Board of India and each affected Data Principal without undue delay, describing the breach, the likely consequences, and the steps we are taking and that you can take. Restaurants will be notified without undue delay where the breach affects diner data they control.

Subject to applicable law, you may ask us to:

• Access a summary of the personal data we process about you and how it is shared;
• Correct inaccurate or incomplete data;
• Erase data that is no longer needed, subject to legal retention;
• Withdraw consent for processing based on consent;
• Nominate another person to exercise your rights if you die or become incapacitated; and
• Grieve about how we have handled your data.

From Account Settings → Your Data you can download a full copy of your account data or close your account. For anything else, use the privacy request form or email privacy@shopifire.in. We may verify your identity before responding. We aim to respond within 30 days.

Diners should contact the restaurant they ordered from first, because the restaurant controls that order data. We will assist restaurants in responding where appropriate.

Our Grievance Officer handles privacy requests and complaints:

• Roshan Yadav, Grievance Officer, Shopifire
• Email: privacy@shopifire.in
• Response target: within 30 days of receiving a complete request

If you are not satisfied with our response, you may complain to the Data Protection Board of India under the DPDP Act. We will cooperate with the Board and provide the information it requires.

The Service is for people aged 18 or older. Under the DPDP Act, a child is a person below 18. We do not knowingly collect or process children's data, and we do not offer verifiable parental consent. If you believe a child has provided personal data, contact privacy@shopifire.in and we will delete it.

We primarily process data in India. Some subprocessors (for example AI, email, or payment providers) may process data in other countries. Where the DPDP Act or applicable law requires restrictions or safeguards for a transfer, we apply them and do not transfer data to a country restricted by the Central Government.

We may update this policy as the Service or the law changes. We will post the new version here and update the date above. If a change materially affects how we use your data, we will provide additional notice where required. This notice is available in English; you may ask us for a translation into any language listed in the Eighth Schedule to the Constitution of India.

Privacy questions and requests: privacy@shopifire.in
General support: roshan@shopifire.in · Contact page · Privacy request form