Privacy Policy

Effective date: 18 October 2026 · Last updated: 18 October 2026 · Version 1.0

Summary. Rinsora is a business app for laundry shops. We collect only what is needed to run your shop's orders, billing and staff. We do not sell personal data, show ads, or use third-party advertising or analytics trackers. You can delete your shop in the app and request deletion of your account at any time (see Section 12). This summary is for convenience; the full policy below governs.

1. About this policy

This Privacy Policy describes how Quorbit ("Quorbit", "we", "us", "our") processes personal data in connection with the Rinsora mobile application (Android package com.rinsora.app), the customer order-tracking pages, and the website at rinsora.quorbit.in (together, the "Service").

It is published in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Digital Personal Data Protection Act, 2023 ("DPDP Act") and rules made under it, and, where applicable, the EU and UK General Data Protection Regulation ("GDPR") and other applicable data protection laws. By using the Service you acknowledge that you have read this policy.

2. Definitions

Personal data — any data about an individual who is identifiable by or in relation to such data.
Account holder / Owner — the person who registers a Rinsora account and creates one or more shops.
Staff user — a person invited by an Owner to use a shop's account with a role (for example manager, counter, delivery or ironing).
End customer — a customer of a shop whose details the shop records in Rinsora.
Shop data — data a shop enters about its business, staff and end customers, including orders, payments and invoices.
Data Fiduciary / Controller — the party that decides the purpose and means of processing. Data Processor — a party that processes data on the fiduciary's behalf.

3. Our role: fiduciary and processor

Account data (your sign-in email, account settings, support correspondence): Quorbit is the Data Fiduciary / Controller.
Shop data (staff and end-customer records, orders, payments, invoices, expenses): the shop (Owner) is the Data Fiduciary / Controller, and Quorbit acts as its Data Processor, processing that data only on the shop's instructions to provide the Service. End customers should direct requests about their data to the shop first; we will assist the shop in responding.

4. Personal data we process

Category	Examples	Source
Account & identity	Email address, password (stored only as a salted hash by our authentication provider), user ID	You
Shop profile	Shop and owner name, phone, address, country, tax registration number (e.g. GSTIN), opening hours, logo, UPI ID or payment link	Owner
Staff records	Name, phone, role, permissions, salary, attendance, login email	Owner
End-customer records	Name, mobile number; optionally email, address, billing cycle, notes	Shop
Transaction records	Orders, items, prices, discounts, coupons, payments and method (cash/UPI/card — recorded by the shop; we do not process card or bank credentials), invoices, expenses	Shop
Technical data	IP address, request timestamps and error logs kept by our hosting providers for security and reliability	Automatic
On-device preferences	Language, theme, app-lock on/off, selected shop — stored only on your device	You
Support	Messages and attachments you send us	You

We do not collect precise location, contacts, call logs, SMS, advertising identifiers, or biometric data, and the app contains no advertising or third-party analytics SDKs. We do not knowingly collect "sensitive personal data" as defined in the SPDI Rules, other than passwords, which are stored only in hashed form. Payments made by end customers through UPI happen in their own UPI app; Rinsora never receives their bank details.

5. Device permissions

Permission	Why	What leaves your device
Camera	Scan QR codes on order tags	Nothing — frames are processed on-device and not stored
Photos / media	Choose a shop logo	Only the image you select
Biometrics (fingerprint/face)	Optional app lock	Nothing — verification is done by Android; we only receive "success" or "failure"
Internet	Sync your shop's data	Shop data, over encrypted connections

You can revoke permissions at any time in your phone's settings; related features will stop working.

6. Purposes and legal bases

Purpose	DPDP Act basis	GDPR basis (Art. 6)
Create and secure your account; authenticate you	Consent (s. 6); legitimate use for the specified purpose you provided data for (s. 7(a))	Contract (6(1)(b))
Provide the Service: orders, receipts, invoices, payment QR codes, reports, staff roles, multi-shop	As above; processing on the shop's behalf as processor	Contract (6(1)(b)); processing on controller's instructions (Art. 28)
Show end customers their order on a tracking link shared by the shop	Shop's instructions	Controller's legitimate interests (6(1)(f))
Customer support and service communications	Consent; legitimate use	Contract; legitimate interests
Security, fraud prevention, debugging, backups	Legitimate use	Legitimate interests (6(1)(f))
Comply with law, court orders and lawful requests	Legitimate use (s. 7(c)–(d))	Legal obligation (6(1)(c))

Where we rely on consent, you may withdraw it at any time by deleting your account (Section 12) or writing to us; withdrawal does not affect processing before it. We do not use personal data for advertising, profiling, or automated decisions that have legal or similarly significant effects, and we do not sell or rent personal data.

We disclose personal data only as follows:

Sub-processors that host and operate the Service under written agreements with confidentiality and security obligations:

Provider	Service	Location
Supabase, Inc.	Database, authentication, file storage	Cloud region selected for the project (may be outside India)
Google LLC	App distribution (Google Play); crash reports you choose to share via Android	Global
Website hosting provider	Serving this website	As configured

Within a shop or business — staff users see data according to the role and permissions the Owner sets. If an Owner turns on customer sharing between their shops, customer contact details (not orders or payments) are visible to the Owner's other shops.
At your direction — receipts, invoices and messages you send by WhatsApp, email, PDF or print go to the recipients you choose, under those services' own terms.
Tracking links — anyone holding an order's unguessable link can view that order's status, items and amount, but not the customer's phone number or address.
Legal — where required by law, regulation, legal process or a lawful request of a government agency, or to protect the rights, property or safety of Quorbit, our users or the public.
Business transfers — in a merger, acquisition or sale of assets, subject to this policy, with notice to you.

