Privacy Policy (India)

DRAFT NOTICE: This Privacy Policy is a draft. It is being prepared for review by qualified legal counsel in India and is not yet in force. It does not create any rights or obligations until a final version is published with an effective date. Nothing in this draft is legal advice. Text in [square brackets] is a placeholder or a point still open for counsel. The final version will replace this draft before any customer or business uses TokenNo in India.

1. About this policy

This Privacy Policy explains how TokenNo collects, uses, shares, stores and protects personal data when you use TokenNo in India. It covers:

the TokenNo customer app, used by people who book tokens (hosts) and the people they invite (guests);
the TokenNo Business app, including the web front desk, walk-in, QR and kiosk tokens and the TV "Now Serving" board, used by businesses and their staff;
the TokenNo website at tokenno.com;
the TokenNo Integration API and webhooks that businesses can connect to their own systems; and
our messages to you by push notification, SMS and WhatsApp.

The TokenNo platform in India is operated by [TokenNo India entity legal name], a [type of entity] registered in India under [CIN / registration number], with its registered office at [registered office address] and its principal place of business (headquarters) at [headquarters address] [and branches at [branch addresses], if any] ("TokenNo", "we", "us"). You can contact us at info@tokenno.com, or call customer care on [customer care landline] / [customer care mobile].

This policy is written to meet the requirements of Indian law, including:

the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules") as notified, as and when their provisions come into force [counsel to confirm which provisions are in force on the effective date];
the Information Technology Act, 2000 and the rules made under it, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent they still apply [counsel to confirm the transition from these rules to the DPDP Act], and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("Intermediary Rules");
the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020 ("E-Commerce Rules"); and
the directions of the Indian Computer Emergency Response Team (CERT-In) on information security practices and incident reporting.

In this policy, "personal data" means any data about an individual who can be identified by or in relation to that data. The person the data is about is called the "Data Principal" under the DPDP Act. The organisation that decides why and how personal data is processed is called the "Data Fiduciary".

2. Who is responsible for your data

TokenNo is a platform. Businesses ("vendors") such as clinics, hospitals, doctors, restaurants, salons, offices and event organisers use it to issue tokens and run their queues.

[TokenNo India entity legal name] is the Data Fiduciary for the account and booking data on the TokenNo platform. This includes your TokenNo account (your mobile number, name and language), your login, your bookings, tokens and booking history across vendors (which we use for features such as "book again", "notify me" and learned service times), guest invitations, the messages we send, the advance payments we collect as merchant of record, our fraud prevention and security, and our own analytics and improvement of the platform.
Each vendor is a separate, independent Data Fiduciary for its own records of your visit (for example a clinic's patient file or a restaurant's bill) and for any data it exports from TokenNo through the Integration API or webhooks into its own systems (for example clinic software or a point-of-sale system). The vendor's own privacy notice applies to that data.
The terms that vendors accept set out how vendors may use booking data they see in TokenNo (see our Terms of Service, section 27).

[Counsel to confirm the allocation above under the DPDP Act, whether TokenNo acts as a Data Processor for any vendor activity, and whether a data processing agreement with vendors is required.]

If you are not sure who to contact, write to info@tokenno.com and we will help you or pass your request to the right vendor.

3. What personal data we collect

We follow a data minimisation approach. In the current phase of the service we collect only what is needed to give you a token and tell you when it is your turn.

3.1 If you book tokens (customers and hosts)

Mobile number. Your mobile number is your identity on TokenNo. One mobile number is one account across all TokenNo apps. We verify it with a one-time password (OTP).
Name. The name you give us, so the vendor can call you.
Language preference. The app language you choose.
Bookings and tokens. The vendor, location, service point (for example a doctor's room or a counter), session, token number, party size, status (booked, called, served, cancelled, no-show), any changes to your token number, and your booking history, including your "notify me when booking opens" requests and "book again" choices.
Party and guests. If you invite guests, the mobile numbers (and names, if you add them) of the people you invite, and whether they said they are coming. If you choose a guest from your phone's contacts, the app uses your device's contact picker: it reads only the number you select and never uploads your address book.
Payment records. If a vendor asks for advance payment: the amount, currency, date, status, refund details and a reference from the payment gateway. We do not collect or store your full card number, CVV, UPI PIN or net-banking password. These are entered directly with the payment gateway.
Live location (optional). Only if you turn on location sharing for an active token. See section 5.
Device data. A push notification token for your device, the app version, device type and operating system, and basic technical logs (such as IP address, time of access and error reports) needed to keep the service secure and working.
Support messages. What you tell us when you contact us.

