Privacy policy
This policy explains how Kalam Enterprises ("EatzyGo", "we", "us"), with its registered office at Shop No. 1, Jameel Manzil, Near Tanwar Complex, Kausa, Mumbra 400612, Maharashtra, India, collects, uses, shares and protects your personal data when you use our food ordering and delivery service in India. We publish it under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, and the rules made under them.
By creating an account or using our apps you agree to the practices described here. If you do not agree, please do not use the service.
1. Who this policy covers
- Customers: people who order food through the EatzyGo app.
- Delivery partners (riders): people who deliver orders using the EatzyGo Rider app.
- Store partners: restaurants and shops, and their staff, who receive and prepare orders using the EatzyGo Store app.
Section 2 lists what each app collects. Sections 3 to 12 apply to everyone.
2. What each app collects
2.1 EatzyGo customer app
- Account details: your name, email address, mobile phone number and a password. Passwords are stored in hashed form by our authentication provider (Supabase Auth). EatzyGo staff cannot see your password. Where we offer sign-in with Google or Apple, we receive only your name and email address from that provider.
- Delivery addresses: the addresses you save or type, their labels (for example "Home"), any delivery instructions, and the map coordinates of each address.
- Location: with your permission, your device's precise or approximate location while you are using the app. We use it to work out your delivery address, show restaurants that deliver to you, and show your order on a map while it is on the way. The app does not collect location in the background and does not run a background service. The app needs location permission to show restaurants near you; you can turn the permission off at any time in your device settings.
- Orders: the items you order, special instructions, order value, payment method chosen, order status and history, restaurants you mark as favourites, and your notification preferences.
- Payments: online payments are handled by Razorpay. You enter your card, UPI, net banking or wallet details in Razorpay's own checkout screen. EatzyGo never receives or stores those details. We store the payment status and the Razorpay payment and order identifiers with your order. For cash on delivery we record the amount due and paid.
- Messages: text messages you exchange with your delivery partner in the in-app chat during an order, stored with that order, and the support tickets you raise and the replies you receive.
- Ratings and reviews: the rating and review text you leave for an order. Reviews may be shown to other customers of that restaurant.
- Push notification token: a device token issued through Firebase Cloud Messaging and Expo's push service so we can send order updates and, if you opt in, offers.
- Crash reports: the app includes a crash-reporting tool (Sentry). When it is switched on and the app crashes, it sends us the error trace, the device model and operating system version, the app version and a random identifier for the installation.
The customer app does not use the camera, your photos, the microphone or an advertising identifier, and it shows no third-party advertising.
2.2 EatzyGo Rider app
- Account details: your name, email address, mobile phone number and a password (hashed by Supabase Auth, as above). EatzyGo creates rider accounts during onboarding.
- Documents and vehicle details: your driving licence number and expiry date, your vehicle type and registration number, a photo of your driving licence and a photo of your vehicle's number plate, and your weekly work schedule. You choose the photos from your phone's gallery; the app does not use the camera. Photos are stored in our file storage (Supabase Storage).
- Location: your precise location while you are online (on shift), including while the app is in the background or your screen is locked. On Android this runs as a foreground service with a persistent notification, so you can always see that tracking is on. We use your location to offer you nearby orders, to navigate to the pickup and drop-off points, and to let the customer and the store follow the delivery. Tracking stops when you go offline. We store your most recent reported position only; we do not keep a history of your movements.
- Bank details: bank name, account holder name, account number and IFSC code, so we can pay out your earnings. We also keep your earnings, wallet balance and withdrawal requests.
- Messages: text messages you exchange with the customer in the in-app chat during an order, stored with that order.
- Push notification token: a device token issued through Firebase Cloud Messaging and Expo's push service, so we can alert you to new orders.
- Crash reports: as for the customer app, through Sentry, once it is switched on.
The Rider app plays an alert sound for new orders but does not record audio and does not use the camera.
2.3 EatzyGo Store app
- Account and business details: the store's name, the contact person's name, email address and phone number, a password (hashed by Supabase Auth, as above), the store's address and opening hours, and the business registration details EatzyGo asks for when it onboards you. EatzyGo creates store accounts and enters the store's address during onboarding; the app itself does not collect location.
- Orders: the orders you receive, including the customer's name, phone number, delivery address, items, instructions and payment method, and your acceptance, preparation time or decline reason.
- Menu: the categories, items, descriptions, prices and image links you enter.