8. International transfers

Our sub-processors may store or process data outside your country, including outside India. Such transfers are made as permitted under section 16 of the DPDP Act (to countries not restricted by the Central Government) and, for data subject to the GDPR, under appropriate safeguards such as the European Commission's Standard Contractual Clauses.

9. Security

We implement reasonable security practices and procedures, appropriate to the nature of the data, including:

Encryption in transit (TLS/HTTPS) for all traffic, and encryption at rest provided by our hosting provider;
Database row-level security so each shop, and each staff role, can access only the data it is permitted to;
Hashed passwords, short-lived access tokens, and an optional on-device biometric lock;
Least-privilege access for our personnel, and regular backups.

No system is perfectly secure. You are responsible for keeping your password confidential, removing staff who should no longer have access, and securing your device.

10. Personal data breaches

If we become aware of a personal data breach, we will act promptly to contain it and will notify the Data Protection Board of India and affected Data Principals in the form and manner prescribed under the DPDP Act, report to CERT-In within the time required by its directions, and, where the GDPR applies, notify the competent supervisory authority within 72 hours where required. Where we act as processor, we will notify the affected shop without undue delay so it can meet its own obligations.

11. Retention

Data	Retention
Account and shop data	While the account or shop is active, until deleted by you
Deleted shops or accounts	Removed from live systems immediately (shops) or within 7 days of a verified request (accounts); purged from backups within 30 days
Inactive accounts	We may delete accounts inactive for 3 years after giving 48 hours' notice to the registered email, as contemplated by the DPDP rules
Security and server logs	Up to 180 days, or longer where required by law
Support correspondence	Up to 2 years after the issue is closed

Shops are responsible for keeping their own copies of invoices and records they must retain under tax or other laws (for example, GST record-keeping) before deleting data.

12. Deleting your data or account

Delete a shop (in the app): the Owner opens Settings → Shop profile → Delete this shop and confirms by typing the shop's name. All of that shop's orders, payments, invoices, prices, staff, coupons and expenses are permanently deleted.
Delete your account: email info@quorbit.in from your registered email with the subject "Delete my Rinsora account". After verifying the request we delete your account and all shops you own within 7 days and confirm by email. Backups are purged within 30 days.
Staff users: ask the Owner to remove you, or contact us.
End customers: ask the shop to remove your details; if you cannot reach the shop, contact us and we will forward your request.

13. Your rights

Subject to applicable law, you have the right to:

Access a summary of your personal data and the processing activities, and the identities of those with whom it has been shared;
Correction, completion and updating of inaccurate or incomplete data (most of it can be edited directly in the app);
Erasure of data no longer needed, and withdrawal of consent;
Grievance redressal through our Grievance Officer, and, if unresolved, to complain to the Data Protection Board of India;
Nominate another individual to exercise your rights in the event of death or incapacity;
Where the GDPR applies: restriction, objection, data portability, and to lodge a complaint with your local supervisory authority.

To exercise a right, email info@quorbit.in. We may need to verify your identity. We respond within 30 days, and earlier where required by law. We will not discriminate against you for exercising your rights.

14. Children

The Service is a business tool intended for persons aged 18 or over. We do not knowingly process personal data of children (under 18 in India; under 16, or the age set by local law, elsewhere) as account holders, and we do not track, behaviourally monitor or target advertising at children. If you believe a child has created an account, contact us and we will delete it.

15. Responsibilities of shops

As the fiduciary/controller of shop data, each shop is responsible for: having a lawful basis and giving any required notice to its staff and end customers; entering only data that is necessary; keeping data accurate; responding to its customers' requests; and setting staff permissions appropriately. Shops must not use Rinsora to store sensitive data (such as health, financial-account or government ID numbers) about end customers.

16. This website

This website does not use cookies, analytics or advertising trackers. Our web host may log IP addresses and request details for security. The page loads fonts from Google Fonts, which receives your IP address under Google's privacy policy. Customer tracking pages load only the data for the single order in the link.

17. Grievance Officer and contact

In accordance with the Information Technology Act, 2000, the rules made under it, and the DPDP Act, the details of our Grievance Officer are:

Grievance Officer: Sanjeev Francis
Organisation: Quorbit Technologies
Address: Royal Apartment, Bhaudaji Road,
Sion (West), Mumbai,
Maharashtra - 400 022, India
Email: info@quorbit.in (subject: Grievance – Rinsora)
Hours: Monday–Friday, 10:00–18:00 IST

We acknowledge grievances within 24 hours and aim to resolve them within 15 days of receipt, and in any case within the period prescribed by law.

18. Governing law and disputes

This policy is governed by the laws of India. Subject to any non-waivable rights you have under the laws of your country of residence, disputes are subject to the exclusive jurisdiction of the courts at [City], India. Nothing in this policy limits rights you have under mandatory consumer or data protection laws.

19. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new "Last updated" date and, for material changes, notify you in the app or by email before they take effect. Continued use after the effective date means you accept the updated policy.