Privacy Policy

1. Who this Policy covers

This Policy applies to customers who use the PackKardo mobile app, support users, and restaurant partners’ personal data (onboarding, KYC, settlements, Partner tools). Commercial partner terms are in the Restaurant Partner Agreement. Customers order only in the mobile app. This website publishes the Policy; it is not an ordering service.

This Policy does not replace our Terms of Service, Refund Policy, or Restaurant Partner Agreement for contract, liability, food safety, refunds, or pickup obligations. It does not add any liability beyond what Indian law requires.

PackKardo is a proprietorship of Shivam Rahar. GSTIN 04DJFPR1441M1Z3. Registered office: Cabin No. 2, Business & Industrial Park, Eraya Co-Working Space, Plot No. 28, II, Chandigarh, 160002.

2. Personal data we collect

We process the categories below — the inventory of data our services actually use:

• Account: mobile number (OTP login), optional Google or Apple account identity (email, name, or profile photo when you choose that sign-in), name, email, profile photo, referral codes, saved vehicle / parking-related details. We do not store your Google or Apple password.
• Orders: restaurant, items, prices, fees, status, fulfilment mode (pickup / dine-in / car handoff), pickup OTP, special instructions (including allergen notes you write), vehicle number, parking spot / pin.
• Location: approximate or precise location when allowed for nearby restaurants; parking pin or one-time GPS for car handoff; optional live GPS share during an active order (about every 25 seconds) until you stop, handoff ends, or the share window expires (about 30 minutes). No continuous background tracking for marketing after handoff. Coordinates come from your phone and can be wrong.
• Payments: method choice (UPI / card / wallet via Razorpay — prepaid only), status, and gateway references. We do not offer cash, pay at pickup, or cash on delivery. We do not store full card numbers, CVV, or UPI PINs.
• Reviews & uploads: ratings, notes, tags; photos or documents you choose to upload.
• Device & security: device type, OS, app version, push tokens (Expo / FCM), IP address and user-agent on auth and sensitive requests, basic diagnostics.
• Support: chat messages, attachments, tickets, grievance submissions, marketing opt-out records.
• Partners: business/owner identity, licence documents, settlement details, menu/media, staff login phones as needed to run Partner accounts.
• Browsing and ordering happen only in the mobile app and require a signed-in account with a verified mobile number. We do not offer guest checkout, Facebook login, or biometrics. Optional Google or Apple sign-in is still linked to a verified phone number.

3. How we collect data

• Directly from you (registration, orders, reviews, support, partner onboarding).
• Automatically (device signals, push tokens, IP/user-agent, location when permitted, on-device session storage in the app).
• From providers (Razorpay payment confirmations; MSG91 SMS delivery status; media URLs).
• From restaurants (acceptance, prep status, fulfilment, review responses).

4. Purposes and DPDP legal bases

We use personal data to: create and secure accounts (OTP/sessions); show restaurants and fulfil pickup, dine-in, and car orders; process prepaid payments, refunds, and fraud prevention; send order alerts (push, SMS via MSG91, in-app); send optional marketing you can opt out of; provide support and grievances; improve reliability and safety; comply with law; and operate Partner KYC/settlements.

Where consent is required, you may withdraw it as described under Your rights. Transactional processing needed for an active order or account security may continue while you use those features. We do not sell personal data or use it for third-party cross-context advertising networks.

5. App permissions

We ask for permissions only when a feature needs them. You can deny them in device settings; some features may be limited.

• Location (when in use) — nearby restaurants, parking pin, optional live car-handoff share.
• Photos / media — profile, support attachments, partner media via system picker.
• Camera — partner onboarding / document capture when a partner uses the camera.
• Notifications — order and account alerts; optional promotional notifications.
• OTP/login SMS may still be sent by MSG91 when you request a code, even if push is off.

