Privacy Policy
Last Updated: June 2026 | DPDP Act (India) Compliant
In compliance with the **Digital Personal Data Protection Act (DPDP Act), India**, ExitQ (operated by its parent company, Karst Technologies Pvt. Ltd.) acts as a **Data Fiduciary**. We collect and process only the minimal personal identifiers (such as mobile numbers) required to authenticate checkout sessions and compile legal GST taxable invoices at retail outlets.
1. Data We Collect
We restrict our data collection to the absolute minimum required to perform self-checkout operations. This includes:
- Shopper Identifiers: Mobile number verified via SMS OTP.
- Transactional Metadata: Products added, unit prices, tax slabs (CGST, SGST), payment reference numbers, and timestamps.
- Browser Geolocation coordinates: Verified client-side on store entrance QR scans to validate geofence boundaries (within 100m). Note: We do not store your exact coordinate points in our database.
2. Purpose of Data Processing
We process data solely for the following specified reasons:
- Authenticating active self-checkout shopper session profiles.
- Generating legal tax-compliant invoices mapping products, quantities, and GST rates.
- Routing Razorpay API payment intents directly to the merchant’s settlement account.
- Compiling compliance analytics and inventory summaries for store administrators.
3. Lawful Basis & Consent
Under **Section 4(1) of the DPDP Act, 2023**, we process personal data based on your explicit, specific, and clear consent. When you scan an in-store QR code or request partner onboarding, you authorize us to collect details for transaction execution. Essential session processing may also be conducted under legitimate contract performance (Section 4(1)(b)).
4. Data Retention Period
We practice strict data minimization. Active checkout session tokens are purged automatically when you exit the store or finish payment. Invoices and related transactional summaries are stored securely to comply with Indian GST tax audit regulations. Personal contact submissions from query forms are kept for a maximum of **12 months** and then permanently deleted.
5. Cross-Border Data Transfers
All personal data of our users is stored on cloud database instances located within **India**. We do not transfer, copy, or process any user data outside the geographical boundaries of India, complying fully with local storage rules.
6. Children's Data & Parental Consent
In accordance with **Section 9 of the DPDP Act**, we do not knowingly collect or process personal data from children under 18 years of age without verifiable consent from their parent or legal guardian. We do not conduct behavioral tracking or targeted ads for children.
7. Third-Party sharing & Processors
We share transactional metadata only with authorized data processors essential to complete your self-checkout:
- Razorpay Payments: To route payment intents and collect UPI/card settlements.
- SMS Gateways: To route 6-digit session validation OTPs.
We do not sell, lease, or lease personal identifiers to third-party marketing companies.
8. Security Safeguards
Our database infrastructure uses strict per-store **Row-Level Security (RLS)** isolation rules in Supabase to protect data records from unauthorized access. Developer API keys, Razorpay credentials, and staff passwords are encrypted using AES-256-GCM. All connections run over secure TLS 1.3 channels.
9. Your Rights under DPDP
As a data principal, you have the right to request deletion of your shopper records, withdraw consent, or correct information. You can execute these actions by writing directly to our data grievance officer at support@exitq.in.
10. Data Protection Officer (DPO)
As required by the **Digital Personal Data Protection (DPDP) Act, 2023**, we have designated a Data Protection Officer (DPO) to oversee our compliance and address any personal data grievances. You can contact our DPO directly: