Privacy Policy
Last updated: 16 October 2026
DotMax (“DotMax”, “we”, “us”) makes software for restaurants: our website at dotmax.io, the restaurant dashboard, point of sale, kitchen and waiter screens, QR menus and ordering pages, and the menu assistant. This policy explains what personal data we handle, why, who we share it with, how long we keep it and the choices you have.
We follow the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka. We do not sell personal data, and we do not use it for advertising.
1. Who is responsible for your data
It depends on how you meet us:
- We are responsible (the “controller”) for data about visitors to our website, restaurant owners and staff who hold a DotMax account, people who contact us, and the restaurants we bill.
- The restaurant is responsible for data about its own guests and customers: orders placed from its QR menu, its customer list, loyalty points, reservations, feedback and the text messages it sends. We hold and process that data only on the restaurant’s instructions, to run its service (we are its “processor”). If you are a guest, the restaurant’s own privacy notice applies, and requests about your data should go to the restaurant first. We will help it answer them.
2. What we collect
Restaurant owners and staff
- Your name, email address, mobile number, role and the branches you work at.
- Your password, which we store only as a one-way scrambled form (a bcrypt hash). Nobody at DotMax can read it.
- Sign-in records: when you signed in, your IP address and browser, so you can see and end your sessions and we can spot misuse.
- An audit trail of important actions (for example a bill voided, a discount given, stock adjusted, a setting changed): who did it, when, from which IP address and browser.
- Shift and attendance times recorded when you sign in and out, where the restaurant uses them.
- The business information you enter: restaurant name and address, menu and prices, tables, stock, suppliers, purchases, orders, payments recorded, cash drawers, reports, and the files you upload such as logos, menu photos and receipts.
Guests ordering from a restaurant’s QR menu
- The restaurant, branch and table, what you order, any notes you add and the order’s progress.
- Your mobile number and name, if the restaurant asks for them, so it can recognise you next time and keep your loyalty points.
- Feedback and ratings you choose to give.
- A random, anonymous id in a cookie, so your phone can follow the orders it placed. See our Cookie Policy.
The menu assistant
The assistant answers questions about the menu on your phone. When it cannot answer a question, the question’s words are sent to us so our team can teach the assistant the answer. Before the question leaves your phone, anything that looks like a phone number, card number or email address is replaced with a placeholder. The question is not linked to your name, number or order.
If you tap the microphone, your browser’s own speech recognition turns your voice into text. Some browsers, such as Google Chrome, do this on their maker’s servers, under that company’s privacy policy. We receive only the text, never a recording. The assistant’s spoken replies come from our own server or are made on your device, with no outside voice service.
Customer records restaurants keep
A restaurant may keep a customer list with names, mobile numbers, email addresses, birthdays, anniversaries, addresses, visits, loyalty points and reservations, and may send text messages to those customers. The restaurant decides what it records and is responsible for having its customers’ permission where the law requires it.
Website visitors
Our website has no analytics, advertising or tracking tools, and its fonts and videos are served from our own server, so a visit sends nothing to other companies. Like every web server, ours briefly keeps technical logs of requests (IP address, browser, page and time) to keep the service secure and fix problems.
When you contact us or buy from us
The messages you send us by email, phone or WhatsApp, and for restaurants that subscribe, our invoices, the payments you make to us and their bank references or receipts.
3. Why we use it
| Purpose | Legal basis |
|---|---|
| Providing the service: accounts, sign-in, orders, billing, kitchen screens, reports and everything else the restaurant uses. | Our contract with the restaurant |
| Processing guests’ and customers’ data for the restaurant. | The restaurant’s instructions, on its own legal basis |
| Keeping the service secure: sign-in records, audit trail, rate limits, error reports. | Our legitimate interest in a secure service, and the restaurant’s |
| Billing restaurants and keeping accounting records. | Our contract, and our legal duties |
| Answering your messages and giving support. | Your request, and our contract |
| Telling restaurants about service changes, problems or their account. | Our contract |
| Meeting legal requests from authorities. | Our legal duties |
Where we rely on your consent, you can withdraw it at any time. That does not affect what was done before you withdrew it. We do not make decisions about people based solely on automated processing that have legal or similarly significant effects on them.
5. Where your data is stored
Our servers and database are in Singapore. When data leaves Sri Lanka we protect it with the safeguards the law requires, including contracts with our providers and the security measures below.
6. How long we keep it
| Data | How long |
|---|---|
| Restaurant accounts and business data, including guest orders and customer records | While the restaurant’s account is open. After it closes we delete or anonymise it within 90 days, unless the law requires us to keep something longer or it is needed for a dispute. A restaurant can ask us to delete a customer’s record at any time. |
| Audit trail | For the life of the restaurant’s account. It cannot be edited, so it stays a reliable record. |
| Sign-in sessions | Deleted 7 days after they end |
| Password reset codes | Deleted after 7 days |
| Technical error reports | Deleted 90 days after they are resolved |
| Unanswered menu-assistant questions | While the restaurant’s account is open, or less if the restaurant asks us to delete them |
| Our invoices and payment records | As long as tax and accounting laws require |
| Backups | Removed automatically as the backup history rolls forward |
7. How we protect it
- Every connection is encrypted (HTTPS), and browsers are told to always use it.
- Passwords are stored only as bcrypt hashes. Sign-in tokens are short-lived and kept in cookies that page scripts cannot read.
- Each restaurant’s data is kept apart, and every person only sees what their role and branches allow.
- Two-step verification with an authenticator app is available for privileged accounts.
- Important actions are recorded in an audit trail that cannot be changed.
- Connections to our database are encrypted.
No system can be perfectly secure. If a breach affects personal data, we will tell the affected restaurants without undue delay and notify the authorities as the law requires.
8. Your rights
You can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct data that is wrong or incomplete;
- delete your data, where we no longer need it or have no right to keep it;
- stop processing that relies on your consent (withdraw your consent);
- review a decision made solely by automated means that affects you.
Email info@dotmax.io. We may need to confirm who you are first. We reply within 21 working days. If your request is about data a restaurant holds about you as its guest or customer, we will pass it to that restaurant and help it respond. If you are not satisfied with our answer, you can complain to the Data Protection Authority of Sri Lanka.
9. Children
DotMax accounts are for restaurants and their staff, not for children. Guests of any age may order from a restaurant’s QR menu, and we collect nothing about a child beyond what the order needs. If you believe a child has given us personal data, contact us and we will delete it.
11. Changes to this policy
When we change this policy we update the date at the top. If a change is significant, we tell restaurants by email or in the app before it takes effect.
12. Contact us
For anything about privacy or your data:
DotMax548/1 Avissawella Road, Wellampitiya, Sri Lanka
Email: info@dotmax.io
Phone: 071 013 5558