Privacy Policy

1. What we collect

When you order, we collect very little:

• Phone number — if you share it at the kiosk, or enter it when you order online, we use it to send you order-status updates by SMS and to identify your order at the counter. At the kiosk you can order without one; it just means no SMS updates.
• Order information — what you ordered, when, at which outlet, and how it was paid.
• Payment confirmation — a confirmation and reference from our payment partner (Razorpay, or Cashfree Payments as a backup gateway) for online payments on this website or in the app, and for UPI payments made at the kiosk. Payment is handled entirely by the payment partner — we never see or store your UPI PIN, card number, CVV or banking credentials.
• Support messages — anything you send us by email or tell us by phone when raising a query, refund request or complaint.

Ordering on this website to eat here or take away needs only your name and mobile number; payment is taken by our payment partner as above. We may start offering delivery at any time. A deliveryorder also needs your mobile number confirmed with a one-time code, your delivery address and the location your browser shares when you tap “Use my location”. We use these to prepare and deliver the order and to let the rider reach you, and keep them with the account for that mobile number — the same account the Delphox Foods app signs into. This website does not use advertising trackers.

2. Why we use it

• To prepare, hand over and invoice your order.
• To send order-status updates by SMS to the number you shared.
• To process refunds and resolve payment issues with our payment partner.
• To handle support requests and complaints.
• To detect and prevent fraud and payment abuse.
• To meet legal obligations, including tax and food-safety record keeping.

We process this data to perform the purchase you make — at the outlet, on this website or in the app — and on the basis of the consent you give when sharing your phone number. We send offers and updates only to customers who have opted in (for example under Profile → App permissions in the app), and you can withdraw that consent at any time.

3. Who we share it with

We do not sell your personal data. We share it only as needed to run the service:

• Razorpay — our payment provider, to process UPI, card, net banking and wallet payments and refunds securely. Cashfree Payments is retained as a backup gateway and receives your payment details only when a payment is routed through it.
• SMS provider — to deliver order-status messages to the phone number you shared.
• Microsoft Clarity — to understand how visitors use this website (page views, taps, scrolling and anonymised session replays). What you type into forms is masked before it leaves your browser, and no payment page is recorded.
• Meta Platforms (WhatsApp Business Platform) — when you order or message us on WhatsApp, your messages pass through WhatsApp and are processed by Meta under its own terms (see section 9).
• Delivery partner — for delivery orders, the rider or courier receives your name, delivery address and phone number so they can bring you the order and reach you at the door. Our own riders can call your number only once they have reached you, and only for that delivery; every call is recorded in our audit log.
• Authorities — where we are legally required to disclose information.

Our systems are hosted on infrastructure we operate in India. Where a provider processes data outside India, we require appropriate safeguards.

4. How long we keep it

Order and tax records are retained for as long as tax and accounting law requires. Phone numbers collected for order updates are kept with the order record and are not used for any other purpose. Support conversations are kept while needed to resolve your issue and for a reasonable period afterwards.

5. Your rights

Under the Digital Personal Data Protection Act, 2023 you can:

• Access a summary of the personal data we hold about you and how it is processed.
• Correct or complete your details.
• Erase personal data we no longer need to keep — order and tax records we must keep by law are retained without being used for anything else. If you have an app account, you can delete it yourself from Profile → Account → Delete account; see Delete your account for what is removed and when.
• Withdraw consent — for example, ask us to stop sending order SMS. Withdrawing consent does not affect processing already carried out.
• Nominate someone to exercise these rights on your behalf in the event of your death or incapacity.
• Complain to us, and then to the Data Protection Board of India if you are not satisfied with our response.

To exercise any of these rights, contact us at [email protected] or +91 96299 72390.

6. How we protect your data

Payment credentials never touch our systems — they are handled by our payment partner. Traffic to our systems is encrypted in transit, and access to order data is restricted to staff who need it. No system is perfectly secure, but if a breach affects your personal data we will notify you and the Data Protection Board as the law requires.

7. Children

We do not knowingly collect personal data from children under 18, and we do not use children’s data for advertising or tracking. If you believe a child has given us personal data, contact us and we will delete it.

8. The mobile app

The Delphox Foods app adds an account to the above: your mobile number (verified by a one-time code — there is no password) and the name you give us, your order history, any delivery addresses you save, and, if you allow notifications, a device token used only to send you order updates. We use these to sign you in, take and deliver your orders and keep you informed about them. You can delete your account and this data yourself from Profile → Account → Delete account — see Delete your account for what is removed, what tax law requires us to keep, and how long it takes.

9. Ordering over WhatsApp

When you message our WhatsApp business number, your messages are carried by WhatsApp and processed by Meta Platforms under its own terms and privacy policy. From that conversation we receive your phone number, your WhatsApp profile name, the items you order, any location you choose to share for delivery, and the payment status from our payment gateway. We use these only to fulfil your order and send you updates about it. You can stop WhatsApp messages from us at any time by replying STOP. Message logs are retained with the order records they belong to, for the period in section 4.

10. Delivery partners (riders)

If you deliver for us through the rider app, we also hold your mobile number (verified by a one-time code — there is no password), your name and photo, your driving licence, vehicle registration and insurance, and your PAN. Your Aadhaar card is copied only if you give your consent when it is collected; otherwise it is checked in person and no copy is kept. While you are online or carrying an order, the app shares your location with us so we can offer you nearby orders and show the customer where their order is. We use this information only to verify you, assign and track deliveries and keep you and our customers safe, and we keep it for as long as you deliver for us and as long as the law requires afterwards. To see, correct or remove it, contact the team that onboarded you, or write to us using the details in section 12.

11. Changes to this policy

If we change how we handle personal data, we will publish the updated policy here with a new date.

12. Contact and grievances

For any privacy question or to exercise a right above, contact our Grievance Officer, Pugazhendi, at [email protected] or +91 96299 72390, or write to us at Site No. 45, 3rd Cross Rd, Govinda Reddy Layout, Silver Springs Layout, Munnekolala, Bengaluru, Karnataka 560037. We respond to privacy requests within the timelines set by the Digital Personal Data Protection Act, 2023.