Privacy Policy

1. Data Fiduciary & Business Information

For the purposes of the DPDP Act, the Data Fiduciary responsible for your personal data is:

2. Personal Data We Collect

We adhere to the principle of data minimization and only collect personal data that is necessary for fulfilling your orders, securing your customer account, and maintaining our website. The categories of information we collect include:

• Contact & Account Identity: Your mobile/WhatsApp phone number (used as your primary account identifier and for OTP verification) and your name.
• Delivery & Location Information: For delivery orders: delivery address lines, city, state, postal code, delivery instructions (e.g. gate codes, building landmarks), and pinned map coordinates (latitude and longitude) that you explicitly select via our interactive map picker.
• Order & Fulfilment History: Items selected, quantities, product options (such as size, dietary variations), delivery or pickup branch preference, scheduled order dates, order notes, total amounts, and order status history.
• Payment Records: As we do not process credit/debit cards through an online payment gateway, we do not collect or store card numbers or banking credentials. Payment is completed in person (Cash on Delivery or direct UPI payment upon receipt/pickup). We record the payment status and order total associated with your order.
• Technical & Device Identifiers: Your Internet Protocol (IP) address, browser user-agent string, device label (e.g., “Chrome on Android” used to display your active login devices), session timestamps, and session tokens.
• Pseudonymous Analytics (Optional): If you consent to analytics, we record browsing events such as page visits, category views, product interactions, and search terms linked to a pseudonymous browser session identifier stored in your local storage.

3. WhatsApp OTP Verification & Account Authentication

We use a passwordless, phone-based authentication model. When you sign in or place an order:

• We send a short-lived 6-digit verification code directly to your WhatsApp account.
• The OTP is used strictly for technical verification of phone ownership and to issue your secure session. It is never used for unsolicited commercial marketing.
• We limit active sessions to a maximum of two (2) devices per customer account. When a third device logs in, older sessions are automatically revoked to safeguard your account against unauthorized access.

4. Specific Purposes of Processing

We process your personal data for specified, legitimate purposes, including:

5. Address & Delivery Location Data

Our website allows you to pinpoint your delivery address on an interactive map. This latitude and longitude data is provided by you voluntarily at the time of checkout.

We use this location coordinate solely to verify that your address falls within our Mumbai delivery radius and to calculate accurate distance-based delivery charges. We do not track your location in the background, nor do we perform continuous GPS tracking of your device.

6. Cookies & Similar Storage Technologies

We use cookies and browser storage technologies (such as localStorage) to provide a reliable shopping experience. We do not use third-party advertising tracking cookies.

7. Data Processors & Third-Party Service Providers

We do not sell, rent, or trade your personal data to data brokers or third-party marketers. We engage carefully selected data processors to host and support our application infrastructure under strict confidentiality and security requirements:

• Database & Backend Infrastructure: Supabase Inc., for secure encrypted cloud database storage, authentication token issuance, and automated backups.
• WhatsApp Messaging Infrastructure: WhatsApp Business API / Evolution API infrastructure deployed on secure cloud servers to deliver transactional OTPs, order confirmations, and customer service chats.
• Hosting & Edge Delivery: Vercel Inc., for serverless web hosting, SSL certificate management, and content delivery.
• Interactive Mapping: OpenStreetMap and Leaflet for delivery coordinate selection.

8. Data Retention

We retain personal data only for as long as reasonably necessary to fulfill the purposes for which it was collected, including satisfying legal, accounting, tax, or reporting requirements:

• Customer account profiles and saved delivery addresses are retained until you request account deletion or for the duration of your active relationship with us.
• Completed order records are retained in our operational database in accordance with applicable Indian tax and business recordkeeping obligations.
• Transient analytics events, application logs, and audit logs are subject to a scheduled retention cleanup period (configured to a default period of 30 days in our administrative settings).

9. Reasonable Security Safeguards

We implement appropriate technical and organizational measures to prevent unauthorized access, disclosure, alteration, or destruction of personal data:

• HTTPS / TLS encryption across all network communications.
• HttpOnly, Secure, and SameSite cookie attributes protecting session tokens against XSS.
• Cryptographic SHA-256 token hashing with server-side secret salts.
• Enforcement of a maximum 2 active device sessions per customer account.
• Row-Level Security (RLS) policies isolating customer data at the database layer.

10. Your Rights as a Data Principal (DPDP Act, 2023)

Under the Digital Personal Data Protection Act, 2023, you have specific rights regarding your personal data:

• Right to Access Information: You have the right to obtain a summary of personal data being processed by us and the processing activities undertaken.
• Right to Correction & Updating: You have the right to request correction of inaccurate or misleading personal data, completion of incomplete data, and updating of your details.
• Right to Erasure: You have the right to request erasure of your personal data, subject to retention required by applicable statutory or tax laws.
• Right of Grievance Redressal: You have the right to readily available grievance redressal mechanisms regarding our data processing practices.
• Right to Nominate: You have the right to nominate another individual who shall exercise your rights in the event of your death or incapacity.
• Right to Withdraw Consent: Where processing is based on consent (such as optional analytics), you may withdraw your consent at any time using our preference controls.

To exercise any of these rights, please contact our team at info@anilashahsnacks.com with the subject line “DPDP Data Request”.

11. Protection of Children's Personal Data

Our storefront provides delicious snacks and sweets suitable for enjoyment by the entire family. However, we do not knowingly market directly to children, nor do we conduct behavioral monitoring or profiling of minors.

Customers placing orders or registering customer accounts must do so with the consent and supervision of a parent or legal guardian. We do not collect date of birth or age verification documentation from visitors, respecting privacy and minimizing unnecessary data collection.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business operations, legal requirements, or regulatory rules under the DPDP Act. When updates are made, we will revise the “Last updated” date at the top of this page. We encourage you to review this policy periodically.

13. Grievance Officer & Contact Details

In accordance with the DPDP Act and the Information Technology rules, if you have any questions, concerns, or grievances regarding our privacy practices or handling of your personal data, you may reach out to: