1. Who we are
Nfresh is a hyperlocal grocery delivery service operating in Kadapa, Andhra Pradesh, with a phased expansion to Tier-2/3 Indian cities. This policy explains what data we collect, why we collect it, and how you can control it.
For any privacy question, email nfinitee9@gmail.com.
2. What we collect
We only collect data we actually need to deliver your order:
- Phone number — verified via OTP at sign-in. Used for login and to reach you about your order.
- Name — shown to the delivery partner when they hand over the bag.
- Delivery address(es) — house/flat number, city, state, pincode, plus the GPS pin you drop on the map. Used by the partner to find your door.
- Order history — items, quantities, totals, payment status. Required to operate the service and to issue invoices/refunds.
- Payment status — we record whether an order is paid, pending, or refunded. We do not store card numbers, UPI IDs, or bank details ourselves — Razorpay handles those.
- Wallet balance — when you recharge, we keep a record of credits and debits so you can see your balance and history.
- Push notification token — only if you grant notification permission. Used to alert you about deliveries and account events.
- Device + browser type — captured automatically by our hosting provider (Vercel) and our database provider (Supabase) for security and debugging. Standard web logs.
3. What we don't do
- We don't sell your data to advertisers or data brokers.
- We don't track you across other apps or websites.
- We don't store payment-card numbers, CVVs, or UPI PINs — Razorpay does, and they're PCI-DSS Level 1 compliant.
- We don't run any third-party advertising SDKs (no AdMob, no Facebook SDK).
- We don't share your phone number with the delivery partner — we mask it via the in-app call/chat flow.
4. Third-party services we rely on
Each of these is bound by their own privacy terms. We share the minimum data each one needs (e.g. Razorpay sees the order amount but not the items).
5. Data retention
- Account data is kept while your account is active.
- Orders are retained for 7 years for tax/regulatory compliance.
- Proof-of-delivery photos auto-delete after 7 days.
- You can email us to delete your account at any time. We honour deletion requests within 30 days.
6. Your rights
You can:
- See your data — your order history, addresses, and wallet are visible in the app.
- Edit/delete an address — directly in the app under Profile → Saved Addresses.
- Withdraw a partner application — in Profile if you applied to be a delivery partner.
- Delete your account — email nfinitee9@gmail.com from your registered phone's email or with a clear statement matching your registered phone.
- Export your data — same email request. We respond in CSV within 30 days.
7. Children
Nfresh is for adults 18+. Placing an order is a legal contract. We do not knowingly collect data from minors. If we discover we have, we delete it on receipt of notice.
8. Security
- All connections are HTTPS/TLS 1.2+.
- Passwords are not used — sign-in is OTP-only.
- Database access is gated by row-level security; staff with admin access can only see what their role permits.
- Payment flows leave our app entirely and run inside Razorpay's encrypted SDK.
9. Changes to this policy
If we change this policy, we'll bump the Last updated date at the top and surface a notice in the app for 7 days. Material changes (e.g. new third-party service) get an in-app banner you must acknowledge before continuing to order.
10. Contact
Email nfinitee9@gmail.com for any privacy question, data export, or deletion request.