Privacy Policy

1. Overview & Commitment

At BowlCulture, we respect your personal privacy. This Privacy Policy explains transparently how we collect, process, store, and protect your information in accordance with the Digital Personal Data Protection Act, 2023 (DPDPA 2023), the Digital Personal Data Protection Rules, 2025, and the Information Technology Act, 2000.

We collect only the minimum digital personal data necessary to prepare your food accurately, dispatch your delivery, and manage loyalty rewards. We do not sell, rent, or trade customer personal data to third-party advertisers or data brokers.

2. Information We Collect

When you interact with our website or place an order, we may collect the following information:

• Contact Information: Your name and 10-digit Indian mobile number.
• Delivery Address: House/flat number, apartment or building name, street, locality, and landmark for accurate delivery fulfillment.
• Optional Email Address: If provided during checkout, your email is used strictly to transmit digital order receipts and payment confirmations. Email is never mandatory to place an order.
• Order Details: Selected food dishes, portion sizes, spice preferences, subtotal, delivery charges, payment method, order timestamps, and unique order reference IDs.
• Loyalty Records: Verified delivery counts, earned loyalty stamps, and available rewards associated with your verified phone number.

3. How We Use Your Information

Your information is used strictly for legitimate business and fulfillment purposes:

• To prepare your selected dishes fresh in our kitchen and package them safely.
• To hand over your delivery package and contact you for navigation or location assistance.
• To award loyalty stamps upon verified delivery and apply valid loyalty reward discounts.
• To provide real-time order status updates and tracking via our secure tracking route.
• To comply with applicable legal, accounting, and food safety regulations in India.

4. Phone & Email Verification

To ensure customer accounts and loyalty stamps cannot be claimed by unauthorized parties, our platform supports one-time password (OTP) verification:

• When you sign in to view your loyalty stamps, an authentication code is sent to your registered phone or email.
• Verification codes expire quickly and can be used only once.
• We never bypass verification or simulate successful logins when authentication credentials are unverified.

5. WhatsApp Ordering

When you choose "Order on WhatsApp", our website prepares a formatted order text containing your items, portion sizes, delivery address, and estimated total, and opens a direct chat with our verified business number (+91 99597 71907):

• Communications on WhatsApp are subject to WhatsApp's standard end-to-end encryption and terms.
• We never include passwords, payment card numbers, or internal server tokens in WhatsApp URLs.
• Opening the chat does not automatically confirm payment or place the order until our kitchen staff verifies and acknowledges it.

6. Payment Processing Safety

If you choose to pay online via Cashfree Payment Gateway:

• Your payment is processed directly through Cashfree's PCI-DSS compliant, RBI-regulated payment infrastructure.
• BowlCulture never receives, processes, or stores your credit card numbers, debit card numbers, CVVs, or net banking passwords on our servers.
• We receive only transaction reference numbers, payment statuses (Success/Failed), and amounts to confirm order preparation.

7. Service Providers & Synchronization

To fulfill orders smoothly, we work with trusted operational service providers:

• Cloud Hosting & Edge Network: Cloudflare Pages provides secure edge hosting with SSL/TLS encryption for all website traffic.
• Database Storage: Supabase provides server-side database storage with row-level security and encrypted backups.
• Internal Kitchen Sheets: If Google Sheets synchronization is enabled, order summaries are synchronized to private, authenticated staff sheets for kitchen assembly. Service account keys are stored securely on the server and are never accessible via frontend code.
• Delivery Logistics: Contact numbers and delivery addresses are shared only with designated delivery personnel for the sole purpose of handing over your meal.

8. Security & Access Controls

We maintain strict administrative, technical, and physical safeguards to protect customer data:

• No Public Order Access: Customer orders cannot be browsed publicly. Order tracking requires the unique, non-guessable cryptographic public token generated at checkout.
• Zero Secret Exposure: All database master keys, admin PINs, and gateway secrets are kept on the server and never exposed in HTML, CSS, or client-side JavaScript.
• Encrypted Communications: All traffic between your browser and our servers uses HTTPS with TLS 1.3 encryption.

9. Data Retention & Customer Rights under DPDPA 2023

In full compliance with India's Digital Personal Data Protection Act, 2023 (DPDPA 2023) and Rules 2025, BowlCulture guarantees the following data principal rights:

• Right to Access & Summary: You have the right to request a summary of personal data being processed by us and the processing activities undertaken.
• Right to Correction & Erasure: You may request the correction of inaccurate or misleading delivery details or the deletion/erasure of your personal information once the purpose of order processing is complete, subject to statutory tax and accounting retention requirements.
• Right of Grievance Redressal: If you have any privacy concerns, you may register a grievance with our designated Grievance Officer, who will address your complaint within the timeframe mandated by DPDPA regulations.
• Right to Nominate: You have the right to nominate an individual who shall exercise your rights in the event of incapacity.

10. Privacy Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact our kitchen team directly: