Privacy Policy

Kinxso Technologies (“we”, “our”, “us”) operates RestaurantOS at restaurantos.kinxso.com (“the Service”). This Privacy Policy explains how we collect, use, disclose, and protect information when you use the Service. By using the Service, you agree to the practices described in this Policy.

Account Information: When you register, we collect your name, email address, restaurant name, phone number, and password (hashed — never stored in plain text).

Business Data: Menu items, orders, customer records, inventory data, financial records, and other data you enter into the Service.

Payment Information: When you subscribe to a paid plan, payment is processed by Stripe. We receive confirmation of payment status and a Stripe subscription ID; we never receive or store full card numbers or CVVs.

Usage Data: Server logs, IP addresses, browser type, pages visited, and timestamps, collected automatically to operate and improve the Service.

Device & Authentication Data: Session tokens stored in secure, HttpOnly cookies on your browser. No tracking cookies or advertising pixels are used.

We use the collected information to:

• Provide, maintain, and improve the Service
• Process payments and manage subscriptions
• Send transactional emails (password reset, receipts, critical alerts)
• Provide customer support
• Monitor and protect against fraud, abuse, and security threats
• Comply with legal obligations

We do not use your data for advertising purposes or sell it to third parties.

We share data only with:

• Stripe — for payment processing and subscription management
• Google (OAuth) — if you choose to sign in with Google; we receive only your email address and profile name
• Cloudinary — for storing images you upload (menu items, restaurant logo)
• FBR API — only if you enable FBR integration; sales invoices are submitted directly to the Federal Board of Revenue as required by Pakistani tax law
• Law enforcement — only when required by a valid court order or applicable law

We retain your account and business data for as long as your account is active. If you close your account, we retain your data for up to 30 days to allow for recovery, after which it is permanently deleted from our systems — unless we are legally required to retain it longer (e.g., financial records).

We implement industry-standard security measures including:

• TLS/HTTPS encryption in transit for all Service communications
• Encrypted database connections and at-rest encryption for sensitive fields
• Hashed passwords (not reversible)
• HttpOnly, Secure session cookies to prevent XSS token theft
• JWT tokens with short expiry and secure refresh token rotation
• Optional TOTP-based two-factor authentication (2FA)

No system is completely secure. In the event of a data breach that affects your personal data, we will notify you by email within 72 hours of becoming aware of the breach, in accordance with applicable law.

We use a single session cookie (ros_session) to maintain your login state. This cookie is:

• HttpOnly — inaccessible to JavaScript
• Secure — only transmitted over HTTPS
• SameSite=Strict — prevents CSRF attacks

We do not use advertising cookies, analytics cookies, or third-party tracking cookies.

Depending on your location, you may have the right to:

• Access — request a copy of your personal data
• Correction — request correction of inaccurate data
• Deletion — request deletion of your account and data
• Portability — request an export of your business data
• Objection — object to certain processing activities

To exercise any of these rights, contact us at privacy@kinxso.com. We will respond within 30 days.

The Service is not directed to children under 13 years of age. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us at privacy@kinxso.com.

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.

We may update this Privacy Policy from time to time. We will notify registered users by email or in-app notification at least 14 days before material changes take effect. The “Effective date” at the top of this page will be updated accordingly.

For privacy-related questions or requests, contact our Privacy team at:

Kinxso Technologies — Privacy Team
Email: privacy@kinxso.com
Website: restaurantos.kinxso.com