Tapezy

தனியுரிமைக் கொள்கை

Last updated: 24 September 2026

At Tapezy ("Tapezy", "we", "us", "our") we respect your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with and the choices and rights you have. It applies to our website tapezy.in, the Tapezy dashboard, and all customer-facing pages and QR codes we provide (the "Services"). It is written with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000 and its rules in mind.

1. Who This Policy Covers

  • Businesses – owners and staff who create a Tapezy account and use our dashboard.

  • Customers – members of the public who scan a Tapezy QR code, get a review suggestion, join a waiting queue or view or order from a QR menu.

  • Visitors – anyone browsing tapezy.in or contacting us.

2. Information We Collect from Businesses

  • Account details: name, email address, Indian mobile number, password (stored only as a secure one-way hash) and, if you use them, basic profile details from Google or Apple sign-in (name and email).

  • Business details: business name, categories, address, Google listing and place information, keywords, logo, banners, photos, menu items and prices, opening hours, social media links, staff notification numbers, your UPI ID (if you add one for menu orders) and any custom messages or AI instructions.

  • Billing details: the Plan you choose, billing name and address, GSTIN (if provided), invoices, coupons used and payment status. Payments are processed by Razorpay; we receive only payment references and status, never your full card, UPI PIN or bank login details.

  • Communications: messages you send us through the contact form, email, phone or WhatsApp, and your support history.

  • Security and usage data: login activity, OTP requests, IP address, browser and device information, and actions taken in the dashboard, used to keep accounts secure and prevent abuse.

3. Information We Collect from Customers

Customers never need to create an account or install an app. Depending on which product they use, we collect:

  • Review pages (AI Review Assistant): no name, phone or login is required. When the QR code is scanned we record anonymous scan analytics – date and time, approximate location (country, region, city), device type, browser, operating system, referring page and a one-way hashed identifier derived from IP address and browser – so the business can see how its QR code is used. The Customer posts the review directly on Google; Tapezy does not see their Google account or the review they post.

  • Waiting queue: name, mobile number, party size, token number, join time and status (waiting, called, served or removed), so the Customer can hold their place and receive alerts.

  • QR menu orders: name, mobile number, order items, special instructions, table number, pickup time and, for delivery, the delivery address and location the Customer chooses to share (used to check the business's delivery radius).

For this Customer data, the business the Customer interacts with decides why it is collected and how it is used, and Tapezy processes it on the business's behalf to provide the Services. Businesses can see their own Customers' queue and order records in their dashboard.

4. Information from Website Visitors

  • Details you submit through our contact form (name, email, phone, business and message).

  • Technical data such as IP address, browser type, pages visited and referring website, collected through server logs and, where enabled, analytics tools.

5. How We Use Information

  • To create and secure your account, verify your mobile number and email by OTP and let you log in.

  • To provide the Services: generate QR codes, show review pages and menus, run queues, send order and queue alerts, and generate AI review suggestions, dish descriptions and images.

  • To process payments, manage subscriptions, issue invoices and apply coupons.

  • To send service messages such as OTPs, payment receipts, trial and renewal reminders, failed-payment notices, low-credit alerts, security notices and important changes to our Services or policies.

  • To show businesses analytics about scans, reviews, queues and orders.

  • To provide support and respond to your questions.

  • To detect, prevent and investigate fraud, spam, abuse and security incidents (for example rate limits on OTPs and logins).

  • To improve and develop our products, mostly using aggregated or anonymised data.

  • To comply with legal, tax and accounting obligations and to enforce our Terms & Conditions.

  • With your consent, to send occasional offers or product news. You can opt out at any time.

6. Artificial Intelligence

To generate review suggestions, menu descriptions and dish images we send the relevant business information – such as business name, categories, keywords, language, dish names and any custom instructions – to our AI provider (OpenAI). We do not send Customers' names, phone numbers or addresses for AI generation. Under our AI provider’s API terms, this data is not used to train its models. AI output is generated automatically and should be reviewed by the business.

7. How We Share Information

We do not sell your personal data or your Customers' personal data. We share information only as follows:

  • With the business: Customer queue and order details are shared with the business the Customer chose to interact with.

  • With service providers who process data for us under confidentiality and security obligations, only as needed to provide their service:

    • Razorpay – payment processing;

    • MSG91 and WhatsApp (Meta) – SMS and WhatsApp messages, including OTPs and alerts;

    • Email providers (such as Zoho Mail) – OTP, billing and service emails;

    • OpenAI – AI text and image generation;

    • Google – business search, Maps and Places data, sign-in, anti-spam checks (reCAPTCHA on some forms) and, where enabled, analytics;

    • Apple – sign-in;

    • Cloud hosting, database and storage providers – running the Services.

