Privacy Policy

Last updated: November 5, 2026

This Privacy Policy explains how ThaiQROrder ("we", "our"), run by Yimtor Company, collects and uses information when you use our service at https://www.thaiqrorder.com/en, the ThaiQROrder app for shops, the owner portal at https://www.thaiqrorder.com/owner, shop websites at your-name.thaiqrorder.com, and the customer menu pages reached by scanning a restaurant's QR code.

1. Who we are

ThaiQROrder is a software-as-a-service platform that lets Thai restaurants and small businesses accept orders through QR codes. Customers scan a QR code on a table to view a menu and place an order directly with the restaurant. We do not operate the restaurants themselves; we provide the software.

2. Information we collect

2.1 Business owners

When a restaurant owner signs up and uses the app or the owner portal, we collect:

Phone number (used as the primary identifier and for OTP login)
Store name, website address, category, region, address and map location, and the contact details the shop enters
Menu items, categories, prices, and optional images uploaded by the owner
Business hours, table settings, the shop's PromptPay number, and a PromptPay QR image if uploaded
Login activity and IP address for security purposes
A push notification token (via Firebase / Google) used to deliver new-order alerts to the owner app
Staff details the owner enters (names, phone numbers, pay rates and clock-in/out times); the shop controls this data and we process it on its behalf
Staff accounts (2.0): the name and phone number of each staff member the owner adds, the permissions given, whether the invitation was accepted, and sign-in activity
If the shop connects its own Stripe account (2.0): the Stripe API keys it pastes (stored encrypted), the webhook signing secrets, and the Stripe account ID, name, email and country when the key allows reading them
Accounting and stock records the shop enters in the owner portal: expenses, receipt photos (stored privately and shown only to the shop), suppliers and their tax IDs, ingredients, recipes, counts and waste

2.2 Customers placing orders

Customers do not create an account. We keep only what an order or a booking needs:

Ordering at the table by QR: table number, items, options, total and any notes. No name or phone number is asked for
When a customer taps "I have paid": the time and amount reported, so the shop can check the transfer
Pickup or delivery orders on a shop website: name, phone number and, for delivery, the delivery address, so the shop can reach the customer and deliver
Table bookings on a shop website: name, phone number, email, party size, date, time and notes, so booking updates can be emailed
Language preference and cart contents (stored locally in the browser)
Online payments through the shop's own Stripe account (2.0): the amount and what it paid for (the bill, a share, dishes or an order), its status, the payment method type and, for cards, the brand and last four digits, the email address the customer gave Stripe, any refunds, and Stripe's reference IDs. Card numbers and bank details are entered on Stripe's own page and never reach ThaiQROrder
The waiting list at the door: the ticket number, party size and any nickname staff type. If a customer taps "Alert me when it’s my turn" on the ticket page and allows notifications, the browser’s notification address for that ticket (it goes through the browser maker’s push service, such as Google or Apple) so the call reaches the phone. It is deleted within 2 days

2.3 Website visitors

When you open our pages, we collect standard server logs (IP address, browser user agent, referrer, requested URLs) for security and reliability. We use Cloudflare as a CDN / WAF, which may process request metadata on our behalf. We also count visits with Cloudflare Web Analytics on this website, the owner portal, shop websites and the customer menu pages. It records the page address, the site you came from, your browser, operating system and device type, your country and how quickly the page loaded. It sets no cookies, uses no local storage and does not follow you across other websites, and we see only totals, such as how many visits a page had and whether they came from a search engine, an AI assistant or social media.

2.4 Contact form

If you submit an inquiry through our contact page, we collect the name, email, optional phone, subject, and message you provide, together with your IP address and a Cloudflare Turnstile anti-bot token.

3. How we use information

To deliver the QR ordering service and route orders to the correct restaurant
To authenticate business owners via one-time codes sent by SMS
To send transactional notifications (order and booking alerts to the shop's app, booking status emails to customers, and webhooks a shop has set up)
To provide analytics, billing, and support
To prevent abuse, spam, and security incidents

4. Payments

Customers pay the restaurant directly: in person, by PromptPay transfer, cash on delivery or, where the restaurant has connected its own Stripe account (ThaiQROrder 2.0), online on Stripe's secure payment page straight into the restaurant's Stripe account. Stripe processes those online payments under its own privacy policy. ThaiQROrder never receives card numbers or bank details and never holds the money; it keeps only the payment record described in section 2.2, so the restaurant's app, bills and books show what was paid. Monthly subscription fees paid by business owners to ThaiQROrder are billed separately.

5. Sharing

We do not sell personal data. We share information only with:

The restaurant a customer ordered from or booked with (the details of that order or booking)
Infrastructure providers we use to run the service (hosting, database, CDN and visit counting via Cloudflare, email, SMS, file storage, push notifications via Firebase / Google)
Stripe, when a restaurant has connected its own Stripe account and a customer pays online: the amount, the bill or items being paid, and our order and shop references
Law enforcement or regulators when required by law

6. Cookies and local storage

We use minimal cookies: for signing in to the owner portal and admin, and to remember page preferences. The customer menu uses localStorage to remember language preference and cart contents between page loads on the same device. Visit counting (section 2.3) uses no cookies or local storage. No third-party advertising cookies are set.

7. Data retention

Business owner accounts and their menu data are retained while the account is active. Order records are retained for at least one year for accounting and dispute resolution. When a store is deleted, associated assets (QR codes, menu images, store images) are removed from our storage. Contact form submissions are retained for up to 12 months.

8. Security

Traffic is served over HTTPS. Passwords and session tokens are hashed or encrypted. Database access is restricted to authorised personnel. We apply security updates regularly and review our infrastructure for vulnerabilities. However, no system is perfectly secure, and we cannot guarantee absolute security.

9. Your choices

You may:

Request a copy of the personal data we hold about you
Ask us to correct or delete your personal data
Withdraw consent to non-essential processing at any time

Requests can be submitted through our contact page.

10. Children

ThaiQROrder is intended for businesses and adult customers. We do not knowingly collect personal information from children under 13. If you believe a child has submitted information to us, please contact us and we will remove it.

11. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of the page indicates when the policy was last changed. Continued use of the service after changes constitutes acceptance.

12. Contact

Questions about this Privacy Policy can be submitted through our contact page.

ThaiQROrder is run by Yimtor Company, No. 99, OSC Building 4F, Moo 5, Kingkaew Rd, Racha Thewa, Bang Phli, Samut Prakan 10540, Thailand.