Privacy & Data Protection Policy
noQ is engineered from the ground up with a privacy-first mindset. This policy articulates our practices regarding the collection, safeguarding, masking, and retention of personally identifiable information (PII) for both venue operators and visiting customers.
01. Information We Collect
A. Business Operator Information: When establishing an account, we collect the business name, operating category, business phone number, operating schedule, and salted cryptographic password hashes.
B. Queue Visitor Information: When a customer scans a venue QR code or books remotely, we collect their self-reported name, mobile contact number, and timestamp. We do not collect government identity cards, residential addresses, financial account details, or medical records.
02. Automatic PII Redaction & Public Masking
To prevent scraping, shoulder-surfing, or unauthorized lobby surveillance, noQ applies strict automated PII redaction across all public surfaces:
Customer mobile numbers are masked via cryptographic formatting across all public APIs and displays (e.g. +91 •••••• 4512).
Public waiting room TV screens and voice announcements display only the issued token number and abbreviated initials to protect patient identity.
03. Strict No-Sale & Confidentiality Guarantee
We operate as an administrative infrastructure provider, not a data broker. We do not sell, rent, monetize, or disclose visitor contact lists or patient check-in records to third-party advertisers, pharmaceutical companies, or data aggregators.
Data entered into a venue's queue stream is strictly partitioned to that business and is accessible only by authorized personnel holding valid operator credentials.
04. Operational Messaging & Notification Consent
By submitting a phone number to join an active queue, visitors provide explicit consent to receive transactional notifications (live pass updates, audio turn callouts, and queue progress alerts) specifically relevant to that service visit. We do not dispatch unsolicited promotional broadcasts or spam marketing messages.
05. Data Storage, Retention & Soft-Delete Policy
Queue data is encrypted both in transit (TLS 1.3 / HTTPS) and at rest within secure PostgreSQL clusters. In accordance with our soft-delete policy, inactive or deactivated business queues retain their historical analytics, token counters, and stream configurations so that businesses can resume operations without losing their historical records. Operators may request complete administrative purging of their data by contacting platform governance.
06. Data Protection Inquiries
For questions regarding privacy compliance, data rights, or security architecture, please contact our security team at privacy@noq-serve.vercel.app.