3.2 If you are a guest

If a host invites you, we receive your mobile number (and possibly your name) from the host. We use it to send you the invitation and updates about that token by push, SMS or WhatsApp, and to show you the token in the app or in a simple web page. Section 3.5 explains the basis we rely on and how you can stop invitations.

3.3 If you work for a vendor (vendor staff)

your name, mobile number, role (for example owner, manager, receptionist, doctor) and the locations you can access;
the actions you take in TokenNo Business (for example calling, serving, pushing back or cancelling tokens), which we record in audit logs; and
for the business: its name, addresses, service points, schedules, holidays, refund rules, prices, bank account details for payouts, tax details (such as GSTIN and PAN), and KYC documents you upload so that we can verify the business.

3.4 Health information

We do not ask for medical records, symptoms or other health details. Even for clinics and hospitals, TokenNo only holds your name and mobile number and your booking. Please do not type health details into names, notes or other free-text fields. Vendors are not permitted to add health details to TokenNo in the current phase. However, the fact that you booked with a particular clinic or doctor may itself say something about you, so we protect booking data carefully and share it only as described in this policy.

3.5 If someone else gives us your number (guests, phone, walk-in, kiosk and API bookings)

Sometimes we receive your name and mobile number from someone other than you:

a host who invites you as a guest;
vendor staff who book a token for you when you phone the vendor, walk in, or use its QR code or kiosk at the front desk; or
a vendor's own system that creates a token for you through the Integration API.

In these cases:

Where the data came from: the host or vendor named in our first message to you.
What we use it for: only to issue that token and send you messages about it (invitation, confirmation, call alerts, changes, cancellations and any refund).
Our basis: [counsel to confirm the lawful ground under the DPDP Act. Consent under section 6 must come from you, and the "voluntarily provided" legitimate use in section 7(a) covers only data you gave us yourself, so a host's or vendor's confirmation is not enough on its own. The working approach is that our first message asks for your consent and we process nothing further if you decline.]
Our first SMS or WhatsApp message to a number entered by someone else names TokenNo and the host or vendor who added you, says it is a message about one visit, links to this policy, and gives you a one-tap "stop inviting me" option.
If you choose "stop inviting me", we stop messaging you and keep only an irreversible hash of your number so that we can honour your request.
Vendors must have a lawful basis for any number they enter and must tell you that TokenNo will process it to manage your token (see our Terms of Service, sections 17 and 27).

4. How and why we use your data

We use personal data for these purposes:

To create and secure your account, verify your mobile number by OTP and keep you logged in.
To issue and manage tokens: booking, showing your place in the queue and estimated waiting time, calling your token, handling cancellations, holidays and changes, and showing your past bookings.
To tell you about your token by push, SMS and WhatsApp: booking confirmations, "your turn is near" and "your number is called" alerts, changes to your token number, cancellations, refunds and "booking is now open" alerts that you asked for.
To handle your party: inviting guests, updating party size and keeping the host and guests informed.
To process advance payments and refunds where a vendor requires them, and to keep accounting and tax records.
To show distance and estimated arrival time, only if you turn on location sharing (section 5).
To translate vendor content (such as business and room names) into your chosen language.
To verify vendors (KYC) and to pay them out.
To keep the platform safe: preventing fraud, misuse and security incidents, and investigating complaints.
To improve the service, for example by estimating average service times at a counter. Where possible we use aggregated or de-identified data for this.
To meet legal obligations, respond to lawful requests from authorities and enforce our Terms of Service.

4.1 Legal basis, language and consent

Under the DPDP Act we process personal data either with your consent or for certain legitimate uses permitted by the Act, for example where you have voluntarily given us data for a specific purpose (such as booking a token) and have not said you object, or where we must comply with law. For data we receive from someone else, see section 3.5. [Counsel to confirm the lawful ground for each purpose above and the form of the consent notice required by the DPDP Rules.]

You can read this notice and any consent request in English or [Hindi / other Eighth Schedule languages offered], as the DPDP Act requires. [Pending: a Hindi version of this policy and of the Terms of Service, and Hindi in-app consent notices, or a documented counsel view on the language requirement.]

