Privacy Policy

1. Who this Policy covers

This Policy applies to customers, website and app visitors, and support users. Restaurant partners’ personal data (onboarding, KYC, settlements, Partner tools) is also covered; commercial partner terms are in the Restaurant Partner Agreement.

This Policy does not replace our Terms of Service, Refund Policy, or Restaurant Partner Agreement for contract, liability, food safety, refunds, or pickup obligations.

For registered business name, CIN/LLPIN, or registered office address, email admin@packkardo.com with subject “Legal entity particulars”.

2. Personal data we collect

We process the categories below — the inventory of data our services actually use:

• Account: mobile number (OTP login), name, email, profile photo, referral codes, saved vehicle / parking-related details.
• Orders: restaurant, items, prices, fees, status, fulfilment mode (pickup / dine-in / car handoff), pickup OTP, special instructions (including allergen notes you write), vehicle number, parking spot / pin.
• Location: approximate or precise location when allowed for nearby restaurants; parking pin or one-time GPS for car handoff; optional live GPS share during an active order (about every 25 seconds) until you stop, handoff ends, or the share window expires (about 30 minutes). No continuous background tracking for marketing after handoff.
• Payments: method choice (UPI / card / wallet via Razorpay, or cash / pay at pickup where offered), status, and gateway references. We do not store full card numbers, CVV, or UPI PINs.
• Reviews & uploads: ratings, notes, tags; photos or documents you choose to upload.
• Device & security: device type, OS, app version, push tokens (Expo / FCM), IP address and user-agent on auth and sensitive requests, basic diagnostics.
• Support: chat messages, attachments, tickets, grievance submissions, marketing opt-out records.
• Partners: business/owner identity, licence documents, settlement details, menu/media, staff login phones as needed to run Partner accounts.
• We do not use biometrics for login, social login (Google/Apple/Facebook), or guest checkout for ordering.

3. How we collect data

• Directly from you (registration, orders, reviews, support, partner onboarding).
• Automatically (device signals, push tokens, IP/user-agent, location when permitted, cookies/local storage on websites).
• From providers (Razorpay payment confirmations; SMS delivery status; media URLs).
• From restaurants (acceptance, prep status, fulfilment, review responses).

4. Purposes and DPDP legal bases

We use personal data to: create and secure accounts (OTP/sessions); show restaurants and fulfil pickup, dine-in, and car orders; process payments, refunds, and fraud prevention; send order alerts (push, SMS, in-app); send optional marketing you can opt out of; provide support and grievances; improve reliability and safety; comply with law; and operate Partner KYC/settlements.

Where consent is required, you may withdraw it as described under Your rights. Transactional processing needed for an active order or account security may continue while you use those features. We do not sell personal data or use it for third-party cross-context advertising networks.

5. App permissions

We ask for permissions only when a feature needs them. You can deny them in device settings; some features may be limited.

• Location (when in use) — nearby restaurants, parking pin, optional live car-handoff share.
• Photos / media — profile, support attachments, partner media via system picker.
• Camera — partner onboarding / document capture when a partner uses the camera.
• Notifications — order and account alerts; optional promotional notifications.
• OTP/login SMS may still apply when you request a code, even if push is off.

6. Location and car handoff

Nearby discovery uses location only if you allow it. Car handoff uses parking details and/or GPS you provide for that order, shared with the fulfilling restaurant. Live share is optional, order-scoped, and time-limited.

Arrival timing, parking accuracy, and customer availability are governed by the Terms of Service and Refund Policy — not by this Privacy Policy.

7. Payments, refunds, and platform fees

Online payments are processed by Razorpay. Razorpay’s privacy practices apply to data it processes as a payment provider. Where cash / pay at pickup is offered, we store payment-status information for the order, not card credentials.

Refunds, cancellations, no-shows, and platform fees follow our Refund Policy (/refund-policy).

8. How we share information

We share data only as needed:

• Restaurants: order details, name/phone for fulfilment, vehicle/parking/live or pin location for car handoff, review content, limited support context for order issues.
• Service providers (processors): hosting (Vercel, Railway); PostgreSQL database; Redis (where configured); SMS (Twilio and/or MSG91); email (SMTP); WhatsApp chats you start with our published numbers; push (Expo, Firebase Cloud Messaging); payments (Razorpay); media (Cloudinary); API error monitoring (Sentry); Google Maps directions links. Providers act on our instructions.
• Legal & safety: when required by law or to investigate fraud, protect safety, enforce Terms, or defend claims.
• Business transfers: merger, acquisition, or asset sale under continuing confidentiality.
• We do not sell personal data or share it with third-party advertisers for their independent marketing.

