BaariPrivacy Policy
Last updated: 21 October 2026
Baari is an online token and queue management service operated by Anekantix Technologies, S-3, Second Floor, Yashwant Plaza, Indore, Madhya Pradesh ("we", "us"). This policy explains what personal data we process, why, and your rights under the Digital Personal Data Protection Act, 2023 (DPDP Act), the DPDP Rules, 2025 and the Information Technology Act, 2000.
1. Our two roles
- Business accounts (clinics, labs, salons and others who sign up): we decide how your account data is used, so we are the Data Fiduciary for it.
- Visitors (people who take a token at a business that uses Baari): the business decides why your details are collected, so the business is the Data Fiduciary. We process your details only on its behalf, as its Data Processor.
2. What we collect
From businesses: business name, owner's email address and mobile number, city, a password (stored only as a one-way hash), announcement language, payment records (amount, date, plan and payment reference), and basic usage data such as last login time. Card, UPI and bank details are handled by our payment partner Razorpay and are never seen or stored by us.
From visitors: the name and, if you choose, the mobile number that you or the receptionist enter for your token; the token number and the times it was issued, called and completed. If you turn on alerts, your browser gives us a push-subscription address so that we can send you queue notifications. We do not collect medical information, ID numbers (such as Aadhaar), photos or location.
Technical data: IP address and browser details, used briefly to keep the service secure and to stop abuse. Logged-in businesses get one essential session cookie. We use no advertising or tracking cookies. On visitors' phones we store the tokens taken on that device in local storage so they can find them again. Queue screens may also show clearly labeled sponsored images or muted videos. Ad delivery and aggregate impression/click measurement do not use token details, names, phone numbers, or health information to choose ads.
3. Why we use it
- To run the queue: issue tokens, show live positions, announce tokens and send turn alerts.
- To manage business accounts, subscriptions, billing and support.
- To keep the service secure, prevent spam and fraud, and meet legal obligations.
- To display operator-approved sponsored content on selected TV and token-tracking screens and report aggregate campaign delivery.
We do not sell personal data, use visitor personal data for ad targeting, or send marketing messages to visitors. Ad reports count impressions and clicks by campaign, clinic and screen, without recording a visitor's token or identity.
4. Legal basis
Businesses give consent when they create an account. Visitors provide their details voluntarily for the specific purpose of getting and tracking a queue token (a legitimate use under Section 7(a) of the DPDP Act), and the business is responsible for that collection. You can withdraw consent at any time as described in section 8.
5. How long we keep it
- Visitor names and mobile numbers are kept for 365 days from the date of the token and then erased automatically. We keep them this long because the DPDP Rules, 2025 require records of processing to be kept for one year. After that, only anonymous counts and times remain for the business's reports, and those are deleted after about 13 months.
- Alert subscriptions are deleted once the token is finished, and within one day at the latest.
- Ad delivery events contain only a campaign, clinic, screen, event type and random event identifier; they are automatically deleted after 400 days.
- Business accounts are kept while active and deleted when the owner deletes the account. Payment records are kept for 8 years because Indian tax laws require it.
- Backups are kept for 7 days and then overwritten.
6. Who we share it with
Only with service providers who help us run Baari, under confidentiality obligations: our cloud hosting provider, Razorpay (payments), our email provider (password-reset emails and reports), the media CDN that hosts and delivers sponsored creative (currently Cloudinary), and browser push services run by Google, Mozilla, Apple or Microsoft (these deliver alerts, which are end-to-end encrypted so they cannot read them). When your browser loads an ad creative from the CDN, that provider receives the network request and its ordinary connection data, such as your IP address. If you choose to open a sponsored link, the advertiser's site receives your connection data. We share data with government authorities only when Indian law requires it.
7. Security
All traffic is encrypted with HTTPS. Passwords are hashed, access is restricted, and backups are taken daily. If a personal data breach happens, we will inform the affected businesses and people and the Data Protection Board of India as the DPDP Act and Rules require.
8. Your rights
You can ask to access, correct or erase your personal data, withdraw consent, raise a grievance, or nominate someone to act for you. Businesses can edit their details under Settings and delete their account at any time. Visitors can cancel their own token, or ask the business or us to correct or erase their details. We erase them as soon as the law allows. Write to our Grievance Officer below. We reply within 48 hours and resolve requests within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.
9. Children
Baari is meant for businesses. A token for a child should be taken by a parent or guardian.
10. Grievance Officer
[Grievance Officer name]
Anekantix Technologies, S-3, Second Floor, Yashwant Plaza, Indore, Madhya Pradesh
Email: info@anekantix.in
11. Changes
If we change this policy we will update this page and the date above, and tell businesses about important changes by email.