Privacy Policy

DropFood is the data fiduciary responsible for the personal data you share with us. This policy applies to data collected via our website (dropfood.in), waitlist form, subscription service, and any communications with us. This policy complies with India’s Digital Personal Data Protection (DPDP) Act, 2023 and the Information Technology Act, 2000.

We collect only what we need to provide the service:

• Identity data — your name.
• Contact data — email address and phone number.
• Location data — your delivery pincode and address.
• Preference data — meal preferences, dietary restrictions you choose to share.
• Usage data — pages visited, session duration, device type (via Vercel Analytics, anonymised).
• Communication data — messages you send us via email or our contact form.

We do not collect payment card details directly — payments (when live) are processed by a certified payment gateway. We do not collect data from children under 18 years of age.

We use your data only for the purposes stated at collection:

• To register and manage your waitlist position or subscription.
• To deliver meals to the correct address and contact you about your order.
• To send service updates, launch notifications, and account information.
• To respond to your queries and support requests.
• To improve our website and service through aggregate analytics.
• To comply with applicable legal obligations.

We will never use your data for unsolicited marketing from third parties, and we will not sell or rent your data to anyone.

Under the DPDP Act 2023, we process your data on the basis of your informed consent, which you provide when submitting your details via our waitlist or subscription form. You may withdraw consent at any time — see Section 7 for how to exercise your rights.

We share your data only where necessary:

• Delivery partners — your name, address, and phone number are shared with our delivery team to complete your order.
• Technology providers — we use Vercel (hosting and analytics) and NeonDB (database) to operate the platform. Both are contractually bound to protect your data.
• Legal authorities — if required by law, court order, or government mandate.

We do not share your data with advertisers or data brokers.

We retain your data for as long as your account is active or as needed to provide the service. If you request deletion, we will remove your personal data within 30 days, except where retention is required by law (e.g., financial records). Anonymised analytics data may be retained indefinitely.

As a data principal under Indian law, you have the right to:

• Access — request a summary of personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data (subject to legal obligations).
• Grievance — raise a complaint with our Grievance Officer (details below).
• Nomination — nominate another person to exercise rights on your behalf in case of death or incapacity.

To exercise any of these rights, email hello@dropfood.in with “Data Request” in the subject line. We will respond within 30 days.

We use industry-standard measures to protect your data: encrypted connections (TLS), access controls, and secure database hosting. No method of transmission over the internet is completely secure, but we take reasonable steps to protect your information. In the event of a data breach that may affect your rights, we will notify you as required by law.

We use a small number of cookies. Our Cookie Policy explains what they are and how to manage them.

We may update this policy as our service evolves. Material changes will be communicated via email or a notice on our website. The “Last updated” date at the top of this page indicates when changes were last made.

In accordance with the DPDP Act 2023 and the Information Technology Act 2000, you may contact our Grievance Officer for any data-related complaints:

Grievance Officer — DropFood
Email: hello@dropfood.in
Response time: within 30 days of receipt.