Privacy Policy

1. Who We Are

DukanWale ("we", "us") operates the DukanWale Platform, an AI-powered grocery and daily-needs ordering marketplace. DukanWale is registered as a Micro, Small and Medium Enterprise (MSME) under the Government of India's Udyam Registration scheme (Udyam Registration Number: UDYAM-BR-35-0056698) — not a separately incorporated company. We are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDPA").

Contact for privacy matters: legal@dukanwale.store

2. Information We Collect

2.1 Information You Provide Directly

Registration data: name, mobile number, email address, gender.

Address data: delivery addresses, landmark, location pin.

Identity documents: for Sellers — GST certificate, shop licence; for Riders — Aadhaar, driving licence, vehicle RC.

Payment information: UPI ID, UTR reference numbers for verification (we do not store bank account numbers).

Selfie photographs: for Rider identity verification.

Shop/product images: uploaded by Sellers to list products.

Voice recordings: when you use voice ordering features (processed for transcription only).

2.2 Information Collected Automatically

Device information: device model, OS version, app version, unique device identifiers.

Usage data: screens visited, features used, time and duration of sessions.

Anonymous app-usage analytics (customer app): which screens are opened, how long they stay open, what is searched for, and which products are viewed or added to the cart. These events carry only a random ID created on your phone - not your name, phone number, address, account or location - and are used only to improve the app. You can switch this off any time in Profile > Help improve DukanWale.

Location data: approximate or precise GPS coordinates when you use location-based features (with your permission).

Log data: IP address, crash reports, performance data.

Order and transaction history.

2.3 Information from Third Parties

WhatsApp Business API: message content you send to our WhatsApp number for placing orders.

Payment gateways: transaction status and reference numbers.

Maps APIs (Google Maps): geocoding and routing data.

3. How We Use Your Information

3.1 To Provide the Service — processing and fulfilling orders; matching Customers with Sellers and Riders; processing AI-assisted orders (voice, image, text); verifying Seller and Rider identities and documents before onboarding; facilitating UPI payments and verifications; sending order confirmations, OTPs, and delivery notifications.

3.2 To Improve the Platform — analysing usage patterns to improve features and the AI ordering system; training and improving AI models using anonymised or aggregated data; debugging and resolving technical issues.

3.3 For Safety & Compliance — verifying the authenticity of documents submitted for onboarding; detecting and preventing fraud, abuse, and unauthorised access; complying with legal obligations, court orders, or government directives.

3.4 For Communication — customer support and dispute resolution; service announcements and important updates; with your consent, promotional messages, offers, and new feature announcements.

AI & Voice Data: Voice recordings are transmitted via OpenRouter to a third-party speech-to-text model solely to convert speech to text. We do not use your voice recordings to build a voice profile or sell them to third parties.

4. Data Sharing

We share personal data only as described below.

4.1 Within the Platform — Customer name and delivery address are shared with the assigned Seller and Rider to fulfil the Order; Rider name and contact number are shared with the Customer for delivery coordination; Seller name and shop location are displayed to Customers.

4.2 Service Providers (Data Processors) — we engage third-party service providers who process data on our behalf and are bound by data processing agreements: cloud infrastructure (Microsoft Azure), AI services (OpenRouter, which routes ordering-assistant, image, and voice-transcription requests to third-party model providers including OpenAI and DeepSeek), communication (Meta WhatsApp Business API), SMS/OTP (Twilio), maps (Google LLC), and payments (Razorpay).

4.3 Legal Disclosures — we may disclose personal data if required by law, court order, or regulatory authority in India, or to protect the safety of our users or the public.

4.4 Business Transfers — in the event of a merger, acquisition, or sale of assets, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

We do not sell your personal data.

5. Data Retention

Account data: retained while your account is active and for 3 years after closure.

Order and transaction records: retained for 7 years for legal and accounting compliance.

Identity documents (Aadhaar, licence scans): retained for 3 years post-offboarding or as required by law.

Voice recordings: deleted within 90 days of processing unless retained for dispute resolution.

Log data: retained for 12 months.

6. Data Security

We implement industry-standard technical and organisational measures to protect your data, including HTTPS/TLS encryption for all data in transit, encryption at rest for sensitive data stored in our databases, role-based access control so only authorised personnel access personal data, regular automated backups with disaster recovery procedures, and periodic penetration testing and security audits.

Breach Notification: in the event of a data breach that is likely to adversely affect you, we will notify you and the Data Protection Board of India within the timelines prescribed under the DPDPA, 2023.

7. Your Rights Under the DPDPA, 2023

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the right to:

Access — obtain a summary of your personal data we process and know how it is being used.

Correction & Erasure — correct inaccurate data directly in your app profile, or delete your account and the personal data we are not legally required to retain (order/financial history is retained for accounting purposes, anonymised) using the "Delete my account" option in your app (type "delete" to confirm) — no email needed, and it takes effect immediately once any order, booking, or delivery in progress is finished. If you'd rather not use the app, you can also request deletion by emailing legal@dukanwale.store from your registered email or registered mobile number.

Grievance Redressal — raise a complaint with our Grievance Officer.

Nomination — nominate another individual to exercise your rights in case of death or incapacity.

Withdraw Consent — withdraw consent for non-essential processing at any time (this will not affect lawfulness of prior processing).

To exercise any of these rights, contact us at legal@dukanwale.store. We will respond within 30 days. If your complaint is not resolved to your satisfaction, you may escalate to the Data Protection Board of India.

8. Children's Privacy

The Platform is not directed at children under 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a minor without verifiable parental consent, we will delete it promptly.

9. Cookies & Analytics

Our web interfaces use cookies and similar browser storage to remember your preferences. You can control cookie preferences through your browser settings. Disabling cookies may affect some Platform functionality. We do not currently use any third-party analytics or session-recording service; if that changes, this section will be updated first.

10. Cross-Border Data Transfers

Some of our service providers operate outside India (e.g., OpenRouter and the AI model providers it routes requests to, such as OpenAI and DeepSeek, in the United States). By using the Platform, you consent to the transfer of your data to these providers as necessary to provide the service, subject to adequate safeguards.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via in-app notification at least 7 days before they take effect. Your continued use of the Platform constitutes acceptance.

12. Grievance Officer

For privacy complaints, contact our designated Grievance Officer at legal@dukanwale.store. Response time: within 30 days of receipt of complaint.