This policy explains what personal data WAO handles, why we handle it, who we share it with, how long we keep it, and what you can do about it. It is written for India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.
"WAO", "we", "us" refers to M/s WAO, a partnership firm constituted under the Indian Partnership Act, 1932 and operating from Delhi NCR, India. Our website is getwao.com. You can reach us using the details in section 19.
The short version. WAO builds WhatsApp ordering software for restaurants. Restaurant customer data belongs to the restaurant, not to us. We never sell personal data, we never share one restaurant's customers with another restaurant, and we do not run a consumer app or directory of our own.
1. Our two roles
WAO handles personal data in two distinct capacities, and your rights differ depending on which one applies to you.
| Whose data | Our role | What it means |
|---|---|---|
| Restaurant owners, staff, demo enquirers and website visitors | Data Fiduciary | We decide why and how this data is processed. You deal with us directly for your rights. |
| Diners who order from a restaurant using WAO | Data Processor | We process this data only on the instructions of the restaurant you ordered from. The restaurant is the Data Fiduciary and owns the customer record. We handle it for them. |
If you are a diner and want your data corrected or deleted, the restaurant you ordered from is the party responsible. You can also write to us at info@getwao.com and we will act on the restaurant's instructions, or route your request to them.
2. Data we collect
2.1 From restaurant owners and prospective clients
- Name, restaurant or business name, mobile number, email address and outlet address.
- Details submitted through the demo request form on getwao.com.
- Onboarding information: menu, prices, operating hours, the WhatsApp number used for orders, the owner's personal WhatsApp number for the management chat, and a kitchen contact number.
- Meta Business account identifiers and WhatsApp Business Account details needed to connect your number.
- Billing details, GST number where applicable, and payment records. Card and bank details are handled by our payment provider, not stored by us.
- Support and onboarding correspondence with our team.
2.2 From diners, on behalf of restaurants
When you message a restaurant's WAO-powered WhatsApp number, we process:
- Your WhatsApp phone number and the profile name WhatsApp supplies.
- The content of messages you send to that ordering line, and our replies.
- Order details: items, quantities, totals, special instructions, and pickup or delivery details you provide.
- Order history with that restaurant, including order dates, frequency and total spend.
- Interaction data: menu views, button taps, list selections and form submissions inside the chat.
- Which entry point you arrived through , for example a QR code at the counter, a code on a packaging insert, or a link in the restaurant's Instagram bio , so the restaurant knows which of its own channels is working.
We do not read or access your other WhatsApp chats. We only receive messages you send to a restaurant's ordering number.
2.3 Technical data from our website
- IP address, browser type, device type, referring page, pages viewed and time of visit.
- Basic server and error logs used to keep the site running and secure.
3. How we collect it
- Directly from you , the website form, WhatsApp messages, onboarding calls, email.
- From the restaurant , where a restaurant provides existing customer records to be loaded into its WAO account. The restaurant is responsible for having a lawful basis to share those records with us.
- Automatically , through the WhatsApp Business Platform when you message a restaurant's ordering line, and through standard web server logs.
4. How you are told about this
Most diners reach a restaurant's ordering line by scanning a QR code or tapping a link, and never visit this website. So the notice is given inside the chat, not only here.
- Diners. The first time you message a restaurant's WAO-powered ordering number, the assistant tells you , before you place an order , what is collected, who it is for, that the restaurant owns the record, how to opt out of promotional messages, and where to find this policy in full. That notice is available in English and Hindi, and you can ask for it again at any time by sending PRIVACY to the ordering line.
- Restaurant clients. Notice is given at signup and forms part of your agreement with WAO.
- Website visitors. This page is the notice, linked from every page of getwao.com.
5. Why we use it
- To receive, interpret, confirm and fulfil orders placed over WhatsApp.
- To notify the restaurant of new orders and notify you of order status and pickup times.
- To maintain the restaurant's own customer database, order history and menu availability.
- To send order-related messages, and , where you have opted in , promotional messages from that restaurant.
- To invite you to leave a public review of the restaurant after an order. This is optional, you can decline, and we do not write or submit a review on your behalf.
