Privacy Policy

This Privacy Policy explains how [PLACEHOLDER: Legal Entity Name] ("Cittrabha", "we") collects, uses, discloses, and protects your personal data when you use the Platform. We comply with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").

1. Data we collect

• Account data: name, email, phone, password hash.
• Address & location: delivery address, approximate location for serviceability.
• Order data: items purchased, payment status, delivery status.
• Creator KYC: business details and contact information.
• Device & usage data: IP address, browser, cookies, log data.

2. Purposes of processing

• To create and operate your account and fulfil orders.
• To verify Creator eligibility under the FSS Act.
• To process payments, refunds, and customer support requests.
• To comply with legal, tax, and regulatory obligations.
• To improve and secure the Platform.

3. Lawful basis & consent

We process your personal data based on your consent obtained at signup and at relevant in-app touchpoints, and on the "legitimate uses" set out in Section 7 of the DPDP Act (such as fulfilment of a service requested by you).

4. Sharing

We share data only with:

• Creators, to enable fulfilment of your orders.
• Payment aggregators and delivery partners, on a need-to-know basis.
• Cloud and analytics service providers acting as Data Processors.
• Government or law enforcement, where required by law.

We do not sell your personal data.

5. Retention

We retain personal data for as long as your account is active or as required by applicable law (including tax records under the Income-tax Act, 1961 and GST law).

6. Security

We follow reasonable security practices including encryption in transit, access controls, and database row-level security, in line with the SPDI Rules.

7. Your rights

Under the DPDP Act you have the right to:

• Access a summary of your personal data and processing.
• Correct, complete, update, or erase your personal data.
• Withdraw consent at any time.
• Nominate another individual to exercise your rights in case of death/incapacity.
• Grievance redressal through the Grievance Officer (see below).

8. Cookies

We use strictly necessary cookies for authentication and a small number of analytics cookies. You can manage cookies in your browser settings.

9. Children

The Platform is not intended for users under 18 years of age.

10. Grievance Officer

In accordance with the DPDP Act, the IT Act, 2000 and the IT Rules, 2021, the Grievance Officer designated to address your queries and complaints is listed on our Grievance Redressal page.

11. Changes

We may update this Policy. Material changes will be notified in-app or via email.