6. Location and car handoff

Nearby discovery uses location only if you allow it. Car handoff uses parking details and/or GPS you provide for that order, shared with the fulfilling restaurant. Live share is optional, order-scoped, and time-limited. Your phone supplies the coordinates. GPS and parking pins can be inaccurate. PackKardo does not guarantee location accuracy.

Arrival timing, parking accuracy, and customer availability are governed by the Terms of Service and Refund Policy — not by this Privacy Policy.

7. Payments, refunds, and platform fees

Online payments are processed by Razorpay. Razorpay’s privacy practices apply to card and UPI data it handles. PackKardo is prepaid only (UPI / card / wallet). We do not offer cash, pay at pickup, or cash on delivery. We store payment-status information for the order, not card credentials, CVV, or UPI PINs. PackKardo is not responsible for Razorpay’s systems.

Refunds, cancellations, no-shows, and platform fees follow our Refund Policy (/refund-policy).

8. How we share information

We share data only as needed:

• Restaurants: order details, name/phone for fulfilment, vehicle/parking/live or pin location for car handoff, review content, limited support context for order issues. The restaurant is an independent business. After we share what that order needs, how the restaurant stores or uses it is the restaurant’s responsibility.
• Service providers: hosting (Vercel, Railway); PostgreSQL database; Redis (where configured); SMS (MSG91 only); email (SMTP); WhatsApp chats you start with our published numbers; push (Expo, Firebase Cloud Messaging); payments (Razorpay); media (Cloudinary); API error monitoring (Sentry); Google Sign-In (Google); Sign in with Apple (Apple); Google Maps directions links. We are not responsible for those providers’ outages or security incidents. When you open WhatsApp, Google Maps, Google, or Apple, that service’s own policy applies.
• Legal & safety: when required by law or to investigate fraud, protect safety, enforce Terms, or defend claims.
• Business transfers: merger, acquisition, or asset sale under continuing confidentiality.
• We do not sell personal data or share it with third-party advertisers for their independent marketing.

9. Cross-border transfers

Some providers (for example cloud hosting, push, payments, media, or error monitoring) may process data outside India to run the app. PackKardo does not control those providers’ systems. Their own terms apply to their service. We do not use this data for advertising.

10. Device storage

Customers use the PackKardo mobile app only. We do not operate a customer website or web app for browsing or ordering, and we do not run a customer advertising-cookie stack. The app stores what it needs on your device (for example session tokens and preferences). This packkardo.com page only publishes the Policy. It is not an ordering service.

11. Marketing and communications

Transactional and security messages (OTP via MSG91, order status, account security, refunds) are part of the service. Marketing / offers are optional. Promotional notifications may be sent if notifications are enabled unless you opt out — turn off promo notifications where available, or email admin@packkardo.com with subject “Marketing opt-out” and your registered phone number. Marketing consent is not required to place an order. We do not sell or rent your phone number to unrelated marketers.

12. Retention

We keep account data while your account is active. After deletion, we remove or anonymise personal account data. Anonymised order and payment records may be kept up to 8 years after order completion for tax, accounting, refunds, disputes, and fraud prevention, then deleted or further anonymised. Live location share ends after stop / handoff / share window. OTP codes are short-lived. Support tickets are kept as needed to resolve and meet legal duties.

13. Your rights

Subject to applicable law and identity verification, you may access, correct, or erase personal data; withdraw consent for consent-based processing (for example marketing or optional live location); and raise a grievance. To request a copy of your data, raise a grievance in the app or email support. These rights do not make PackKardo responsible for restaurant food, a provider’s systems, or information you submitted yourself.

• App: Profile → About → Privacy & account (grievance, delete account).
• This website explains those steps. It is not a customer ordering account.
• Email admin@packkardo.com with a clear subject and your registered +91 phone number.
• We aim to respond to privacy grievances within 7 days. You may escalate under applicable law, including to the Data Protection Board of India when available for your matter.

14. Account deletion

You can permanently delete your PackKardo customer account (not freeze only):

App: Profile → About → Privacy & account → Delete account.

