Privacy Policy

Oplyx POS is a restaurant point-of-sale, QR-ordering and accounting platform operated by Oplyx Technologies ("Oplyx", "we", "us"), Sankhamul-10, Kathmandu, Nepal (Registration No. 368546/81/82; PAN 62237628).

This policy explains what personal information we collect, why, who we share it with, and the choices you have. It covers:

• the Oplyx POS marketing website and demo/contact forms (the "Website");
• the Oplyx POS admin dashboard, API and mobile app (the "Service"); and
• the public pages the Service produces for restaurants (QR table menus and the restaurant's public profile page).

Contact for anything in this policy: privacy@oplyxpos.com

1. Who is responsible for what

Oplyx POS is used by restaurants ("Restaurants", "you" if you are one). Two roles matter:

If you are a diner who scanned a table QR code, the Restaurant (not Oplyx) decides what to do with your order data. Questions or requests about it should go to the Restaurant. We will help the Restaurant respond.

2. Information we collect

2.1 Restaurant owners and staff (account holders)

• Identity and contact: name, email address, phone number, username, profile photo/avatar.
• Sign-in credentials: a password (stored only as a salted hash, never in plain text) or your Google account identifier if you sign in with Google. Staff may also sign in with a QR login token.
• Role and workplace data: the restaurant(s) you belong to, your role and permissions, position/staff role, status, and any staff balance or due amount the restaurant records.
• Restaurant profile: restaurant name, address, country, time zone, phone, email, website and social links, logo, business details, opening date, subdomain/public link, tax and invoice settings.
• Subscription data: selected plan, plan status, renewal/expiry dates, and billing contact details. We do not currently take card payments inside the Service (see section 6).
• Mobile app data: a push-notification token, device platform (iOS/Android) and device name, so we can deliver order alerts to your device.
• API/AI access data: names and the hashed value of API tokens you create, when they were last used, and details of any AI client you authorize via OAuth.
• Activity records: audit/activity logs of actions taken in the Service (for example menu edits, order cancellations, settings changes).

2.2 Data Restaurants enter about their business

Restaurants control what they store, which may include: menus, prices and costs; tables and spaces; orders, bills, KOTs, discounts, taxes and service charges; payment mode records (cash, Fonepay, card, credit — as records only); inventory, suppliers and purchases; accounting ledger entries, day-book closings and reports; and a customer (CRM) list that can contain a diner's name, phone, email, address, date of birth, tax number, favourite dish, seating and dietary preferences, allergies, notes, credit balance and loyalty progress.

Restaurants should only enter customer information they have a lawful basis to hold and should tell their customers about it.

2.3 Diners using a table QR code

Table QR ordering needs no account and no sign-up. When a diner scans a table code we process the table identifier, a table session, the items ordered, quantities, variants and any note the diner types, and timestamps. We do not ask diners for name, phone or email in this flow. Please do not put personal information in order notes.

2.4 Website visitors and demo requests

If you submit the demo/contact form we collect: your name, restaurant name, phone number, email (optional), your role, current POS system, number of tables, and your message. We use this only to respond to you.

2.5 Technical data

Server and security logs (IP address, browser/device type, request time, error details) and error reports generated by our error-monitoring service. The Service uses browser storage/cookies that are strictly necessary to keep you signed in and remember preferences.

Analytics and advertising tools. To understand how people use our products and to measure our marketing, we use:

• On the Website: Google Analytics, Google Tag Manager, Meta Pixel, Microsoft Clarity and Google Search Console.
• In the admin dashboard: Google Analytics and Meta Pixel.

These tools use cookies or similar identifiers and may collect your IP address, device and browser details, pages viewed, clicks and, with Microsoft Clarity, session recordings with on-screen text masked where possible. Meta Pixel may share this activity with Meta to measure and improve our ads. We use them on our own Website and dashboard only. They do not read the orders, menus or customer lists a Restaurant stores in the Service, and we do not send that data to these tools. You can block these cookies in your browser settings, use Google's opt-out browser add-on, or manage ad preferences in your Meta account.

