1. Scope & who this applies to

The Platform serves three types of users, and we collect different data for each:

• Customers — people who browse restaurants and place food orders.
• Delivery Partners (riders) — independent partners who accept and fulfil deliveries.
• Restaurant Partners — businesses that list menus and prepare orders.

Where a section applies only to a specific role, we say so. If you do not agree with this policy, please do not use the Platform.

2. Information we collect

2.1 Information you provide

• Account & profile: name, mobile number, email, password, profile photo, saved delivery addresses, and preferences (e.g. veg-only, allergens).
• Health & dietary data (customers): optional nutrition and dietary information you choose to add in the app — your daily calorie goal, calorie/nutrition intake tracking, flagged food allergies, and taste preferences. You can add, edit or delete this at any time. Nutrition values shown in the app are estimates provided by restaurants and are not medical or dietary advice.
• Delivery partners (KYC): government ID (e.g. Aadhaar/PAN/driving licence), vehicle and registration details, a verification selfie, bank/UPI details for payouts, and emergency contact.
• Restaurant partners: business name, owner/contact details, address, FSSAI licence number, GSTIN/PAN, bank details for settlements, and menu content (items, images, prices).
• Orders & communications: order details, chats and calls with support, delivery partners and restaurants (calls may be masked and recorded for safety and quality), ratings and reviews.

2.2 Information collected automatically

• Location data — see Section 7 (precise/GPS location; background location for active delivery partners).
• Device & usage data — device model, OS, app version, unique device and advertising identifiers (e.g. Android Advertising ID), IP address, mobile network, in-app activity, and diagnostic/crash logs.
• Cookies & similar technologies (website) — used for essential functionality, preferences and analytics. You can control cookies through your browser.

2.3 Information from third parties

We may receive information from payment processors (transaction status), mapping providers, and identity/KYC verification providers, as needed to operate the Platform.

3. Device permissions

We request permissions only for the features that need them:

• Location — to find restaurants near you, calculate delivery, and enable live order tracking. Delivery-partner apps use location in the background while a delivery is active, so customers can track the order.
• Camera & Photos — to upload a profile photo, KYC/verification documents (partners), or menu images (restaurants).
• Notifications — to send order updates and important alerts.
• Phone — to place masked calls between customers, riders and restaurants without revealing personal numbers.

You can revoke any permission in your device settings; some features may then stop working.

4. How we use your information

• Create and manage your account and provide the Platform’s core features.
• Process, assign, deliver and track orders, and process payments and payouts.
• Verify the identity and eligibility of delivery and restaurant partners.
• Provide customer support and resolve disputes.
• Send transactional notifications, and — with your consent — promotional messages.
• Ensure safety, prevent fraud, and enforce our Terms.
• Apply your dietary preferences and allergy flags, and show estimated nutrition information, when you browse and order (customers).
• Improve and analyse the Platform, and develop new features.
• Comply with legal obligations and lawful requests.

Our lawful bases include performance of our contract with you, your consent, our legitimate interests (e.g. safety and fraud prevention), and compliance with law.

5. How we share information

We do not sell your personal data. We share it only as needed to run the Platform:

• Between users to fulfil an order — a customer’s name, delivery address and order are shared with the assigned restaurant and delivery partner; a delivery partner’s first name, photo and live location are shared with the customer for tracking.
• Service providers — payment gateways, cloud hosting, mapping, messaging/analytics, KYC and communication providers who process data on our behalf under confidentiality obligations.
• Legal & safety — to comply with law, court orders or government requests, and to protect the rights, safety and property of users, the public or Zyumm.
• Business transfers — in connection with a merger, acquisition or sale of assets, subject to this policy.

6. Third-party services we use

The Platform relies on trusted third parties, each governed by its own privacy policy:

• Google Firebase (authentication support, push notifications, analytics, crash reporting) — Firebase Analytics may use your device Advertising ID. See Google’s Privacy Policy.
• Payment gateway(s) (e.g. Razorpay) for processing payments — card and banking details are entered on the provider’s secure systems; we do not store full card numbers.
• Mapping & routing providers (e.g. Google Maps / Ola Maps) for location, distance and navigation.

7. Location data

Location is central to a delivery service. For customers, we use precise location (with permission) to show nearby restaurants, estimate delivery, and track your order. For delivery partners, we collect location while the app is in use and, during an active delivery, in the background — this is required to route the delivery and let the customer and restaurant track it in real time. You can turn location off in device settings, but you will not be able to receive/deliver orders.

8. Payments

Online payments are processed by PCI-DSS-compliant third-party payment aggregators. We receive confirmation of payment status and limited metadata (e.g. last four digits, method), but we do not collect or store your full card/UPI credentials. Cash-on-delivery transactions are handled between you and the delivery partner.

9. Data retention & account deletion

We keep personal data for as long as your account is active and as needed to provide the Platform, and thereafter as required to comply with legal, tax, accounting, dispute- resolution and fraud-prevention obligations. Transaction and invoice records are retained for the periods required under Indian tax and company law. When data is no longer needed, we delete or anonymise it.

Deleting your account. You can request deletion from the Zyumm customer app (Profile → Delete account) or by emailing our Grievance Officer (Section 14). Once requested, your account enters a 30-day grace period during which you can cancel the request and keep your account; our team may review and action it sooner. On completion we anonymise your profile and delete your saved delivery addresses, health/nutrition preferences, device (push) tokens and login sessions. Order, invoice and payment records are retained only in anonymised form for the periods required under Indian tax and company law.

10. How we protect your data

We use reasonable technical and organisational measures — encryption in transit (HTTPS), access controls, secure token-based authentication, and monitoring — to protect personal data. No method of transmission or storage is 100% secure; you are responsible for keeping your login credentials confidential. If we become aware of a data breach affecting your rights, we will notify you and the relevant authority as required by law.

11. Your rights

Subject to applicable law (including the DPDP Act, 2023), you may:

• Access and obtain a copy of the personal data we hold about you.
• Correct or update inaccurate or incomplete data (also editable in-app).
• Request deletion of your account and personal data.
• Withdraw consent (e.g. opt out of marketing, or turn off permissions).
• Nominate another individual to exercise your rights in case of death or incapacity.
• Raise a grievance with our Grievance Officer (details below).

To exercise any right, email grievance.zyumm@gmail.com. We may verify your identity before acting on a request. Deleting your account does not remove records we are legally required to keep.

12. Children

The Platform is intended for users aged 18 and above. Delivery and restaurant partners must be adults and legally permitted to work. We do not knowingly collect data from children; if you believe a child has provided us data, contact us and we will delete it. Some items (e.g. where permitted by law) may have age restrictions at delivery.

13. Changes to this policy

We may update this policy from time to time. Material changes will be notified via the app or website. The “Last updated” date above reflects the latest revision. Continued use of the Platform after changes take effect constitutes acceptance.

14. Grievance Officer

In accordance with the Consumer Protection (E-Commerce) Rules, 2020 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, you may contact our Grievance Officer with any complaint about the Platform, its content, or the handling of your personal data:

• Name: Jagtar Singh
• Designation: Director, HavOdds Private Limited
• Entity: HavOdds Private Limited
• Address: Chak 7 PBN, Dulmana, Pilibanga, Hanumangarh, Rajasthan – 335803, India
• Email: grievance.zyumm@gmail.com
• Phone: +91 63776 88547
• Working hours: Monday to Saturday, 10:00 – 18:00 IST

We acknowledge complaints within 48 hours of receipt and endeavour to resolve them within one month, in accordance with applicable law.