Or email admin@packkardo.com with subject “Account deletion request”. Deletion is in the app or by that email. There is no customer ordering website.

We delete or anonymise login, profile, vehicles / related preferences, cart, favourites, push tokens, and OTP records. Anonymised order/payment history may be kept under Retention. Deletion is permanent. Partner closure follows Partner processes.

15. Security and breaches

We use HTTPS/TLS in transit, token-based login, access controls, rate limiting on sensitive endpoints, and Razorpay for card data so we do not store full card numbers. Protect your phone and never share OTPs. You are responsible if you share an OTP.

No method of transmission or storage is completely secure. If a personal data breach is likely to cause harm, we will take the steps and give the notices that applicable law requires (including the DPDP Act where it applies). This Policy does not promise security beyond that.

16. Automated decisions and AI

We do not use generative AI to make legal or similarly significant decisions about you based on personal data. Partner kitchen voice alerts use text-to-speech for operational readouts. Offer eligibility may use fraud-prevention signals (for example device / push-token checks) to limit promo abuse — not credit scoring. Contact support if you believe an offer was wrongly blocked.

17. Children’s privacy

PackKardo is for users who can form a binding contract under Indian law (18+). We do not knowingly create accounts for children. If a child provided data, email admin@packkardo.com and we will delete it where the law requires.

18. Food and allergens (privacy context)

Menus and allergen statements are supplied by restaurants. Allergy notes you write are processed only to send them to the restaurant and to handle your request. You are responsible for what you write. PackKardo does not verify kitchen allergen practices and is not responsible for food quality, ingredients, or FSSAI compliance. Those matters are covered in the Terms of Service.

19. International users; CCPA / GDPR awareness

PackKardo is built for customers in India. Indian law and this Policy govern. Access, correction, deletion, and grievance channels remain available if you use the service from abroad. If we formally expand to the EEA/UK or California, we will publish supplemental disclosures first.

CCPA-style awareness: we do not sell personal information. Categories and purposes are listed above; use Section 13 channels for access or deletion.

20. Changes

We may update this Policy for product, legal, or processor changes. The effective date will change when we do. Material changes will be highlighted in-app where practicable. Continued use of the app after an update means you acknowledge the revised Policy. This does not waive any duty Indian law does not allow us to waive.

21. Contact

Grievance Officer: Shivam Rahar · admin@packkardo.com · +91 88376 72302

Registered office: Cabin No. 2, Business & Industrial Park, Eraya Co-Working Space, Plot No. 28, II, Chandigarh, 160002

GSTIN: 04DJFPR1441M1Z3

App: Profile → Privacy & account → Raise a grievance (we aim to respond within 7 days).

More: /privacy · /delete-account · /data-rights

Governing law: India. Courts in Chandigarh have jurisdiction, subject to mandatory consumer-protection venue rules.

22. What this Policy does not make us responsible for

PackKardo is a marketplace in the mobile app. This Policy explains personal data. It does not create any responsibility beyond what Indian law requires. Liability limits for the service are in the Terms of Service. Duties the DPDP Act does not let us waive still apply: reasonable security, breach notices where the law requires them, access, correction, erasure subject to legal retention, and grievance handling.

We are not responsible for food, allergens, hygiene, FSSAI compliance, preparation, delay, or handoff. The restaurant is an independent business. After we share order details so the restaurant can prepare and hand over that order, how the restaurant stores or uses the data — including calls, screenshots, or the restaurant’s own marketing — is the restaurant’s responsibility.

We are not responsible for Razorpay, MSG91, Expo, Firebase, Google, Apple, WhatsApp, maps, hosting, or media providers: their outages, errors, or security incidents. Card numbers, CVV, and UPI PINs stay with Razorpay. Payments are prepaid only. SMS is MSG91 only.

We do not guarantee that phone GPS or a parking pin is accurate. You are responsible for the phone number, name, vehicle number, parking note, and allergy or dietary text you submit, and for keeping OTPs private.