Privacy Policy

1. About this policy

This policy explains how MR Industry, which operates InCue, handles personal data through the InCue website, merchant app, staff and dashboard apps, TV display app, QR token pages, tracking pages, WhatsApp/SMS messages and admin tools. We are implementing safeguards for the Digital Personal Data Protection Act, 2023 (DPDP Act) and DPDP Rules, 2025. The Rules have phased commencement; this policy describes the choices and controls available in InCue, not a certification of legal compliance.

InCue is operated by MR Industry, GSTIN 06FXUPM5416C1Z9, 369, Ghari mundo ki tapriya, Oppt Gupta Petrol Pump, Jagadhri, Yamunanagar, Haryana 135003, India. Email support@incue.in, phone 7988919040.

2. Our role: fiduciary or processor

• Businesses using InCue (merchants), their staff, website visitors and people who ask for a demo: MR Industry decides how this data is used and is the Data Fiduciary.
• Customers who take a token or book at a business: that business is the Data Fiduciary. It decides what it collects and why. InCue is its Data Processor: we store and process these details only to run the business's queue, on its instructions and under our Terms.
• Customers can send a rights request to the business or to us. If you ask us, we act on it with the business.

3. What we collect and why

• Customers (for the business): name, mobile number, the service chosen, any extra fields the business asks for, token number, status and timings, WhatsApp delivery status, and ratings if you leave feedback. Used to issue your token, show your queue position, call your turn, send updates about your turn and ask for feedback.
• Location on the token page: if a business only accepts tokens from people nearby, your browser location is requested only after you tap the location-check button, and is compared with the business address. Coordinates are not saved in the token record. If you decline, ask reception for help.
• Merchants: business name, owner name, phone, email, address, GST and billing details, plan and payment records, settings, services and counters. Used to run the account, bill it and support it.
• Staff: name, phone, role, login sessions, and the queue actions they take. Used to control access and keep an activity record for the business.
• Website visitors and demo requests: what you type in our forms, and, only if you accept analytics cookies, usage data from Google Analytics, Meta Pixel and Microsoft Clarity.
• Technical data: IP address, device and browser details and security logs. Used to keep the service secure and to investigate misuse.

4. Consent and other lawful grounds

On the QR token page you tick a box to agree before your token is created. We record the notice version you agreed to and when. The notice lists the fields requested by the business and their queue purpose, in English and Hindi. WhatsApp is off by default and requires a separate opt-in. You can stop it from your tracking page. Mobile is optional unless needed for online payment or the WhatsApp updates you choose. We record the notice language, field labels and adult self-declaration, without treating that declaration as verified age or guardian consent.

Where you give us details yourself for a clear purpose, such as a demo request or support message, we use them for that purpose. We also process data where a law requires it, for example GST invoices and tax records.

5. What we don't do

• We don't sell or rent personal data.
• We don't send marketing messages to a business's customers. Customers get only the queue updates and feedback request for their own token.
• We don't show phone numbers on TV displays. Customer names appear on a display only if the business switches that on, and phone numbers never reach the display at all.
• InCue is not a medical records system. Don't enter diagnoses, prescriptions, medical history, Aadhaar or other ID numbers, card or bank details in token forms, notes or feedback.

6. Who we share data with

• Google Cloud / Firebase: database (hosted in India, Mumbai region), file storage and sign-in.
• MSG91: WhatsApp, SMS and one-time-password messages.
• Razorpay and Cashfree: payment processing, including prepaid tokens where enabled. The relevant provider receives the contact and transaction details needed for checkout.
• Our server and website hosting providers.
• Google Analytics, Meta and Microsoft Clarity: website analytics, only after you accept cookies.
• The business you visited: it sees the customer details for its own queue.
• Government authorities, when the law requires us to share data.

We share only what each service provider needs to run InCue:

7. How long we keep data

• Queue customer details: the current default retention is 365 days. A configured longer period or a legal retention requirement can apply. The retention job erases eligible names, phone numbers and custom-field answers; it does not promise deletion of every copy exactly on day 365. Payment, security and legally required records can remain longer. Ask the business or InCue about the period applying to your records.
• WhatsApp message logs: numbers are masked when the configured customer retention period expires; billing and delivery records may remain.
• Merchant and staff account data: while the account is active. After an account is closed we delete it when asked, except records the law requires us to keep.
• Invoices, payments and other accounting records: for as long as GST and income-tax laws require (generally at least six years).
• Security and access logs: retained according to applicable legal and security requirements; access is restricted. The DPDP Rules include one-year retention obligations when the relevant provisions commence.
• Demo and contact requests: while we follow up with you; deleted when you ask.

8. Your rights

• Access: get a summary of your personal data we hold, what we do with it, and who we shared it with.
• Correction, completion, updating and erasure of your personal data.
• Withdraw consent, as easily as you gave it. Withdrawal doesn't affect what was done before.
• Nominate a person to use your rights if you die or cannot act yourself.
• Grievance redressal: complain to us about how your data was handled.

Use the Your Data Rights page, email support@incue.in or call 7988919040. Tell us the mobile number or email you used and, for token data, the business you visited, so we can find your records. We may contact you to confirm it is you before we share or erase anything. We aim to respond within 30 days. The notified Rules provide a maximum 90-day grievance response period when that provision commences. After first using the business’s or InCue’s grievance process, you may escalate to the Data Protection Board of India under the applicable process.

The DPDP Act also asks users not to impersonate others, not to hide material information, and not to file false or frivolous complaints.

9. Grievance Officer

Grievance Officer, InCue (MR Industry). Email support@incue.in. Phone 7988919040. Address: 369, Ghari mundo ki tapriya, Oppt Gupta Petrol Pump, Jagadhri, Yamunanagar, Haryana 135003. We resolve grievances within 30 days of receiving them.

10. How we protect data

• All connections use HTTPS, and the database is encrypted at rest by Google Cloud.
• One-time passwords are stored only as hashes and expire quickly.
• Role-based access: merchants see only their own business, staff see only what their role allows, and InCue admin access is limited by role.
• Admin and staff actions are logged, and logs are kept for at least one year so misuse can be detected and investigated.
• Public pages such as tracking and feedback links don't show customers' phone numbers, and TV displays never receive them.

11. If there is a data breach

If personal data is breached, we will tell each affected person without delay: what happened, the likely impact, what we are doing about it, what they can do to protect themselves, and who to contact. We will inform the Data Protection Board of India without delay and send it a detailed report within 72 hours, as the DPDP Rules require. For customer data we hold for a business, we tell that business immediately so it can meet its own duties.

12. Children

The QR self-service form is for adults taking their own token. For a child or a person you represent, ask reception. The business must use an appropriate assisted process and establish any required verifiable parental or lawful-guardian consent, or a specific applicable exemption, before collecting that person’s data. Ticking an adult declaration is not age verification or verified guardian consent. We do not add behavioural tracking or targeted advertising to QR token pages.

13. Data stored outside India

Our main database is hosted in India. Some providers, such as analytics and messaging services, may process data outside India. We use such transfers only where Indian law allows them.

14. Cookies

The website loads analytics and marketing tools only after you accept them in the cookie banner. You can change your choice at any time with the Cookie preferences link in the footer.

15. Messages we send

Customers receive only queue updates and a feedback request for their own token, and can stop WhatsApp updates from the tracking page. Merchants receive service messages about their account, billing and plan, and may receive product updates, which they can ask us to stop.

16. Changes to this policy

When we change this policy we update the date above. If a change affects how we use data you gave with consent, we will ask for your consent again where the law requires.