Legal
Privacy
What Vardivo collects when a guest joins a waitlist, why, how long we keep it, and who can see it.
Effective 19 September 2026. If we change this page we will update this date, and we will tell restaurants using Vardivo before a change that affects them takes effect.
The short version
- A guest gives their name, mobile number and party size to join a queue. That is the whole of it.
- The restaurant you are joining decides what happens with that information. We hold it for them.
- We delete names and mobile numbers after 30 days — counted from when you joined a queue, or from the date you booked for. A one-way fingerprint of the number stays, and one thing we have not finished deleting is named below.
- We do not sell anything to anyone, and there are no advertising or third-party analytics trackers on these pages.
Who is responsible for what
The restaurant whose QR code you scanned decides to run a waitlist and decides what to do with the details you give it. Under India's Digital Personal Data Protection Act, 2023 it is the Data Fiduciary for that information. Vardivo provides the software and stores the data on the restaurant's behalf as its Data Processor. If you are elsewhere and equivalent words apply, the restaurant is the controller and Vardivo is the processor.
That means a request to see, correct or delete your details can go to the restaurant, or to us at promragger@icloud.com — we will act on it and tell the restaurant.
What we collect, and why
- From a guest joining a waitlist
- Your name, your mobile number and your party size, because the staff need to know who to call, on what number, and for how many people. We also record when you joined and each step that follows — waiting, called, seated, cancelled, no-show — because that is the queue, and because it is what the restaurant's nightly report counts. From your number we additionally derive a one-way fingerprint, which is what lets the report count returning guests; see "How long we keep it" for how the two are treated differently.
- From a guest's browser
- Your phone keeps a short random key for the join form (so a double tap does not put you in the queue twice). It stays on your device. Our server logs the ordinary things a web server logs — the request, the time, an IP address — to keep the service running and to find faults.
- From a restaurant owner who requests access
- What you type into the Request access form on our home page: your name, your restaurant, its city, the email address or phone number you want us to reach you on, and anything you tell us about your door. We use it only to get back to you about Vardivo.
- From restaurant staff
- The name and device label a manager enrols with, and a credential for that device. Staff credentials are never written to our logs.
From guests, we do not ask for, and have no use for, an email address, a location, photographs, or anything about what they ate.
Messages
If the restaurant has WhatsApp table-ready messages switched on, the join page tells you so before you join, and joining is what agrees to that one message. The message goes through a WhatsApp Business provider, which necessarily sees your mobile number in order to deliver it. If the restaurant has not switched messaging on, no message is sent and we do not promise one — staff will call you instead. We do not send marketing messages, and we do not use your number to reach you about anything other than your place in that queue.
Who can see your details
The staff of the restaurant you joined, on their enrolled devices. Nobody else: the live page you get after joining shows your own place in line and never another guest's name, number or party. We do not share guest details with other restaurants, and we do not sell or rent them to anyone.
We use service providers to run Vardivo — hosting, the database, and a WhatsApp Business provider where messaging is on. They act on our instructions and for no other purpose.
How long we keep it
Your name and your mobile number are deleted after 30 days, and the day that period counts from depends on how you came to us. Deletion is automatic in both cases; nobody has to remember to do it.
- If you joined a queue
- 30 days from when you joined — the clock runs from when you gave us the details, not from when your evening ended — and only once that visit has settled: seated, left the queue, or did not arrive. A visit still open is not purged, however old it is.
- If you booked a table
- 30 days from the date you booked for, and unconditionally — a booking is purged on that deadline whether or not anything ever resolved it. That is deliberate: a booking nobody cancelled, seated or marked as missed should not keep your number forever just because its status was never moved.
A Request access form is kept until we have dealt with it, and deleted whenever the person who sent it asks us to. It is not guest data and never reaches a restaurant.
Two things deliberately outlive that deletion:
- A one-way fingerprint of your number. When you join we also store a keyed hash of your mobile number, and that hash is not deleted. It cannot be turned back into your number — it exists so the restaurant's nightly report can tell that someone is a returning guest and count how many, without keeping the number to do it.
- The shape of the evening. Timestamps and queue states survive: how many parties, how long they waited, when the rush was. That is no longer about you.
And one thing we would rather tell you than let you discover: if a WhatsApp table-ready message was queued for you, the queued message itself still holds your name and number, and those queued records are not on any deletion schedule today. They are reachable only by us, they are never shown to another restaurant, and this is a gap in our own housekeeping rather than a decision — it is written up as work to do. We will say so here, plainly, until it is fixed. If you want yours removed now, write to promragger@icloud.com and we will delete it by hand.
Keeping it safe
Traffic to Vardivo is encrypted in transit. Queue data is reachable only by a restaurant's own enrolled staff devices, and staff credentials are stripped from our logs rather than recorded in them. No system is perfect; if something goes wrong that affects your information, we will tell the restaurant and, where the law requires it, the authority and you.
Children
Vardivo is for restaurant staff and adult guests joining a queue. We do not knowingly collect anything from a child, and a party size is a number, not a list of people.
Payments
There is no checkout on this site today; paid plans are arranged with us directly. When we do take payment it will be through a payment provider, and card details will go to that provider, not to us.
Getting in touch
Write to promragger@icloud.com for anything on this page, including a request about your own information or a complaint about how it was handled. We answer these ourselves.