Privacy Policy

This notice explains what personal data Chinthamath (registered entity name to be confirmed) collects when you use Chinthamath, why we collect it, how long we keep it, who we share it with, and how you can get it back or have it erased. It is given under the Digital Personal Data Protection Act, 2023, and it applies to the Chinthamath app and website.

1. What we collect

We collect only what the service needs to work. In full:

• Your mobile number, or your email address. Collected when you sign in. One of the two is your account identifier and is how you prove the account is yours, and we ask you for one of them rather than both. If you sign in with an email address, it is stored against your account, and the part before the @ is used to suggest a display name.
• Your name. Collected on the sign-in form when you sign in with a mobile number, so that a store, a rider or a support person can address you and identify your order. If you sign in with an email address we derive a starting name from it instead, and you can change it afterwards.
• Your delivery addresses. Collected when you save one or place an order, and passed to the store and the delivery partner so the order can reach you.
• Your orders, service requests and their history. What was ordered, from which store, for how much, where it went and what happened to it.
• Your reviews and support messages. Anything you write to a store, a professional or to us.
• Your device and its notification token. If you turn notifications on, we store a token issued by your browser or by the app so that an alert about your order can reach that device, along with the device label and app version.
• The place you choose on the map. When you set your location, choose a pickup or drop for a ride or a parcel, or pin a saved address, the app uses the point you chose. Finding your current position happens on your phone and only when you press “Use my location”; the app asks Android for that permission the first time and works without it if you search for a place or tap the map instead. The point you confirm is kept on your device so shops can show how far away they are, and a ride or parcel’s pickup and drop are sent to us with the request and stored on it so a rider can find you. We do not track your location in the background and we do not record the path of a device.
• Basic technical and security records. One-time codes we have sent and whether they were used, sessions on your devices and when each was last used, and records of sign-in attempts, so we can stop misuse of the service.

We do not collect your contacts, your photos, your location in the background, or your payment card details. We hold an email address only if you signed in with one, and we use it only to sign you in and to send you the one-time code. Payment for an order is made on delivery, directly to the delivery partner or the store; Chinthamath does not process or store card or bank details.

2. Why we collect it, and what we rely on

• To create and secure your account, and to sign you in. We use your mobile number or your email address, and a one-time code sent to whichever you gave us. Without one of them there is no account.
• To fulfil your orders and requests. Your name, address and order details are shared with the store, professional or delivery partner who performs the order, because they cannot deliver it otherwise.
• To send you messages about your orders. Order confirmations, status changes and alerts, to the app or as notifications.
• To support you and settle disputes. Order history and support messages are what a refund or a complaint is decided on.
• To keep the platform safe and lawful. Codes, sessions and sign-in records are used to detect and stop misuse, and to answer lawful requests from authorities.
• To improve the service. Aggregate, non-identifying counts of orders and usage, which do not identify you.

We rely on your consent for the collection described above, and we ask for it on the sign-in form, before any code is sent, whichever of the two you choose. Where we are required to keep a record by law - for tax, accounting or to answer a lawful request - we rely on that legal obligation.

3. Who we share it with

We do not sell your personal data, and we do not share it for anyone else’s advertising.

• The store, professional or delivery partner fulfilling your order - your name, address, phone number and the details of that order, and only what is needed to complete it.
• Our messaging providers - your mobile number is passed to Meta, which operates WhatsApp, and your email address is passed to our mail provider, so that your one-time code can be delivered to you. Each handles it under its own terms and privacy policy, and only for the purpose of delivering that message.
• Our push notification service - if you enable notifications, a token for your device is passed to the browser or platform push service (for example, Firebase Cloud Messaging), which delivers the alert. The alert content is encrypted so that only your device can read it.
• Authorities, where the law requires it. We will disclose data where we are legally obliged to, and we will tell you unless the law forbids us to.

4. How long we keep it

• Your account and profile are kept while your account is active. To have the account closed and your personal data removed, ask us to delete it - the steps, what goes and what stays, are all under 5. Deleting your account.
• Sessions end when you sign out, and otherwise expire after 100 days of not being used. Expired sessions are deleted automatically.
• One-time codes expire ten minutes after they are sent. The record that a code was sent and used is kept for a short period for security, and then deleted.
• Order, tax and accounting records are kept for as long as the law requires a business record to be kept, which is currently eight years.
• Notification tokens are removed when you turn notifications off, sign out of that device, or when the device stops accepting them.

