Privacy Policy

• Identity & contact: your name, mobile number, and email address.
• Delivery details: your saved addresses, including the map location/coordinates (latitude/longitude) you set, and details such as flat/house number, floor, building/society, street, area, pincode, and landmark.
• Order & preferences: your plan, diet (veg/non-veg), meal slot, add-ons, dietary notes, and subscription history (pause/skip/cancel activity).
• Payment information: payments are processed by our payment partner (Zoho Payments). We receive only a transaction reference, status, and amount — we do not collect or store your full card number, UPI PIN, CVV, or bank credentials.
• Technical & usage data: basic device/browser information, IP-level data used for security and reCAPTCHA verification during login, and a theme/session preference stored locally in your browser.

We use your information to: create and secure your account (phone-OTP verification); prepare and deliver your meals to the correct place and time; process payments and issue refunds; provide customer support and respond to enquiries; send service communications (delivery updates, pause/skip and payment confirmations, important policy or service changes); prevent fraud and abuse; comply with legal, tax, and accounting obligations; and improve our menu and service.

We process your data based on your consent (given when you sign up and subscribe), to perform our contract with you (delivering the meals you ordered), to comply with legal obligations, and for our legitimate interests in running and securing the service. You may withdraw consent at any time by contacting us (this may mean we can no longer provide the service).

We share data only with the service providers needed to run SpoonWell, and only to the extent required:

• Google Firebase — authentication and database hosting.
• Zoho Payments — secure payment processing.
• Delivery personnel — your name, address, and contact number, solely to deliver your order.
• Legal/regulatory authorities — where disclosure is required by law, court order, or to protect our rights and the safety of others.

We do not sell, rent, or trade your personal information. If our business is transferred, your data may pass to the new owner under the same protections.

All payments are handled on the secure, PCI-DSS-compliant infrastructure of our payment partner. Sensitive payment details are entered on the gateway, not on our servers, and transmitted over encrypted (HTTPS/TLS) connections. We never see or store your card or banking credentials.

We use minimal, essential storage only — to keep you signed in, remember your dark/light theme preference, and operate Google reCAPTCHA for login security. We do not use third-party advertising or cross-site tracking cookies. You can clear this data in your browser settings, though doing so may sign you out or reset preferences.

We keep your account and order data while your account is active. After you delete your account or become inactive, we retain only what is needed for legal, tax, accounting, and dispute-resolution purposes, for the period required by law, after which it is deleted or anonymised.

Your data is protected by access controls so that only you (when signed in) can read or change your own account information, by encrypted connections, and by the security measures of our infrastructure providers. No method of transmission or storage is completely secure; while we work to protect your data, we cannot guarantee absolute security.

You can view and update your name and addresses from your account dashboard at any time. You may also request to access, correct, or delete your personal data, or withdraw consent, by contacting us using the details below. We will verify your identity and respond within a reasonable time, subject to any legal retention requirements.

Our service is intended for users aged 15 and above; users under 18 should use it with the involvement of a parent or legal guardian. We do not knowingly collect personal data from children under 15. If you believe a child under 15 has provided us data, contact us and we will delete it.

Our site may link to third-party services (e.g. WhatsApp, maps, the payment gateway). Their privacy practices are governed by their own policies; we are not responsible for their content or handling of your data.

We may update this policy from time to time. Material changes will be posted here with a new "Last updated" date; please review it periodically.

For any privacy questions, data requests, or complaints, contact our Grievance Officer:

Ashmit Parandkar · ✉️ contact@spoonwell.in · 📞 +91 63096 99411 · Kokapet, Hyderabad, Telangana 500075.

We acknowledge requests within 48 hours and aim to resolve them within 30 days, as required under Indian law.