- To provide support, resolve failed or missed orders, and investigate complaints.
- To bill restaurant clients and maintain accounts and tax records.
- To secure the service, prevent abuse and fraud, and debug faults.
- To improve the product in aggregate , for example, how often orders complete or where a flow fails. This uses aggregated and de-identified information, not individual customer records.
6. Consent and withdrawing it
We process personal data on the basis of your consent, or where the law permits processing for a legitimate use , for example, where you have voluntarily provided data for a specified purpose, such as placing an order.
Placing an order over a restaurant's WhatsApp line is a voluntary act, and we process the data needed to complete that order on that basis. You can withdraw consent at any time, with the same ease as giving it. Withdrawal applies going forward and does not affect processing already carried out, or records we are required by law to keep.
What happens if you withdraw consent
We are required to tell you the consequences, and they are straightforward:
- Opting out of promotional messages stops marketing from that restaurant. Ordering continues to work normally.
- Withdrawing consent for order processing means the ordering line can no longer take your orders, and any order in progress cannot be completed. You can still order from the restaurant by phone or in person.
- Asking for erasure removes your order history with that restaurant, including any saved favourites or reorder shortcuts. It cannot be restored afterwards.
WhatsApp messaging is also governed by Meta's own policies and by the WhatsApp Business Messaging Policy, which apply in addition to this policy.
7. Promotional messages
Restaurants using WAO can send offers, new-item announcements and reorder reminders to customers who have opted in. How this works:
- The restaurant is the sender. Messages come from the restaurant's own WhatsApp line, under its own brand, about its own food. WAO does not send marketing to diners on its own behalf, and does not advertise other restaurants to you.
- Opt-in is required and separate from placing an order. Ordering does not sign you up for marketing.
- Every promotional message carries a way to stop. Replying STOP to the ordering line ends promotional messages from that restaurant, usually immediately and in any case within 7 days. You will still receive messages about orders you have actually placed.
- Opt-outs are per restaurant. Stopping messages from one restaurant does not affect another, because the lists are separate and never combined.
8. Automated and AI processing
WAO uses an AI assistant to read order messages and respond. Message content sent to a restaurant's ordering line is processed by a third-party large language model provider to interpret the order and generate a reply. This is automated. No decision with a legal or similarly significant effect is made about you by this system , it takes orders, answers menu questions and relays status updates.
We instruct our providers not to use this content to train their models. Please do not send sensitive personal information , identity numbers, financial account details, health information , through the ordering chat. It is not needed to place an order.
9. Who we share data with
We share personal data only with the parties below, only to the extent needed, and under contractual confidentiality and security obligations.
| Recipient | Purpose |
|---|---|
| The restaurant you ordered from | To prepare and fulfil your order and manage its own customer relationship. The restaurant is the owner of this record. |
| Meta Platforms (WhatsApp Business Platform) | Message delivery. All chat traffic runs on WhatsApp's infrastructure. |
| Cloud hosting and database providers | Running the service and storing data securely (Supabase, DigitalOcean). |
| AI model provider | Interpreting order messages and generating replies (OpenAI). |
| Form and email providers | Handling demo requests and business correspondence (Formspree). |
| Delivery and POS partners | Only where a restaurant enables delivery or point-of-sale integration, and only the data needed to complete that order. |
| Payment provider | Collecting subscription payments from restaurant clients. |
| Professional advisers and authorities | Where required by law, court order, or to protect our legal rights. |
If WAO is acquired or merges with another business, personal data may transfer as part of that transaction. We will inform affected restaurant clients before it takes effect.
10. What we never do
- We do not sell personal data to anyone, for any purpose.
- We do not share or make available one restaurant's customer data to another restaurant.
- We do not build or operate a consumer-facing ordering app, directory or marketplace using this data.
- We do not use diner data for our own marketing.
- We do not send promotional messages to diners on our own behalf. Any marketing you receive comes from the restaurant, under its brand.