  • Publicly, by your choice: your business name, logo, menu and review page are visible to anyone with your link or QR code.

  • For legal reasons: when required by law, court order or a government authority, or to protect the rights, property or safety of Tapezy, our users or the public.

  • Business transfers: if Tapezy is involved in a merger, acquisition or sale of assets, information may be transferred subject to this Policy.

8. Messages You May Receive

  • Businesses: OTPs, account and security messages, payment receipts, invoices, trial reminders, renewal and failed-payment reminders (which may include a reactivation offer), low-credit alerts and new-order alerts. These are necessary to run your account.

  • Customers: only the messages linked to what they did – for example a queue confirmation, a "you are next" alert and a "your turn" alert, or an order confirmation and status updates. Tapezy does not send marketing messages to Customers.

9. Cookies and Similar Technologies

  • Essential cookies: we use a secure, HTTP-only session cookie to keep you logged in, and similar small cookies to remember choices such as where to send you after login. The Services do not work properly without them.

  • Analytics and marketing tools: on public pages we may use analytics or advertising tools (such as Google Analytics or Meta Pixel) that set their own cookies to understand visits and measure campaigns. These are not used inside the signed-in dashboard.

  • You can block or delete cookies in your browser settings, but you may then be unable to log in.

10. How We Protect Information

  • All traffic to and from Tapezy is encrypted with HTTPS/TLS.

  • Passwords are stored as one-way hashes, OTPs are stored only in hashed form and expire quickly, and sensitive keys and settings are encrypted at rest.

  • Scan analytics use hashed identifiers instead of raw IP addresses.

  • Access to production systems is restricted to authorised personnel, and we use rate limits and monitoring to prevent abuse.

  • Payment data is handled by Razorpay, which is PCI-DSS compliant.

No system is completely secure. If a personal data breach affects you, we will notify you and the relevant authorities as required by law.

11. How Long We Keep Information

  • Account and business data: for as long as your account is active. If you close your account, we delete or anonymise it within 90 days, except what we must keep by law.

  • Billing and invoice records: as long as required by Indian tax and accounting laws (typically up to 8 years).

  • Customer queue and order records: kept for the business's record history and removed when the business's account is closed. Unfinished queue tickets are automatically closed after 24 hours.

  • OTPs and security logs: OTPs expire within minutes; security and rate-limit records are kept only as long as needed to prevent abuse.

  • Contact-form messages: as long as needed to answer you and for a reasonable period afterwards.

12. Your Rights

Subject to applicable law, including the DPDP Act, you have the right to:

  • access a summary of the personal data we hold about you and how it is used;

  • correct or update inaccurate or incomplete data (most business details can be edited directly in your dashboard);

  • request erasure of your personal data and closure of your account;

  • withdraw consent you have given (for example to marketing), without affecting processing already done;

  • nominate another person to exercise your rights in the event of your death or incapacity;

  • raise a grievance with us and, if not satisfied, with the Data Protection Board of India.

To exercise these rights, email care@tapezy.in from your registered email address. We may need to verify your identity before acting on your request. Customers who joined a queue or placed an order with a business should contact that business first; we will help the business respond, or you can contact us directly.

13. Children

Tapezy accounts are for businesses and people aged 18 or over. We do not knowingly collect personal data from children to create accounts. If you believe a child has given us personal data, please contact us and we will delete it.

14. Where Data Is Processed

Tapezy is operated from India. Some of our service providers (such as cloud hosting, email and AI providers) may store or process data on servers outside India. Where this happens, we take reasonable steps to ensure the data is protected in line with this Policy and applicable Indian law.

15. Third-Party Links

Our pages may link to other websites, such as Google Maps, Swiggy, Zomato or social media. Their privacy practices are governed by their own policies, and we are not responsible for them.

16. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top shows the latest version. For significant changes we will notify businesses by email or in the dashboard.

17. Grievance Officer and Contact

If you have any questions, requests or complaints about this Policy or how your data is handled, please contact our Grievance Officer. We aim to acknowledge requests within 48 hours and resolve them within 30 days.

  • Email: care@tapezy.in

  • Phone / WhatsApp: +91 81414 58858 (Mon–Sat, 10 AM – 6 PM IST)

  • Address: B-1009, Empire Business Hub, Near Shukan Mall, Science City, Ahmedabad, Gujarat, India