Privacy Policy
This policy explains what personal data the OonDrop customer app and website collect, why, who we share it with and your rights. The data fiduciary is AIIBLUE TECHNOLOGIES PRIVATE LIMITED ("OonDrop", "we"). Registered office: No. 31A, Ground Floor, Dr. Seethapathy Nagar, 100 Feet Taramani Link Road, Chennai City Corporation, Chennai, Tamil Nadu 600042, India.
We process your personal data under the Digital Personal Data Protection Act, 2023 and its rules.
1. What we collect
- Account: your mobile number, name, and email and profile photo if you add them.
- Addresses and location: the delivery addresses you save, and your device location while the app is open (to show nearby restaurants, check delivery coverage and detect when you reach a restaurant for pickup). We do not track your location in the background.
- Orders: what you order, from whom, when, the amount, how you paid, delivery notes, drop-off photos for contactless delivery, ratings and reviews.
- Payments: payment status and references from Razorpay. We do not store your card number, UPI PIN or bank password.
- Wallet, Pass and referral: wallet balance and transactions, Pass purchases, referral codes and coupons.
- Support: messages and photos you send in the support chat or help requests.
- Calls: for masked calls we record who called whom, when, the outcome and how long. Calls are not recorded and the phone numbers are not stored with the call.
- Device: device type, app version, notification token, and app usage data.
2. Why we use it
- To create your account and sign you in with a one-time code.
- To take, deliver and support your orders, and to share the details needed with the restaurant and the delivery partner.
- To process payments and refunds.
- To run the wallet, OonDrop Pass, coupons and referrals.
- To answer support requests and prevent fraud and misuse.
- To send order updates, and offers if you allow them.
- To keep records that tax and other laws require.
- To improve the app using usage data.
3. Who we share it with
- The restaurant gets your name, order and delivery details. While masked calls are on, the restaurant and the delivery partner do not see your phone number; they call you through an OonDrop number.
- The delivery partner gets your name, delivery address, location pin and delivery notes for the delivery.
- Service providers that process data for us:
- Amazon Web Services, servers in the Mumbai region (India), for hosting and storage.
- Razorpay, for payments and refunds.
- Meta (WhatsApp Business), for sign-in codes and order messages.
- Plivo, for masked calls.
- Google (Google Maps), for maps, addresses and distances.
- Expo and Google Firebase, for app notifications, app updates and usage analytics.
- Our email provider, for emails you ask for.
- Authorities, when the law requires.
We do not sell your personal data.
4. How long we keep it
- Your account data is kept while your account is open.
- When you delete your account, it is removed after the grace period (currently 30 days; signing in again before then cancels the deletion). We remove your name, phone number, email, photo, saved addresses, favourites and notifications.
- Orders, invoices and payment records are kept without your name for the years tax law requires (currently set to 8 years).
- Drop-off photos are deleted a few days after delivery.
5. Your rights
Under the DPDP Act you have the right to:
- Access: get a summary of the personal data we hold about you and how we use it.
- Correction and completion: correct or update your data (you can edit most of it in the app).
- Erasure: delete your account and data, as described above.
- Withdraw consent: withdraw consent at any time; this does not affect processing already done, and we may not be able to serve you without the data needed for orders.
- Nominate: nominate a person to exercise your rights if you die or cannot act.
- Grievance redressal: complain to our Grievance Officer.
- Complain to the Data Protection Board of India if you are not satisfied with our answer.
To use these rights, use the support chat or write to our Grievance Officer (see the Grievance Redressal and Contact page). We acknowledge a request within 24 hours and answer it within 15 days (and within 90 days at the latest, as the DPDP Rules require).
6. Cookies and similar storage
The OonDrop website uses cookies and browser storage only to keep you signed in and remember your choices, such as accepting this notice. We do not use them for advertising or to track you on other websites. The apps store your sign-in securely on your phone.
7. Security
We protect your data with encryption in transit, access controls and limited staff access. Bank account details of partners are stored encrypted. No system is perfectly secure; we will tell you and the Data Protection Board about a breach as the law requires.
8. Children
OonDrop is not meant for children under 18 without a parent or guardian.
9. Changes
When we change this policy, the app shows the new version and asks you to agree before you continue.