11. Where data is stored
Order and customer data is stored on cloud infrastructure hosted in India. Some of our service providers , including the WhatsApp Business Platform and our AI model provider , process data on servers outside India. Where that happens, the transfer is limited to what the service requires and is subject to the provider's contractual security commitments and to any restrictions the Central Government notifies under the DPDP Act.
12. How long we keep it
- Diner and order data: retained for as long as the restaurant's account with WAO is active, because the record belongs to the restaurant. If a restaurant leaves WAO, we export its data to it and delete our copy within 30 days, unless the law requires us to keep it longer.
- Restaurant client data: retained for the life of the account and for 8 years afterwards where needed for tax, accounting and legal records.
- Demo enquiries that don't convert: deleted within 24 months of last contact.
- Server and security logs: retained for up to 12 months.
When a retention period ends, data is deleted or irreversibly anonymised.
13. Security and breaches
We take reasonable security safeguards to protect personal data, including encryption in transit, access controls limiting who on our team can reach production data, credential rotation, restricted database access, and logging of administrative access. No system is perfectly secure, and we do not claim otherwise.
If a personal data breach occurs:
- We notify the affected restaurant without undue delay, with what we know about what happened, what data was involved and what we are doing about it , so the restaurant, as Data Fiduciary, can meet its own obligations.
- We notify affected individuals and the Data Protection Board of India in the manner and within the timelines the DPDP Rules require, where that duty falls on us or where the restaurant asks us to do it on its behalf.
- We keep a record of breaches and the remedial action taken.
14. Your rights
Under the DPDP Act you have the right to:
- Access a summary of the personal data we hold about you and how it is processed.
- Correction and completion of inaccurate or incomplete data, and erasure of data no longer needed for the purpose it was collected for.
- Withdraw consent at any time, including opting out of promotional messages. See section 6 for what that changes.
- Nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
- Grievance redressal , raise a complaint with us first, and escalate to the Data Protection Board of India if you are not satisfied with our response.
To exercise any of these, write to info@getwao.com from the email or phone number associated with your data, or send PRIVACY to the ordering line you use. We respond within 30 days. Diners: because the record belongs to the restaurant, we will either act on the restaurant's instruction or pass your request to it, and we will tell you which.
Please give accurate information when exercising these rights. The DPDP Act places a duty on Data Principals not to file false or frivolous complaints.
15. Children and persons with disability
WAO's services are intended for adults. We do not knowingly process the personal data of anyone under 18, and we do not direct any part of the ordering experience at children. We do not use personal data for tracking, behavioural monitoring or targeted advertising directed at children. If we learn that we hold a child's data without verifiable parental consent, we will delete it.
Where a person with disability has a lawfully appointed guardian, that guardian may give consent and exercise rights on their behalf, and we will verify the appointment before acting on such a request.
16. Cookies and measurement
getwao.com uses only the cookies and local storage needed for the site to work and to measure basic traffic. Visit counts are measured by us, on our own infrastructure, and are not passed to any third-party analytics service. We do not run advertising or cross-site tracking cookies on this site. You can block or delete cookies in your browser settings; the site will still work.
Separately, restaurants using WAO may use distinct QR codes or links for different places , the counter, a table card, a packaging insert, an Instagram bio , so they can see which of their own channels brings in direct orders. This records the entry point, not your behaviour elsewhere. It is not linked to any advertising network and is visible only to that restaurant.
17. Changes to this policy
We may update this policy as the product and the law change. The "last updated" date at the top always reflects the current version. If a change materially affects how we handle your data, we will notify restaurant clients directly by email or WhatsApp before it takes effect.
18. Governing law
This policy is governed by the laws of India. Disputes are subject to the exclusive jurisdiction of the courts at Delhi, India. Nothing here limits your right to complain to the Data Protection Board of India.
19. Contact and grievances
For any question, request or complaint about personal data:
- Grievance Officer, M/s WAO , the person responsible for answering questions about how we process personal data.
- Email: info@getwao.com
- Response time: we acknowledge within 7 days and resolve within 30 days.
M/s WAO is based in Delhi NCR, India. If you need a postal address for formal correspondence, write to us at the email above and we will provide it.
If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India.