Privacy Policy

Last updated: 15/08/2026

Orbitlink Innovations Pvt Ltd ("Orbitlink", "we", "us", "our") operates the FlowPlate platform (flowplate.in). This Privacy Policy explains how we collect, use, store, share, and protect personal data in connection with the Service, in accordance with the Information Technology Act, 2000, the SPDI Rules 2011, and the Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Data We Collect

From Restaurant Owners/Staff: Account details (name, mobile, email, restaurant name, address, GSTIN); payment information (processed via Razorpay, we do not store full card/UPI credentials); usage data (orders, menu items, billing records, staff activity logs, device/browser info).

From Restaurant Customers (QR ordering): Name and phone number, only if voluntarily provided; order history tied to that restaurant only.

Automatically collected: IP address, device type, log data, and cookies.

2. Purpose of Collection

To provide the Service; process payments and generate invoices; enable order management, billing, and reporting; communicate service updates, OTPs, and support; comply with legal/tax obligations; improve the Service via aggregated, anonymized analytics.

3. Legal Basis for Processing

Consent given at signup/checkout; performance of a contract; compliance with legal obligations (e.g. GST invoicing, IT Act requirements).

4. Data Sharing

We do not sell personal data. We share data only with Razorpay (payments), Fast2SMS (OTP/SMS), and cloud infrastructure providers (secure storage), or law enforcement/regulators where legally required. We do not share one restaurant's data with another.

5. Data Storage & Security

Data is stored with access controls, encrypted connections (TLS/HTTPS), and role-based OTP authentication. No system is completely secure, and we cannot guarantee absolute security.

6. Data Retention

We retain personal data while your account is active and for a reasonable period thereafter to comply with tax/accounting obligations, after which it is deleted or anonymized unless a longer period is legally required.

7. Your Rights

Under the DPDP Act, 2023 you may: access your data; request correction; withdraw consent; request erasure (subject to legal retention); nominate another person to act on your behalf in case of death or incapacity. Contact our Grievance Officer to exercise these rights.

8. Children's Data

The Service is intended for business use by adults 18 years or older. We do not knowingly collect data from children.

9. Cookies

See our separate Cookie Policy for details.

10. Grievance Officer

Name: Deepu S — Email: support@orbitlink.in — Address: Orbitlink Innovations Pvt Ltd, Building No. 5/257A8, Basement Floor, Pallath Square, FACT Kalamassery Rd, Kalamassery P.O, Ernakulam — 683104, Kerala, India. We acknowledge complaints within 24 hours and resolve within 15 days.

11. Changes to This Policy

We may update this Policy periodically; material changes will be notified via email or in-app notice.