When we rely on consent, we will ask for it clearly and in plain language. You can withdraw your consent at any time as easily as you gave it (see section 9). Where available, you may also give, manage, review or withdraw consent through a Consent Manager registered with the Data Protection Board of India [counsel/product to confirm whether TokenNo will integrate with registered Consent Managers]. Withdrawing consent does not affect processing that already took place, but it may mean we can no longer provide some features (for example, without your mobile number we cannot issue a token).

4.2 Data items, purposes, recipients and retention

Mobile number, name and language: used for purposes 1 to 4, 9 and 11; seen by the vendor you book with, your host or guests, and our hosting and messaging providers; kept as described in section 11 (account data).
Bookings, tokens and booking history: used for purposes 2 to 4, 10 and 11; seen by the vendor (and its connected systems through the Integration API), your host or guests and our hosting provider; kept for [3 years] after the visit.
Guest numbers and numbers entered by vendors: used for purposes 2 to 4 only; seen by the host or vendor who entered them and our messaging providers; kept as described in section 11.
Payment and refund records: used for purposes 5 and 11; seen by the payment gateway, the vendor (status, amount and refund status) and our accounting and tax advisers; kept for at least 8 years.
Live location: used for purpose 6 only; distance or estimated arrival time is seen by the vendor and your host; coordinates go to the maps provider; raw location is deleted within [24 hours] after the token closes.
Device data and logs: used for purposes 1, 3, 9 and 11; seen by our hosting and push notification providers; kept as described in section 11.
Vendor staff data, business details and KYC documents: used for purposes 8, 9 and 11; seen by our verification providers and payment gateway; kept as described in section 11.

5. Live location

Location sharing is off by default and optional.

You can turn it on for one active token at a time. It only runs from a set time before your expected turn until you arrive, your token closes, or you turn it off.
It stops automatically.
We use it to calculate how far away you are and your estimated arrival time, to send a "leave now" reminder, and to mark you as "arrived" when you reach the location.
The vendor and your host see your distance or estimated arrival time (for example "8 min away"), not a continuous map of where you are. [Product to confirm that no vendor setting can show exact coordinates; if one is added, this policy will be updated and your opt-in asked for first.]
We send your location to a maps/routing provider only to calculate the route and time.
We delete raw location data soon after the visit, within [24 hours] of your token closing, and keep only the fact that you arrived [counsel to confirm the retention period, and whether raw location is covered by the one-year log retention in rule 8(3) of the DPDP Rules].

You can control location permission at any time in your device settings and in the app.

6. Messages we send (push, SMS and WhatsApp)

Service messages about your token (confirmation, call alerts, changes, cancellations, refunds) are part of the service. You can switch some of them off in the app, but you may then miss your turn.
"Notify me when booking opens" messages are sent only if you ask for them, and you can cancel each request.
We do not send promotional messages without your consent.
SMS in India is sent through telecom operators that follow the Telecom Regulatory Authority of India (TRAI) rules on commercial communications, including the Telecom Commercial Communications Customer Preference Regulations, 2018 (as amended) and the Distributed Ledger Technology (DLT) registration of senders, headers and message templates. OTPs are sent as transactional messages and booking updates as service messages [counsel/ops to confirm the DLT category for each template, including "notify me" alerts and guest invitations, which may need explicit consent captured through the DLT digital consent framework, and the principal entity registered on DLT].
WhatsApp messages are sent through the WhatsApp Business Platform operated by Meta, and only where you have agreed to receive messages on WhatsApp or as allowed by WhatsApp's policies. You can reply "STOP" or block the business number at any time [product to confirm the WhatsApp opt-out keyword is implemented].
The vendor pays for SMS and WhatsApp messages sent for its bookings. This does not change how your data is protected.

7. Who we share your data with

We do not sell your personal data. We share it only as follows:

