Skip to content

Policy

Privacy Policy

Version 2026-08-05 · effective 2026-08-05

Draft for review: this is business-configurable template content prepared for The Tiffin. It has not been reviewed by a lawyer. Review and adapt it before relying on it commercially.

This Privacy Policy explains how The Tiffin ("we", "us") collects, uses and protects your personal information when you use our website and tiffin delivery service in Jaipur, Rajasthan.

1. Information we collect

  • Account details: name, email address, mobile number and password (stored only as a secure hash).
  • Delivery details: addresses, map coordinates you confirm, landmarks and delivery instructions.
  • Order details: bookings, meal selections, pauses, payments and payment references you submit.
  • Communication records: support messages, assistant chats you start, and notification history.
  • Technical data: basic logs (IP address, browser type) kept for security and troubleshooting.

2. How we use it

  • To prepare and deliver your meals, including sharing your name, address and phone number with the assigned delivery rider.
  • To verify payments and maintain your booking, credit and invoice history.
  • To send service notifications (order confirmations, delivery updates) on the channels you opt into — WhatsApp and/or SMS.
  • To respond to support requests and improve the menu and service.

3. What we do not do

  • We do not sell your personal information.
  • We do not send marketing messages on channels you have not opted into.
  • We do not store card or UPI credentials — payment happens in your own UPI app.

4. Sharing

Your details are shared only with: (a) the delivery rider assigned to your order (name, address, phone, instructions); (b) service providers we use to send notifications you opted into; and (c) authorities when the law requires it.

5. Retention

Order, payment and invoice records are retained as required for accounting and tax. You may request deletion of your account; records we must keep by law are retained and the rest is removed or anonymised.

6. Your rights over your data

Under the Digital Personal Data Protection Act 2023 you have the following rights over the personal data we hold about you. Use the contacts in the Business details section below to exercise any of them.

  • Access: ask for a summary of the personal data we process about you and who we have shared it with.
  • Correction and completion: correct anything inaccurate, complete anything incomplete, and update your details. Your profile, addresses and notification preferences are editable from your dashboard at any time.
  • Erasure: ask us to delete your personal data. We must keep order, payment and invoice records for the periods tax and accounting law require; everything not legally required is deleted or anonymised.
  • Withdraw consent: withdraw consent for anything you opted into, as easily as you gave it. Withdrawing consent for optional messages does not stop essential service messages about an order you have placed, and it does not affect processing already carried out.
  • Nominate: nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
  • Grievance: raise a data-protection grievance with us first, using the Grievance Officer details below. If you are not satisfied with our response you may complain to the Data Protection Board of India.

6a. Consent and the legal basis for processing

We process your personal data to perform the service you have asked us for — preparing, scheduling and delivering your meals, taking payment and keeping the records the law requires of us. Optional processing, such as sending messages on a channel you selected, happens only with your consent, which you may withdraw at any time. We do not process the personal data of a child knowingly, and we do not use your data for behavioural advertising or tracking.

7. Delivery tracking and location data

  • Rider location: while a delivery rider has explicitly started a work shift in the rider app, the app reports the rider's position to us so we can coordinate deliveries and show customers when their order is near. Tracking stops when the shift or route ends, on logout, and is never active outside a shift. Riders see a persistent notification whenever tracking is active.
  • What customers see: you can see your assigned rider's approximate position only while your own order is out for delivery and close to you (within a small number of remaining stops), and never after it is delivered, failed or cancelled. You are shown the rider's first name only. Other customers' orders, addresses and route details are never visible to you.
  • Retention: the rider's live position is deleted as soon as their shift ends. Short-term location history used for operations is automatically deleted after a limited retention window (48 hours by default).
  • Customer location: we store the delivery coordinates you confirm for your addresses. The customer app does not track your device's location in the background.

8. Security

Passwords are hashed, access to admin systems is role-restricted and audited, and sensitive values are masked in logs. No internet service can promise absolute security, but we design for it.

9. Changes to this policy

If we change this policy materially we publish the new version with a new effective date and ask you to review it. The version you accepted is recorded against your account.

Business details

Our registered business details are being finalised and will be published here. In the meantime please contact us through the website and we will answer any question about who operates this service.

Customer care and grievance redressal

For anything about an order — a late delivery, a wrong meal, a refund:

  • Email: hello@thetiffin.cloud
  • In your account: raise a support case at Support, which we answer in writing.

Our Grievance Officer's name and contact details are being published and will appear here. Until then, escalate any unresolved complaint through Support and it will be handled by the business owner.

We acknowledge every complaint within 48 hours of receiving it and aim to resolve it within 30 days. Nothing on this page limits your rights under the Consumer Protection Act 2019, including your right to approach the appropriate Consumer Disputes Redressal Commission, or to use the National Consumer Helpline (1915).