Privacy Policy

1. Who we are

Greenzaa is a grocery delivery service operated by Vaibhav Patni, registered at 00 Amali Faliya, Gokul, Nagarwada, Vadodara, Gujarat 390001, India (“Greenzaa”, “we”, “us”). For the purposes of India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), we are the Data Fiduciary for the personal data described here.

This policy covers the Greenzaa customer app (Android and iOS) and this website. It does not cover third-party sites or apps we link to. It is published in line with the DPDP Act, the Information Technology Act, 2000 and the rules made under it, including the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

2. What we collect

Information you give us

• Phone number — used to sign you in with a one-time password (OTP). We don’t use passwords.
• Name — so riders and support know who they’re helping.
• Delivery addresses — the address text, any landmark or instructions you add, and the map pin (latitude and longitude) you place for each saved address.
• Messages to support — anything you send us by email, phone or in the app, including any photos you choose to send when reporting a quality issue.
• Launch sign-ups — if you email us to be notified when Greenzaa launches, your email address and anything you include in the message (such as your locality).

Information created when you use Greenzaa

• Orders — items, prices, delivery address, order status, cancellations, refunds and invoices.
• Wallet coins — your coin balance and the history of coins earned, used and refunded.
• Cart and preferences — items in your cart and settings you save in the app.
• Payment information — the payment method you choose (online payment, cash on delivery or wallet coins) and the payment status. Online payments will be processed by our payment gateway once it is live: you enter your card, UPI or bank details with the gateway, and we receive only a transaction reference and status, never your full card number, CVV or UPI PIN.

Information from your device

• Location (only with your permission) — if you allow it, the app reads your device’s current location while you’re using it, to suggest a map pin and check whether you’re in a delivery zone. The app asks only for “while using the app” access; we do not track your location in the background. You can deny or revoke this in your phone’s settings and place the pin by hand instead.
• Push notification token — a device identifier issued by Firebase Cloud Messaging so we can send order updates and Greenzaa offers or announcements. When you sign in, we register this token, your platform and app version against your account. You can turn notifications off in your phone’s settings.
• Basic device and technical information — such as device model, operating system and app version, and server logs (IP address, timestamps, errors) generated when the app talks to our servers.
• Crash reports — Firebase Crashlytics collects crash and error reports, installation identifiers, device and app information, and diagnostic metadata in release builds. We attach your internal Greenzaa customer ID when you are signed in, so these reports can be linked to your account. We do not deliberately include your name, phone number or delivery address in crash reports.
• Storefront interactions — the app sends views and taps on storefront banners to Greenzaa so we can measure which promotions and features are used. Signed-in requests can be associated with your account. This is first-party measurement, not cross-app advertising tracking.

The app does not access your contacts, photo library, camera, microphone or SMS inbox.

3. Why we use it

We use personal data only for these purposes:

• Creating and securing your account, and signing you in by OTP.
• Taking, packing, delivering and tracking your orders, and contacting you about them.
• Checking whether your address is inside a delivery zone and estimating delivery times.
• Collecting payment (online payments through our payment gateway once it is live, and cash on delivery for eligible customers) and issuing refunds.
• Running the wallet: crediting, debiting and refunding coins.
• Sending order-status push notifications and service messages.
• Sending Greenzaa offers and announcements through push notifications, which you can disable.
• Measuring storefront banner views and taps to understand feature and promotion effectiveness.
• Handling support requests, complaints and grievances.
• Telling you when Greenzaa launches in your area, if you asked us to.
• Preventing fraud and abuse, keeping our systems secure, and fixing bugs.
• Keeping invoices and accounting records, and meeting other legal obligations.

Legal basis. We process your data with your consent, which you give when you sign up and use the app, and for legitimate uses the DPDP Act allows, such as complying with law (for example, tax records). You can withdraw consent at any time (see Your rights); doing so may mean we can no longer deliver to you.

We do not sell your personal data or link it with other companies’ data for targeted advertising. We do not use it for third-party advertising. We collect only what we need for the purposes above, and we’ll ask for fresh consent before using your data for any new purpose.

4. Who we share it with

We share data only with service providers who process it on our behalf and under our instructions (“Data Processors”), and only what each one needs:

We also share limited information:

• With delivery riders — your name, phone number, delivery address and pin for the order they’re delivering.
• When the law requires it — with government, tax or law-enforcement authorities when we receive a valid legal request, or to protect the safety of our customers, riders and staff.
• In a business transfer — if Greenzaa is merged or acquired, data may move to the new owner, who must keep protecting it under this policy.

Our main systems are hosted in India. Some providers (such as Google) may process data on servers outside India; such transfers are made as permitted under the DPDP Act.

5. How long we keep it

• Account data (name, phone, addresses, cart, preferences, device tokens) — while your account is active. When you delete your account, we delete it (see Delete your account).
• Order and invoice records — kept as required by Indian GST and tax law, which generally requires records to be kept for 72 months from the due date of the annual return for that year (about 8 years in practice). After you delete your account, we keep only what the invoice needs (such as name, billing/delivery address and order details).
• Support and grievance records — as long as needed to resolve the matter and handle any follow-up or dispute.
• Launch sign-up emails — until we’ve sent the launch update you asked for, or earlier if you ask us to delete them.
• Server and security logs — for a limited period needed for security and debugging, then deleted.

Our providers may keep their own records (for example, SMS delivery logs) as their law requires.

6. How we protect it

We use reasonable security practices, including encrypted connections (HTTPS/TLS) between the app and our servers, access controls that limit staff access to what their job needs, and OTP sign-in so there are no passwords to steal. No system is perfectly secure; if a personal data breach happens, we will notify affected users and the Data Protection Board of India as the DPDP Act requires.

7. Your rights

Under the DPDP Act you have the right to:

• Access — ask for a summary of the personal data we hold about you and how we use it, and who we’ve shared it with.
• Correction and updating — fix inaccurate or incomplete data. You can edit your name and addresses directly in the app.
• Erasure — ask us to delete your data, subject to records we must keep by law. The fastest way is in the app: Profile → Delete account.
• Withdraw consent — at any time, as easily as you gave it.
• Grievance redressal — complain to our Grievance Officer, and if you’re not satisfied, to the Data Protection Board of India.
• Nominate — name another person to exercise these rights on your behalf if you die or become unable to do so.

To use any of these rights, email hello@greenzaa.in from, or quoting, your registered phone number. We may need to verify your identity before acting on a request.

8. Children

Greenzaa is not directed at anyone under 18, and you must be 18 or older to create an account. We do not knowingly collect personal data from children. If you believe a child has given us their data, contact us and we will delete it.

9. Cookies & this website

This website does not set cookies, does not use analytics or advertising trackers, and has no sign-in or forms. The “Get notified” and contact links simply open your own email app. Fonts and images are served from our own website domain. Like any website, our hosting provider records standard server logs (such as IP address, browser type and the pages requested) to keep the site running and secure.

If we add analytics or cookies in future, we’ll update this section first.

10. Changes to this policy

We may update this policy as our service changes (for example, when the app launches or online payments go live). We’ll change the “Last updated” date above, and for significant changes we’ll tell you in the app before they apply.

11. Contact & grievances

Questions about this policy: hello@greenzaa.in.

Grievances: hello@greenzaa.in, +91 99248 42601. We acknowledge complaints within 48 hours and aim to resolve them within 30 days. See Grievance redressal for details.

Postal address: Vaibhav Patni, 00 Amali Faliya, Gokul, Nagarwada, Vadodara, Gujarat 390001, India.