With the vendor you book with: your name, mobile number, token, party size, status, the payment status and amount, any refund status, the status of guests in your party (for example "coming" or "arrived") and, if you turned on location sharing, your distance or estimated arrival time. Vendor staff see this in TokenNo Business, and your token number may be shown and announced on the vendor's TV "Now Serving" board in its waiting area. [Product to confirm whether any part of the customer's name can appear on the board.]
With your host or guests: the members of a party see each other's status (for example "coming" or "arrived") and, if location sharing is on, estimated arrival time.
With the vendor's own systems, if the vendor connects them through the Integration API and webhooks. These receive your name, mobile number, booking, token and queue details, and payment events (for example payment status, amount and reference). They never receive health details. Once the data reaches the vendor's system, the vendor is responsible for it.
With our service providers (sub-processors), who process data on our instructions under contract, only for the services they provide to us:
- Amazon Web Services (AWS) — cloud hosting and storage;
- payment gateways — in India, the gateway configured for India (currently Razorpay [to be confirmed]); our other gateways (Stripe, Tap Payments and Moyasar) serve other countries;
- SMS and WhatsApp providers — such as MSG91 and Twilio for SMS, and Meta for the WhatsApp Business Platform (Unifonic serves other countries);
- Firebase Cloud Messaging (Google) and Apple's push notification service — to deliver push notifications;
- translation providers — to translate vendor content (not your personal messages); and
- maps and routing providers — to calculate distance and arrival times.
An up-to-date list is available on request from info@tokenno.com [or at [link to sub-processor list]].
With authorities, where required by Indian law, a court order or a lawful request from a government agency, including under the IT Act and the CERT-In directions.
In a business transfer, such as a merger or acquisition, subject to this policy and applicable law.

8. Where your data is stored and international transfers

Our main servers are in India (the AWS Asia Pacific (Mumbai) region). Some of our service providers (for example push notification, messaging, translation or maps providers) may process limited data on servers outside India.

The DPDP Act allows personal data to be transferred outside India except to countries or territories that the Central Government restricts by notification [counsel to confirm the current status of any such notification]. We will not transfer personal data to any restricted country, and we require our providers to protect it.

Payment data is handled by the payment gateway, which is responsible for storing payment system data in India as required by the Reserve Bank of India (RBI) rules on storage of payment system data.

9. Your rights and how to use them

Under the DPDP Act, you have the right to:

Get information about the personal data we process about you, how we process it, and who we have shared it with.
Correct, complete or update your personal data.
Have your personal data erased, unless we must keep it to meet a legal obligation or for the specified purpose (for example tax and payment records, and the restricted records described in section 11).
Withdraw consent you have given, in the app, by email or, where available, through a registered Consent Manager.
Have your grievances addressed by us (see section 10).
Nominate another person who can exercise your rights if you die or become unable to do so.

You can use these rights:

In the app: go to Profile to edit your name and language, see and manage your bookings, manage notifications and location permission, and delete your account.
By email: write to info@tokenno.com with the subject "Privacy request", from or mentioning the mobile number on your account. To protect you, we may ask you to confirm a one-time password sent to that number.

We will respond within the period we publish under the DPDP Rules, which is [X] days and in any case no more than 90 days [counsel to confirm the response period]. If a request relates to a vendor's own records, we will tell you and pass it to the vendor where appropriate.

Your duties. The DPDP Act also asks Data Principals not to give false information, not to impersonate anyone and not to file false or frivolous complaints.

10. Grievance Officer and how to complain

If you have a question or complaint about your personal data, or about content or conduct on TokenNo, please contact our Grievance Officer:

Name: [Grievance Officer name]
Designation: Grievance Officer
Address: [TokenNo India entity legal name], [headquarters address]
Email: info@tokenno.com (subject: "Grievance")
Phone: [customer care landline] / [customer care mobile]
Hours: [working days and hours]

The same officer is designated as the grievance officer under the Intermediary Rules and the E-Commerce Rules, and as the person who answers questions about personal data under the DPDP Act [counsel to confirm whether separate officers are required and whether TokenNo may be notified as a Significant Data Fiduciary needing a Data Protection Officer based in India].

Our timelines (the same in our Terms of Service, section 12):

We acknowledge every complaint within 24 hours and give it a ticket number you can use to track it in the app under Help or by email.
Complaints under the Intermediary Rules: resolved within 15 days.
Requests to remove content prohibited under rule 3(1)(b) of the Intermediary Rules: acted on within 72 hours.
Complaints under rule 3(2)(b) of the Intermediary Rules (content showing a person's private areas, nudity or sexual acts, or impersonating them): acted on within 24 hours.
Consumer complaints under the E-Commerce Rules: resolved within one month at most.
Grievances about personal data under the DPDP Act: answered within the period we publish under the DPDP Rules, and in any case within 90 days.

[Counsel to confirm these timelines.]

If you are not satisfied:

Personal data: you can file a complaint with the Data Protection Board of India online through its digital platform at [Board URL / app], after first using our grievance process (DPDP Act, section 13(3)).
Complaints under the Intermediary Rules: you may appeal the Grievance Officer's decision to the Grievance Appellate Committee within 30 days at gac.gov.in.
Consumer complaints: you can contact the National Consumer Helpline (1915 or consumerhelpline.gov.in) or file online through e-Jagriti (e-jagriti.gov.in) [counsel to confirm the current portal].