5. Deleting your account

This section applies to the account you hold in Chinthamath, our Android app and this website. It is here so that you can ask for your account to be deleted without installing the app, and so that every step below can be read before you take it.

If you use the app - the app has no screen that deletes an account by itself, so open the account screen for your registered address and use the email route below. The app can be uninstalled at any time; uninstalling it does not delete the account, and the request below does not need the app installed at all.

How to ask - email manikantamaheshreddy36@gmail.com from the email address the account is registered with, with the subject “Delete my Chinthamath account”. Write from the registered address, because that is how we know the request is yours. You do not have to give a reason, and there is no charge.

What then happens, and when. We act on your request within 30 days. Closing the account makes it unusable: it can no longer be signed in to, and every device that was signed in has its session ended in the same step, which also stops its notifications. A closed account cannot be recovered or reopened, and signing in again with the same address creates a new, empty account rather than restoring the old one. Closing the account also removes your personal data from it - your name, your email address, your mobile number, the delivery addresses you saved, and your device notification tokens.

What we keep, and for how long. We keep the record of the orders you placed, because a business is required to keep its books. Those records are retained for eight years from the end of the year they belong to, and are deleted after that. Before they are kept, the personal details attached to them are removed as far as the law allows, so what remains is the transaction itself - what was ordered, when, for what amount, and through which store - rather than a profile you can be identified by. Where the law requires it, or where a dispute or a legal claim is still live, we may be obliged to keep a record longer; when it does not, we do not.

If you want anything that is not an order record removed as well, or you believe something of yours is still held after reading the above, write to manikantamaheshreddy36@gmail.com and we will look into it and answer you within 30 days.

6. Your rights

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• Access a summary of the personal data we hold about you and how it is being processed.
• Correct anything inaccurate. Your name can be changed in the app; for anything else, write to us.
• Erase your data, where we are not required by law to keep it.
• Withdraw your consent at any time, as easily as you gave it.
• Nominate another person to exercise these rights on your behalf if you die or become unable to act.
• Complain to us, and if you are not satisfied, to the Data Protection Board of India.

To exercise any of these, write to manikantamaheshreddy36@gmail.com from any address, quoting your registered mobile number. We will respond within 30 days. There is no charge.

7. Withdrawing consent

You can withdraw your consent at any time, and it is deliberately as easy as giving it. Sign out of this device from the account page to end that device’s session and delete its notification token; turn notifications off in the app to stop alerts; or write to us to have your account and its data erased.

Withdrawing consent does not affect anything done before you withdrew it. If you withdraw the consent that lets us hold your mobile number, we can no longer identify your account, and it will be closed.

8. How we protect it

• Sign-in is by a one-time code sent to your number. We never store that code; only a one-way hash of it, so a copy of our database does not contain a usable code for anyone.
• There is no password to be stolen, reused or leaked from another service.
• Codes expire in ten minutes, can be used once, and are refused after five wrong attempts.
• Access from your device is by a session token, which is what makes a session endable remotely and what expires when a device is not used.
• Data in transit is encrypted with HTTPS.

9. Children

Chinthamath is not intended for children under 18. We do not knowingly collect the personal data of a child, and we do not track, behaviourally monitor or target advertising at children. If you believe a child has given us their data, write to us and we will delete it.

10. Where your data is held

Your data is stored on servers located in India. Where a service provider we use processes data outside India, we do so only as the law permits, and we remain responsible for it.

11. Changes to this notice

If we change what we collect or why, we will update this page and change the date at the top, and we will ask for your consent again where the change needs it.

12. How to reach us

• Data protection queries: manikantamaheshreddy36@gmail.com
• Grievance Officer: Grievance Officer - name to be confirmed, manikantamaheshreddy36@gmail.com, or on WhatsApp at +91 93812 81956
• Post: Registered address to be confirmed, Tamil Nadu, India

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

See also our Terms & Conditions.