2.6 Images

If you upload images (logo, dish photos, banners) we store them. If you use the built-in image library, the search terms you type are sent to Pexels to return photos.

3. How we use information

We do not sell personal information, and we do not use Restaurant or diner data for advertising. We will only send you marketing about Oplyx products if you have asked for it or given consent, and you can opt out at any time.

4. Who we share information with

Service providers (sub-processors). We use trusted providers to run the Service. They may only process data for us:

Within a Restaurant. Staff and administrators of a Restaurant can see that Restaurant's data according to their role. Data is separated between Restaurants.

Public pages by design. A Restaurant's public profile page shows what the Restaurant chooses to publish (such as name, address, phone, social links, menu images, bio). A table QR menu is reachable by anyone who has that table's QR code.

AI and API connections you authorize. If a Restaurant admin creates an API token or approves an OAuth connection for an AI assistant or other tool, that tool can read and act on the Restaurant's data within the permissions granted. Oplyx is not responsible for how a third-party tool you connect uses data. You can revoke access at any time in Settings.

Legal and business reasons. We may disclose information if required by law, court order or a competent Nepali authority, to protect rights and safety, or in connection with a merger, acquisition or sale of the business (with notice to you).

Where a provider is outside Nepal, your data may be transferred and processed abroad. We take reasonable steps (contracts, access controls, encryption in transit) to protect it.

5. Security

We use measures including encrypted connections (HTTPS), hashed passwords and API tokens, restaurant-level data isolation, role-based access and least-privilege access to production systems. No system is perfectly secure. If a breach affecting your personal data occurs, we will notify affected Restaurants and, where required, the authorities, without undue delay. Please keep your credentials safe and tell us at once if you suspect misuse. To report a security issue, write to security@oplyxpos.com.

6. Payments

Oplyx POS records tender types and billing status for reporting. It does not capture or store card numbers or process card or QR payments; those are handled by your bank's terminal or merchant QR. Subscription fees are currently arranged directly with Oplyx and paid to Oplyx Technologies' bank account. If we add an online payment gateway, we will update this policy and the gateway will process payment details under its own terms.

7. Retention and deletion

• Active accounts: we keep data for as long as the account is active.
• Deleting your account: an account owner can delete the account in Settings → Delete Account. If you are the only administrator of a Restaurant, the Restaurant and all its data (orders, menu, customers, inventory, accounting) are permanently deleted. This cannot be undone. Export any records you must keep before deleting.
• Backups and logs: deleted data may remain in encrypted backups and logs for up to 30 days before being overwritten.
• Legal records: we may keep limited billing and contract records about our own dealings with you for as long as Nepali tax and accounting law requires.
• Tax records are your responsibility. Restaurants remain responsible for keeping sales, VAT and accounting records for the period Nepali law requires, including exports from the Service.

8. Your rights and choices

Under Nepal's Privacy Act, 2075 (2018) and other applicable law, you may ask us to:

• access the personal information we hold about you;
• correct inaccurate information;
• delete your information (subject to section 7);
• object to or restrict certain uses, or withdraw consent where we rely on it.

Account holders can edit most data directly in Settings, revoke API/AI access, and delete their account. Otherwise email privacy@oplyxpos.com. We will verify your identity and respond within 30 days. If you are a diner or a Restaurant's customer, contact the Restaurant first; we will assist them. You may also complain to the competent authority in Nepal.

9. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children.

10. Third-party links

The Website and public pages may link to third-party sites (for example a Restaurant's social profiles). We are not responsible for their privacy practices.

11. Changes to this policy

We will post updates here with a new "Last updated" date. For material changes we will notify account holders by email or in the dashboard before the change takes effect.

12. Contact

Oplyx Technologies
Sankhamul-10, Kathmandu, Nepal
Registration No. 368546/81/82 · PAN 62237628
Privacy requests: privacy@oplyxpos.com
Security reports: security@oplyxpos.com
Phone: +977 9824628662