11. How long we keep your data

We keep personal data only as long as needed for the purpose it was collected for, or as long as the law requires. Our draft retention periods are [counsel to confirm all retention periods]:

Account data (mobile number, name, language): while your account is active. If you delete your account, we remove your profile from the app at once and delete or anonymise the rest within [30] days, except the restricted records below and what we must otherwise keep by law.
Bookings and token history: for [3 years] after the visit, so that you can see past bookings and use "book again", and so that disputes can be handled.
Guest numbers and numbers entered by vendors: deleted, or kept only as an irreversible hash to honour a "stop inviting me" request, within [30 days] after the visit, unless the person creates their own TokenNo account.
Live location: deleted within [24 hours] after the token closes (section 5).
Payment, refund, payout and tax records: for at least 8 years, as required by Indian accounting and tax laws (including the Companies Act, 2013 and GST law) [counsel to confirm].
Vendor KYC documents: for as long as the vendor uses TokenNo and for [5 years] afterwards.
Device push tokens: until you log out, uninstall the app or the token expires.
Inactive accounts: we may delete accounts with no activity for [period] after giving you notice [counsel to confirm whether the DPDP Rules' time limits for inactive users apply to TokenNo].

Restricted records kept after deletion. Some records must be kept for a minimum period even after you delete your account. We keep them access-restricted and use them only to answer lawful requests, investigate incidents or meet legal duties:

registration data (the mobile number and name you signed up with): for [180 days] after your account is deleted, as rule 3(1)(h) of the Intermediary Rules requires;
processing logs and associated traffic data (for example records of logins, bookings and messages): for at least [1 year], as rule 8(3) of the DPDP Rules requires; and
audit and security logs: for at least 1 year, and certain logs in India for at least 180 days as the CERT-In directions require.

In plain words: "delete account" removes your profile at once, but these records stay locked away for the periods above and are then deleted. When a retention period ends, we delete the data or make it anonymous.

12. How we protect your data

We use reasonable security safeguards, including:

encryption of data in transit (HTTPS/TLS) and at rest;
OTP-based login, role-based access for vendor staff and least-privilege access for our own team;
storing only a secure hash of Integration API keys, signed webhooks and audit logs of API use;
payment card and UPI details handled only by the PCI-DSS compliant payment gateway;
monitoring, backups and regular security reviews; and
contracts with our service providers requiring them to protect personal data.

No system is completely secure. If a personal data breach happens, we will inform the Data Protection Board of India and the affected people as required by the DPDP Act and DPDP Rules, and report cyber security incidents to CERT-In within the time its directions require (currently 6 hours from becoming aware) [counsel to confirm].

13. Children

TokenNo accounts are meant for adults aged 18 or over. Under the DPDP Act, a "child" is anyone under 18.

If you are under 18, please ask a parent or lawful guardian to book for you.
In the current phase, a token is always held in the adult host's name. We do not collect a child profile, a child's name or a child's date of birth. When a parent books a visit that includes a child (for example at a children's clinic), the booking is in the parent's name.
Guests are invited by mobile number and we do not check their age. Guests under 18 should not turn on location sharing. [Product and counsel to confirm: whether location sharing and arrival detection should be turned off for guests flagged as minors, and the position under section 9(3) of the DPDP Act and the Fourth Schedule to the DPDP Rules for guests and clinic bookings.]
We do not track children, monitor their behaviour, or show them targeted advertising.
Phase 2 placeholder: family profiles, where a parent adds a child's name, are planned for a later phase. Before they launch, this section will explain how we obtain verifiable consent of a parent or lawful guardian under the DPDP Rules [counsel to confirm the mechanism and whether any exemption for clinical establishments and healthcare professionals applies].

If you believe a child has created an account without consent, contact info@tokenno.com and we will delete it.

14. Cookies and similar technologies

Our website and web views (for example the guest token page) use essential cookies or local storage to keep you logged in and remember your language. We use [analytics tool, if any] only with your consent where consent is required. You can control cookies in your browser.

15. Changes to this policy

We may update this policy. If we make important changes, we will tell you in the app or by message before they take effect and, where the law requires, ask for your consent again. We also remind users at least once a year about this policy and our Terms of Service. The "last updated" date at the top shows when it last changed.

16. Contact us

[TokenNo India entity legal name] [headquarters address] Email: info@tokenno.com Customer care: [customer care landline] / [customer care mobile]