Privacy Notice

Tokri Ltd (trading as "Tokri") is the data controller for the personal data described in this notice. You can contact us about privacy at sabbirhossainnde@gmail.com.

Restaurants using Tokri are themselves controllers of their own customer and menu data; for that data we act as a processor on their behalf.

Account data — name, email address, password credentials (stored hashed), restaurant name and contact details. Used to create and secure your account and provide the service. Legal basis: performance of our contract with you.

Menu and business content — menu items, prices, photos, opening details, table numbers. Used to publish your menu and take orders. Legal basis: contract.

Order data — table number, items ordered, order notes, order status, and any name or note a diner adds. Used to deliver orders to the restaurant and show the diner their status. Legal basis: contract and legitimate interests of the restaurant.

Support messages — the name, email, subject and content you send us. Used to answer your request. Legal basis: contract and legitimate interests.

Usage and technical data — pages viewed, QR scans, aggregate conversion metrics, device type, browser, approximate country derived from IP address, and IP address in server logs. Used for security and fraud prevention, to show restaurants their analytics, to set your interface language, and to improve the product. Legal basis: legitimate interests.

Marketing communications — where you opt in, we may email you product news. Legal basis: consent, withdrawable at any time.

Payment card details are never collected or stored by us. Payments are processed by Paddle as Merchant of Record.

• Service providers / subprocessors — hosting, database, storage, authentication and email delivery providers, and support tooling, acting on our instructions.
• Merchant of Record (Paddle) — for sale of the product, subscription management, payments, tax compliance and invoicing.
• Professional advisers — legal and accounting advisers where necessary.
• Authorities — where we are required to disclose by law or to protect legal rights.

We do not sell personal data.

Our providers may process data outside your country, including outside the UK/EEA. Where that happens we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

We keep account, menu and billing records for as long as your account is active and for up to 6 years afterwards where needed for tax, accounting and legal purposes. Order records are kept for up to 24 months for restaurant analytics. Support messages are kept for up to 24 months. Server logs are kept for up to 90 days. When data is no longer needed it is deleted or anonymised.

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to processing, receive a portable copy, and withdraw consent. Under UK/EU GDPR you also have the right to complain to your supervisory authority. Email sabbirhossainnde@gmail.com and we will respond within one month.

We apply appropriate technical and organisational measures, including encryption in transit, hashed credentials, row-level access controls in our database, and restricted administrative access. No system is completely secure, so we also keep processes for detecting and responding to incidents.

We use strictly necessary cookies and browser local storage to keep you signed in, remember your language and currency preference, and let a diner return to their in-progress order. We use limited first-party analytics to count QR scans and orders for restaurant dashboards. We do not use advertising cookies. You can clear or block cookies in your browser settings, though sign-in and ordering may then stop working.

The service is intended for business users and is not directed at children.

We may update this notice. Material changes will be announced by email or in the app, and the date at the top of this page will change.