Privacy Policy

Last Updated:
Version: 1.1

Privacy Policy

Welcome to **RR Village Dosa** ("we", "us", "our"). We operate a food ordering platform including mobile applications and website services (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our Service in India under the **Digital Personal Data Protection Act, 2023 (DPDP Act)** and other applicable consumer protection rules.

1. Information We Collect

We only collect information directly necessary to provide our premium food ordering service.

1.1 Information You Provide

  • **Phone Number:** Collected during sign-up for OTP authentication and delivery communication.
  • **Name:** Collected for order identification and personalization.
  • **Delivery Address / Residency:** Apartment campus, block, flat number, landmark, and special gate instructions that you select or enter to fulfill deliveries. The mobile app does **not** continuously collect device GPS or background location.
  • **Order History:** Items ordered, transaction pricing, outlet location, and preference notes.

1.2 Information Collected Automatically

  • **Device Information:** Device model, operating system version, and unique push notification tokens (used via Expo Notifications / FCM for order tracking updates when you grant notification permission).
  • **Session Metadata:** Redis-backed authentication session keys and JWT tokens containing your user ID and role for secure requests.
  • **Crash & Diagnostics:** Diagnostic crash reports collected via Sentry to resolve operational system crashes. We scrub sensitive fields (tokens, OTP, payment identifiers) before transmission where configured.

1.3 Payment Metadata

All payments are processed securely by **Razorpay**. We do **not** store full credit card numbers, CVVs, or UPI PINs. We receive and store transaction references, payment status (success/failed), payment method (e.g., UPI, card), and payment timestamp for reconciliation and tax compliance.

2. Authentication & Third-Party Services

  • **OTP Authentication:** We use **MSG91** to verify phone numbers via secure OTP. Your phone number is shared with MSG91 for SMS dispatch.
  • **JWT Security:** Secured session cookies and localized storage are utilized to keep you logged in.
  • **Redis Sessions:** Temporary sessions are cached in Redis to manage real-time active logins.
  • **Razorpay:** Processes online payments. Payment card/UPI secrets remain with Razorpay.
  • **Sentry:** Receives scrubbed crash diagnostics for reliability.

3. Data Storage, Security, & Retention

  • **Data Fiduciary:** Your personal data is stored securely in India using encrypted database services hosted on **Supabase** (PostgreSQL) and server containers on **Render**.
  • **Security Controls:** We implement industry-grade TLS encryption for all data in transit, standard row-level security (RLS) policies on database tables, and strictly tokenized mobile secure stores.
  • **Retention Schedule:**
  • *Account Profile:* Retained while your account is active. Upon an approved deletion request, data is soft-deleted/anonymized within 30 days.
  • *Order Records & Financials:* Retained for **7 years** to satisfy Indian accounting, corporate tax, and GST compliance laws.
  • *Session Logs:* Retained for 90 days.

4. Children's Privacy

Our platform is not designed for children under 18 years of age. We do not knowingly collect personal information from minors.

5. User Rights & Account Deletion (Google Play Compliant)

Under the DPDP Act 2023, you have the right to access, correct, or request the deletion of your data.

5.1 Formal Account Deletion Pipeline

To delete your account:

1. **Mobile App:** Navigate to **Profile -> Delete Account** and type `DELETE` to confirm. Authenticated customers receive immediate anonymization when there are no active orders.

2. **Web App:** Go to the **Account Deletion** page at our website, log in to submit a deletion request, **or** email **support@rrvillagedosa.com** with subject "Account Deletion Request" if you cannot use the app.

3. **Process:** Profile PII (name, email, phone, addresses) is anonymized. Active sessions and push tokens are revoked. Order and payment records are retained as required for tax/compliance but disconnected from your identity.

6. Grievance Redressal & Contact Us

If you have any questions or wish to exercise your data rights, please contact our Grievance Officer:

  • **Grievance Officer:** Sathish Naik
  • **Email:** support@rrvillagedosa.com
  • **Address:** Ground Floor, Whitefield Main Road, near Hope Farm Junction, Whitefield, Bengaluru, Karnataka 560066