9. Cross-border transfers

Some processors may process data outside India (for example cloud hosting, push, payments, media, or error monitoring). Transfers occur for the purposes in this Policy under contractual and organisational safeguards appropriate to the DPDP Act and our processor arrangements.

10. Cookies and similar technologies

packkardo.com and web app surfaces may use cookies, local storage, or similar technologies for essential session/security functions, preferences, and basic traffic measurement if enabled. We do not operate a third-party advertising cookie stack for cross-site ads at the time of this Policy. If we add non-essential analytics or advertising cookies, we will update this Policy and provide any required consent controls.

11. Marketing and communications

Transactional and security messages (OTP, order status, account security, refunds) are part of the service. Marketing / offers are optional. Promotional notifications may be sent if notifications are enabled unless you opt out — turn off promo notifications where available, or email admin@packkardo.com with subject “Marketing opt-out” and your registered phone number. Marketing consent is not required to place an order. We do not sell or rent your phone number to unrelated marketers.

12. Retention

We keep account data while your account is active. After deletion, we remove or anonymise personal account data. Anonymised order and payment records may be kept up to 8 years after order completion for tax, accounting, refunds, disputes, and fraud prevention, then deleted or further anonymised. Live location share ends after stop / handoff / share window. OTP codes are short-lived. Support tickets are kept as needed to resolve and meet legal duties.

13. Your rights

Subject to applicable law and identity verification, you may access, correct, or erase personal data; withdraw consent for consent-based processing (for example marketing or optional live location); export a JSON copy of your customer data; and raise a grievance.

• App: Profile → Privacy & account (download data, grievance, delete account).
• Web: /data-rights · /delete-account
• Email admin@packkardo.com with a clear subject and your registered +91 phone number.
• We aim to respond to privacy grievances within 7 days. You may escalate under applicable law, including to the Data Protection Board of India when available for your matter.

14. Account deletion

You can permanently delete your PackKardo customer account (not freeze only):

App: Profile → Privacy & account → Delete account.

Web: /delete-account — or email admin@packkardo.com with subject “Account deletion request”.

We delete or anonymise login, profile, vehicles / related preferences, cart, favourites, push tokens, and OTP records. Anonymised order/payment history may be kept under Retention. Deletion is permanent. Partner closure follows Partner processes.

15. Security and breaches

We use HTTPS/TLS in transit, token-based login, access controls, rate limiting on sensitive endpoints, and Razorpay for card data so we do not store full card numbers. Protect your phone and never share OTPs.

If a personal data breach is likely to cause harm, we will take remedial steps and provide notifications required under applicable law (including the DPDP Act as it applies).

16. Automated decisions and AI

We do not use generative AI to make legal or similarly significant decisions about you based on personal data. Partner kitchen voice alerts use text-to-speech for operational readouts. Offer eligibility may use fraud-prevention signals (for example device / push-token checks) to limit promo abuse — not credit scoring. Contact support if you believe an offer was wrongly blocked.

17. Children’s privacy

PackKardo is for users who can form a binding contract under Indian law (18+). We do not knowingly create accounts for children. If a child provided data, email admin@packkardo.com and we will delete it where required.

18. Food and allergens (privacy context)

Menus and allergen statements are supplied by restaurants. Allergy notes you write in special instructions or support are processed to send to the restaurant and handle your request. Food quality and FSSAI responsibility are covered in the Terms of Service.

19. International users; CCPA / GDPR awareness

PackKardo is built for customers in India. Indian law and this Policy govern. Access, correction, deletion, and grievance channels remain available if you use the service from abroad. If we formally expand to the EEA/UK or California, we will publish supplemental disclosures first.

CCPA-style awareness: we do not sell personal information. Categories and purposes are listed above; use Section 13 channels for access or deletion.

20. Changes

We may update this Policy for product, legal, or processor changes. The effective date will change when we do. Material changes will be highlighted in-app or at /privacy where practicable.

21. Contact

PackKardo Grievance Officer: admin@packkardo.com

App: Profile → Privacy & account → Raise a grievance (we aim to respond within 7 days).

More: /privacy · /delete-account · /data-rights

Governing law: India. Courts in Chandigarh have jurisdiction, subject to mandatory consumer-protection venue rules.