Privacy Policy

1. Information We Collect

When you use TruBites, we may collect the following information:

• Account info: Name, phone number, email address
• Delivery info: Delivery addresses you provide, optional landmark and delivery instructions
• Payment info: Transaction details processed via Razorpay (we never store card / UPI / netbanking credentials)
• Usage data: Pages visited, features used, device and browser information
• Dietary preferences: Your selected meal preference (Regular or Swaminarayan)
• Communication preferences: Granular consent for transactional vs promotional WhatsApp

2. Purpose & Legal Basis

We collect each category for a specific purpose and rely on the lawful basis indicated:

• Process and deliver your subscription - basis: contract
• Process payments through Razorpay - basis: contract
• Order / delivery / receipt WhatsApp - basis: contract
• Promotional WhatsApp & email - basis: consent (opt-in only)
• Service improvement, fraud prevention - basis: legitimate use
• Tax & statutory compliance - basis: legal obligation (Income Tax Act, GST law)

3. Data Sharing

We do not sell your personal information. We share data only with the following data processors, under contract, for the limited purposes listed:

• Razorpay (India): Payment processing - name, phone, email, amount
• Delivery partners: Name, delivery address (phone is masked to last 4 digits)
• Firebase / Google Cloud (US/EU regions): Authentication, database, file storage
• WhatsApp Business API providers (India): Sending opted-in notifications
• Ola Maps (India): Address autocomplete and geocoding

4. Data Retention

We retain your personal data for the minimum period each purpose requires:

• Account profile: While your account is active. After deletion: anonymised within 30 days.
• Orders, payments, tax invoices: 7 years (Income Tax Act & GST records retention).
• Notification logs: 12 months.
• Backups: Encrypted backups are retained for 90 days after deletion.

5. Your Rights as a Data Principal

Under the DPDP Act 2023 you have the following rights:

• Right to information - what we collect and why (this policy).
• Right to correction & erasure - update your profile from the Profile page, or delete your account from Profile → Delete Account.
• Right to grievance redressal - write to our Grievance Officer (above).
• Right to nominate - write to the Grievance Officer to designate a representative.
• Right to withdraw consent - toggle promotional WhatsApp off from Profile at any time.

If your grievance is not resolved within 7 working days, you may appeal to the Data Protection Board of India.

6. Data Security

We use industry-standard security measures including Firebase Authentication, encrypted data transmission (HTTPS / TLS 1.2+), encrypted storage at rest, and PCI-DSS-compliant payment processing via Razorpay.

7. Cookies & Local Storage

We use cookies and local storage for authentication sessions, remembering your preferences, and attribution tracking (e.g., referral and partner codes - 30-day expiry). You can clear these through your browser settings without losing your account.

8. Children

TruBites is intended for adults. We do not knowingly collect data from children under 18. If you believe a minor has signed up, contact our Grievance Officer to have the account removed.

9. Changes to This Policy

We may update this policy from time to time. We will notify active subscribers of significant changes via the app, email, or WhatsApp (transactional channel - separate from your marketing consent).

10. Business Contact

TruBites Foods
Ahmedabad, Gujarat 380015, India
Email: support@trubites.in