- Bank details: bank name, account holder name, account number and IFSC code, so we can pay out your earnings. We also keep your earnings, wallet balance, transaction history and withdrawal requests.
- Messages: text messages you exchange with the customer in the in-app chat during an order, stored with that order. Your store's display name is sent with each message.
- Bluetooth: used only to connect to a paired thermal receipt printer and send it the order ticket. The ticket contains the customer's name, phone number, address, items and payment details, and it travels over Bluetooth to your printer only. We do not derive your location from Bluetooth. If your Android version bundles a location permission with Bluetooth access, the app still does not read or store your location.
- Push notification token: a device token issued through Firebase Cloud Messaging so we can alert you to new and cancelled orders. The app also plays a sound when a new order arrives.
The Store app does not use the camera, your photos, the microphone or your location, and it contains no crash-reporting or analytics tool.
2.4 Device permissions each app asks for
You can refuse any permission and revoke it later in your device settings. Where a permission powers a core feature, only that feature stops working.
| App | Permission | Why we ask | Required? |
|---|---|---|---|
| Customer (EatzyGo) |
Location (precise and approximate), while the app is in use | Find your delivery address, show restaurants that deliver to you, and show your order on a map while it is on the way. Not collected in the background. | Needed to see restaurants near you |
| Customer | Notifications | Order confirmation, preparation and delivery updates, and offers if you opt in. | Optional |
| Rider (EatzyGo Rider) |
Location (precise and approximate), including in the background ("Allow all the time") | Offer you nearby orders, navigate, and let the customer and store follow the delivery while you are online. On Android a persistent notification shows while tracking runs. Stops when you go offline. | Required to go online and accept deliveries |
| Rider | Photos and media (read) | Choose your driving licence photo and vehicle number-plate photo from your gallery. We receive only the images you pick. | Required for document verification |
| Rider | Notifications | Alert you to new orders and delivery updates. | Required to receive orders |
| Store (EatzyGo Store) |
Bluetooth (connect and scan for nearby devices) | Find and connect to your paired receipt printer and print order tickets. Used for nothing else; no location is derived from it. | Optional, only if you print receipts |
| Store | Notifications | Alert your staff to new and cancelled orders. | Required to receive orders |
What our apps do not do: none of the EatzyGo apps records audio or video, reads or sends your SMS messages, reads your contacts, call logs or calendar, uses an advertising identifier, shows third-party advertising, or collects biometric or health data.
3. How we use your information
- Running the service: creating and managing accounts, showing nearby restaurants, receiving and fulfilling orders, assigning delivery partners, and live order tracking.
- Payments: processing online payments through Razorpay, reconciling cash on delivery, issuing refunds, and paying out partner earnings.
- Communication: order status notifications, in-order chat between customers, riders and stores, service messages, and replies to support requests.
- Verification and safety: checking delivery partner documents, preventing fraud and misuse, and keeping the platform safe.
- Fixing problems: diagnosing crashes and errors from crash reports, once crash reporting is switched on.
- Offers, with your consent: promotional notifications in the customer app. You can turn them off in the app's notification settings. Messages about your active orders are still sent.
- Legal compliance: meeting our obligations under Indian tax, accounting and food-safety law, and responding to lawful requests from authorities.
4. Who we share your information with
We do not sell personal data. We share it only as needed to run the service:
| Recipient | What is shared | Why |
|---|---|---|
| Store partners | The customer's name, phone number, delivery address, items, instructions, payment method, and the chat messages for that order. | To prepare and hand over the order. |
| Delivery partners | The customer's name, delivery address, phone number, order items, and the chat messages for that order, for the duration of the assigned delivery. | To deliver the order and reach the customer if needed. |
| Customers | The delivery partner's name, their live position while delivering the order, and the chat messages for that order. | So the customer can follow the delivery. |
| Razorpay (payment gateway) | Payment amount, order reference, and the customer's name, email address and phone number to pre-fill checkout. Card and UPI details are entered directly with Razorpay and never reach EatzyGo. | To process online payments and refunds. See Razorpay's privacy policy. |
| Google Maps Platform (Maps SDK, Places API, Geocoding, Routes API) | Location coordinates, address text you type, and pickup and drop-off coordinates. Google's map component also receives device and app information and the area of the map shown. | Maps, address search, turning coordinates into addresses, routes and delivery time estimates. |
| Supabase (authentication, database and file storage) | Account identifiers, email address, hashed password, and the application data described in section 2, including rider document photos. | To sign you in and store our data on our behalf. |
| Fly.io (application hosting) | All data the apps send to our servers, in transit and in processing. | To host our backend. |
| Firebase Cloud Messaging (Google) and Expo push service | Device push tokens and basic device information. | To deliver push notifications. |
| Sentry (customer and Rider apps, once switched on) | Crash traces, device model, operating system and app version, and an installation identifier. | To diagnose crashes. |
| Government and law enforcement | Data required by a valid legal demand. | Compliance with applicable law. |
If EatzyGo is involved in a merger, acquisition or sale of assets, your data may pass to the successor, who will remain bound by this policy or one at least as protective.
Where your data is processed. We operate for users in India. Some of the providers above (Supabase, Fly.io, Google, Expo and Sentry) run data centres in several countries and may store or process your data outside India. We transfer personal data outside India only as permitted under the DPDP Act, 2023 and any restrictions notified by the Central Government, and we require each provider by contract to protect it to the standard described here.
5. How long we keep your data
- Account data (profile, saved addresses, preferences, bank details) is kept while your account is active and deleted or anonymised within 30 days of a deletion request.
- Order, payment and payout records, including invoices, are kept for the period Indian tax and accounting law requires, which can be up to 8 years, and then deleted. After account deletion these records are no longer linked to you.
- Chat messages and reviews are stored with the order and treated in the same way as order records: anonymised on account deletion.
- Rider position: we keep only your most recent reported position, which is replaced by the next one.
- Rider documents are kept for the duration of the partnership plus any period required by law.
- Support conversations are kept as long as needed to resolve your issue and for a reasonable period afterwards for quality and dispute purposes.
- Backups: copies may remain in encrypted backups for a limited time after deletion and are removed when those backups are rotated.
For exactly what is deleted, what is retained and how long deletion takes, see the account and data deletion page.
6. How we protect your data
We use safeguards appropriate to the data we hold: encryption in transit (HTTPS/TLS), access controls limiting which EatzyGo staff can view personal data, and contracts requiring our providers to protect it. Passwords are hashed by Supabase Auth and are never visible to us. The apps keep a sign-in token on your device so you stay signed in; signing out removes it. No system is perfectly secure. If a data breach affects you, we will notify you and the Data Protection Board of India as the DPDP Act requires.
7. Your rights under the DPDP Act, 2023
As a Data Principal you have the right to:
- Access: a summary of the personal data we hold about you, what we do with it, and who we share it with.
- Correction: have inaccurate or incomplete data corrected. You can edit most profile details in the app.
- Erasure: have your personal data deleted. The account and data deletion page explains how and what is retained.
- Withdraw consent: withdraw any consent you have given (for example location or offers) at any time, with effect for future processing.
- Grievance redressal: complain to our grievance officer (section 9) and receive a response within the time the law prescribes.
- Nominate: name another person to exercise your rights if you die or become incapacitated.
To exercise any of these rights, email contact@eatzygo.in from the email address registered to your account. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.
8. Children
EatzyGo is for people aged 18 or over. If you are under 18 you may use the service only with the verifiable consent and supervision of a parent or lawful guardian, as the DPDP Act requires. We do not knowingly collect personal data from children without that consent, and we do not track children or show them targeted advertising. If you believe a child has given us personal data without consent, contact us and we will delete it.
9. Grievance officer
Grievance officer: Umair Shaikh
Email: contact@eatzygo.in
Address: Kalam Enterprises, Shop No. 1, Jameel Manzil, Near Tanwar Complex, Kausa, Mumbra 400612, Maharashtra, India
We acknowledge complaints within 48 hours and resolve them within one month of receipt, as the Consumer Protection (E-Commerce) Rules, 2020 require.
10. Cookies, analytics and advertising identifiers
Our apps do not use cookies. These policy pages are static and set no cookies. Our apps do not use advertising identifiers, contain no advertising network, and do not share data with data brokers or credit-scoring agencies. The only diagnostic tool in the apps is the crash reporter described in section 2, and it is switched off until we enable it.
11. Changes to this policy
We may update this policy. When we make a material change we will tell you through the app or by other reasonable means and update the effective date at the top of this page. If you keep using the service after a change takes effect, the updated policy applies.
12. Contact us
- Email: contact@eatzygo.in
- Grievance officer: Umair Shaikh, contact@eatzygo.in
- Post: Kalam Enterprises, Shop No. 1, Jameel Manzil, Near Tanwar Complex, Kausa, Mumbra 400612, Maharashtra, India