1. Personal Data We Collect

Under Section 6 of the DPDP Act (Principle of Data Minimisation), we collect only data necessary for service fulfillment:

A. Account & Contact Information

• User Profile: Full Name, Email Address, and Mobile Phone Number verified via Telecom SMS OTP. We do NOT collect or require Aadhaar or government identity cards from customer patrons.
• Saved Locations: Street address, landmark, PIN code, and GPS pin (Home, Office, Other).

B. Service-Specific Operational Data

• Food Delivery: Menu selections, dietary notes, restaurant FSSAI preference, and delivery instructions.
• Parcel Logistics: Sender details, recipient name, contact number, pickup/drop coordinates, declared item category, and the mandatory Prohibited Items Non-Possession Declaration (certifying absence of narcotics, weapons, alcohol, currency, or explosives under Carriage by Road Rules).
• Bike Taxi Rides: Pickup/drop GPS locations, road routing coordinates, live ride tracking links shared with emergency contacts, and in-app SOS emergency logs.

C. Payments & Financial Data

• We do NOT store sensitive credit/debit card numbers, CVVs, or UPI PINs. Online transactions are tokenized and processed via RBI-authorized payment aggregators (e.g., Cashfree/Razorpay) complying with PCI-DSS standards.

2. Purpose of Data Processing

• To connect you with licensed FSSAI restaurants, nearby parcel couriers, and licensed bike taxi captains.
• To calculate accurate road routing distance, estimated arrival times, and transparent fares.
• To enable real-time order tracking and dispatch automated delivery confirmation OTPs.
• To provide 24x7 customer support, address grievance tickets, and process 3-7 day refunds under RBI settlement guidelines.
• To collect and remit 5% GST on restaurant services directly to the Government under Section 9(5) of the CGST Act, 2017.
• To assist emergency police dispatch via the 112 SOS trigger when requested during bike taxi rides.

3. Data Sharing & Third-Party Disclosures

We do not sell personal information to third-party advertisers. Data is shared strictly on a need-to-know operational basis:

• Restaurant Partners: Order contents and customer name to prepare food safely.
• Delivery Partners & Captains: Delivery address, contact phone (for delivery coordination), and navigation coordinates during active orders only.
• Law Enforcement Authorities: When required under Section 69 of the IT Act, 2000, Section 9 of the Post Office Act, 2023, or lawful police/court orders.

4. Data Principal Rights (DPDP Act, 2023)

• Right to Access & Summary: You can review your transaction history, invoices, and profile at any time in the app.
• Right to Correction: Update your name, email, or addresses directly in Profile Settings.
• Right to Erasure / Account Deletion: You have an instant right to delete your account and personal data directly in the app (Profile ➔ Delete Account) or online at /delete-account. Personal data is permanently purged within 30 days.
• Right to Grievance Redressal: Submit privacy concerns directly to our Grievance Officer.

5. Data Storage, Retention & Security

Personal data is hosted on secure cloud infrastructure located within India, protected by 256-bit SSL encryption. In accordance with CERT-In directions under Section 70B of the IT Act, system and communication logs are retained for 180 days to detect and prevent cyber fraud.

6. Grievance Officer & Nodal Contact (India Compliance)

In accordance with the IT Act 2000, Consumer Protection Rules 2020, and DPDP Act 2023: