Privacy policy

Privacy Policy — Paustik Poornaahar

Effective date: 16 October 2026

Paustik Poornaahar ("we", "us", "our") operates a food ordering and delivery platform consisting of a mobile application, a website and related services (the "Service"). This policy explains what personal data we collect, why we collect it, who we share it with and the rights you have. It applies to customers, guest users, kitchen partners and visitors of our app and website. We process personal data as a Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025.

1. Data we collect

  • Account data: name, email address, phone number, password (stored only as an encrypted hash) and profile photo if you add one.
  • Order data: items ordered, order value, delivery address and its geocoordinates, chosen payment method, order status and ratings/reviews you submit.
  • Location data: approximate location to show nearby restaurants, and precise background location only while a delivery is in progress and only if you grant permission.
  • Device and usage data: device model, operating system, app version, language, IP address and in-app events used to keep the service secure and improve it.
  • Communications: messages you send to support, and chats between you, restaurants and delivery partners related to an order.

Kitchen partner data: owner name, phone, email, kitchen address and location, identity and business documents (Aadhaar, PAN, Shop Act licence, FSSAI licence, electricity bill, Udyam certificate), bank details (bank name, account holder, account number, IFSC, cancelled cheque) and login details.

2. How we use your data

  • To create and manage your account and authenticate you (including OTP verification by phone).
  • To place, process, deliver and track your orders, and to handle refunds and customer support.
  • To send service messages (order status, OTP, delivery updates) and — only with your consent — offers and promotions, which you can withdraw at any time.
  • To personalise restaurant and food recommendations, and to measure and improve the performance and security of the Service.
  • To comply with legal obligations such as tax, accounting and consumer-protection requirements.

Kitchen partners: identity and business documents are used only to verify the kitchen and comply with food-safety (FSSAI), shop-establishment and tax law; bank details are used only to pay you. These documents are visible only to our verification team, are not shown to customers, and are stored with restricted access (bank account numbers are encrypted).

Consent: we ask for your consent when you sign up or register a kitchen. Marketing messages are a separate, optional choice. You can withdraw consent at any time as easily as you gave it (Profile → Settings, or by writing to us); withdrawal does not affect processing already done, and some services may stop working without the data they need.

3. Third-party services we use

  • Firebase (Google): push notifications, phone-number authentication and basic analytics.
  • Google Maps: maps, geocoding and route display for delivery addresses.
  • SMS gateway providers: delivery of OTP codes.
  • Payment service providers: card, wallet and online payment processing. Card details are handled by the payment provider and are not stored on our servers.
  • Hosting and infrastructure providers: to run the Service.

These providers process data on our behalf under their own privacy terms. We do not sell your personal data.

4. Data sharing

To fulfil an order, we share the necessary details with the restaurant or kitchen preparing your food (your order and, where delivery requires it, your name, address and phone number) and with the delivery partner assigned to your order (name, address, phone number and live location needed for pickup and delivery). We may also disclose data to authorities where legally required.

5. Permissions

The app requests the following permissions only when a feature needs them: location (find nearby kitchens and track delivery), notifications (order updates), camera (profile photo and scanning) and storage (attachments and media). You can revoke permissions in your device settings at any time.

6. Retention

We keep your account data for as long as your account is active. Order and transaction records are retained as required by tax and accounting law. Support conversations are kept for up to 24 months. Kitchen partner documents are kept while you are a partner and afterwards only as long as the law requires. Traffic and processing logs are kept for at least one year as required by the DPDP Rules. Backups are rotated on a rolling basis. When data is no longer needed we erase it; if we plan to erase your data because your account has been inactive, we will tell you at least 48 hours before.

7. Your rights (DPDP Act, sections 11–14) and account deletion

You have the right to: get a summary of the personal data we hold about you and who we have shared it with; correct, complete or update it; have it erased; withdraw consent; have your grievances addressed; and nominate another person to exercise these rights if you die or become unable to. You may also opt out of targeted advertising or delete your account at any time. You can delete your account in the app (Profile → Settings → Delete Account) or on our website at paushtikpoornaahar.com/delete-account. After deletion your profile, saved addresses, wishlist, cart, searches and notifications are erased, and the name, phone and address on your past orders are anonymised; order, payment and tax records are kept only as long as the law requires. Requests made on the website are verified and completed within 90 days. See also our Privacy Choices page.

8. Children

Under the DPDP Act a child is anyone under 18. You must be 18 or older to create an account. We do not knowingly collect personal data of children, do not track or target advertising at them, and if we learn that a child has provided data without verifiable consent from a parent or lawful guardian, we will delete it. Parents can contact our Grievance Officer below.

9. Security

We use encrypted connections (HTTPS/TLS), hashed passwords, access controls and monitoring to protect your data. Identity documents are not publicly accessible and are served only through short-lived authorised links. No method of transmission or storage is completely secure, but we work continuously to safeguard it.

10. Data breaches

If a personal data breach affects you, we will inform you without delay — what happened, the likely impact, what we are doing about it and what you can do — and we will report it to the Data Protection Board of India as required by law.

11. Grievance Officer, complaints and changes

Grievance Officer / contact for data questions: Grievance Officer, Paustik Poornaahar, Pune, Maharashtra, India — support@paushtikpoornaahar.com. We acknowledge requests promptly and resolve them within 90 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

We may update this policy; material changes will be announced in the app. Questions or requests: support@paushtikpoornaahar.com or write to us at our registered address published on the contact page.

सारांश (मराठी)

पौष्टिक पूर्णाहार तुमचे नाव, संपर्क, पत्ता, ऑर्डर व स्थान माहिती फक्त ऑर्डर देणे, पोहोचवणे, पेमेंट व कायदेशीर गरजांसाठी वापरते. किचन भागीदारांची ओळखपत्रे (आधार, पॅन, शॉप ॲक्ट, FSSAI इ.) व बँक तपशील फक्त पडताळणी व पेमेंटसाठी वापरले जातात आणि ग्राहकांना दाखवले जात नाहीत. जाहिरात संदेश फक्त तुमच्या संमतीनेच पाठवले जातात. डिजिटल वैयक्तिक डेटा संरक्षण कायदा, 2023 अंतर्गत तुम्हाला तुमची माहिती पाहणे, दुरुस्त करणे, हटवणे, संमती मागे घेणे, नामनिर्देशन करणे व तक्रार करण्याचा हक्क आहे. 18 वर्षांखालील व्यक्तींनी खाते तयार करू नये. संपर्क: तक्रार निवारण अधिकारी — support@paushtikpoornaahar.com. समाधान न झाल्यास तुम्ही भारतीय डेटा संरक्षण मंडळाकडे तक्रार करू शकता.