Legal
Privacy policy
A queue needs almost nothing about you to work. This page says exactly what Qgress holds, for how long, and who else touches it.
Last updated 20 October 2026
The short version. You can take a token with no name and no phone number. If a business does ask for them, they are cleared 30 days after your visit ends. There are no advertising cookies and no analytics trackers anywhere on Qgress, and nothing we hold is ever sold.
Who this covers, and who is responsible
Qgress is based in Pune, Maharashtra 412101, India. Two different groups of people appear in this policy.
Businesses that run queues on Qgress. For their account data we are the data fiduciary: we decide what is needed and we answer for it.
People who join a queue. Here the business you visited is the data fiduciary. They chose what their join screen asks for. We are their data processor: we hold it on their behalf, act on their instructions, and use it for nothing of our own.
If you joined a queue
To put you in a line and call you back, Qgress records your token number, the branch and service you chose, the size of your party, and the times you joined, were called and were served.
Some businesses also ask for a name, so staff can call you by it, and a phone number, so they can reach you if the notification does not. Both are optional for the business to ask and optional for you to give. A token works without either.
If you allow notifications, your browser gives us a push subscription for your device so the phone can tell you when your turn is near. You can revoke it in your browser at any time. Your device also keeps a small key that lets you reopen your own token; it stays on your device.
If the business asks for feedback after your visit, we store the rating you gave and any comment you typed.
Location
Some businesses only allow a token to be taken on their premises. When that setting is on, your browser is asked for your location once, at the moment you join, and it is compared with the branch's own coordinates to check you are nearby. The result of that check is what we keep. Your coordinates are not stored, and your location is never tracked while you wait.
How long it is kept
Your name, your phone number and any feedback comment you typed are erased 30 days after your visit closes. This happens automatically, whether or not anyone asks. What remains afterwards is the shape of the visit with no one in it: token number, times, waiting time and rating, which is what a business needs to see whether its Tuesday mornings are too busy.
If you run a business on Qgress
For an account we hold your name, email address and phone number, your business and branch details including the address and opening hours, the staff logins you create, and the documents you upload to have the business verified.
We also hold your billing history: which plan, which period, what was invoiced and whether it was paid.
Payments
Card and bank details are entered on Razorpay's own checkout and go straight to Razorpay. We never see them and we never store them. What comes back to us is a payment reference, the amount and whether it succeeded.
Cookies and what sits on your device
There are no advertising cookies, no third-party analytics and no tracking pixels on qgress.com, in the customer app or in the staff console. This site carries no scripts at all.
The apps store a small amount on your own device so they work: a sign-in session for staff, and for customers the key that reopens their token. Clearing your browser storage removes both.
Who else processes it
We use a short list of suppliers to run the service. Each one is bound to use the data only to provide their service to us.
| Supplier | What they do | What they see |
|---|---|---|
| Supabase | Database and sign-in | All stored data, account credentials |
| Render | Runs the API | Data in transit while a request is served |
| Cloudflare | Serves the web apps and this site | Request metadata, including IP address |
| Razorpay | Takes payments | Billing name, contact, payment instrument |
| Resend | Sends account email | Email address and message contents |
| Sign in with Google, review links | Your Google account email, if you use it | |
| Browser push services | Deliver notifications | An anonymous device endpoint, not the message subject |
We also disclose data where the law requires it, and to our professional advisers when needed. We do not sell data and we do not share it for anyone else's marketing.
Where it is stored
The database and the API currently run in Europe, in Ireland and Frankfurt respectively. We are moving both to an Indian region; this page will be updated when that is done. Data is transferred and stored under contract with each supplier and is encrypted in transit and at rest.
How it is protected
Every request to the API is authenticated, and a business can only ever read its own data; that separation is enforced in the database itself, not only in the application. Traffic is encrypted end to end. Staff access inside Qgress is limited to the people who need it and administrative actions are logged.
No system is perfect. If a breach affects your data we will notify you and the Data Protection Board as the law requires.
Your rights
You can ask us to show you what we hold, correct it, or erase it. You can withdraw consent for notifications or for a phone number at any time, and you can ask for a copy of your data.
If you joined a queue as a customer, ask the business you visited first: the data is theirs and they can remove it from their console immediately. If you cannot reach them, write to us and we will act on it.
We answer requests within 30 days. We may need to confirm who you are before acting on one.
Children
Qgress is not directed at children, and an account may only be opened by an adult. A parent may of course take a token for a child, in which case the child's name is treated exactly like any other name on this page and erased on the same clock.
Grievances
If something about your data has been handled badly, that is a grievance and it goes to a person, not a form.
If you remain unsatisfied you may complain to the Data Protection Board of India.
Changes to this policy
When this policy changes, the date at the top changes with it. If a change materially affects how we handle your data, we will email account owners before it takes effect.