Privacy Policy

1. Introduction & Scope

Annaswaad ("we", "us", or "our") respects your personal data privacy and is committed to protecting it in accordance with the Digital Personal Data Protection (DPDP) Act, 2023 of India and other applicable laws. This Privacy Policy describes how we collect, process, use, store, and safeguard your personal data when you interact with our website, mobile application, and digital services.

When you continue with OTP authentication after being presented with our Terms of Service and Privacy Policy notice, you acknowledge that you have read this Privacy Policy and agree to the processing of your personal data as described herein, subject to applicable law.

2. What Data We Collect

We collect only necessary personal data required to fulfill our contractual and service obligations to you:

• Identity & Contact Information: Name, mobile phone number, email address, and delivery addresses.
• Transaction & Order History: Products purchased, payment method types, delivery status, and invoice records. We do not store full credit/debit card numbers or sensitive banking credentials.
• Technical & Telemetry Data: IP address, device type, operating system version, browser type, and app interaction telemetry. This information may include diagnostic logs, device identifiers, application events, and other technical information generated while using our services.

3. Why We Collect Your Data & Lawful Basis

We process your personal data under explicit consent and legitimate contractual necessity for the following purposes:

• Order Fulfillment & Account Security: To authenticate your identity via OTP, process orders, deliver goods, and send critical transactional service updates (order confirmation, dispatch, delivery, refunds, and support replies).
• Legal & Tax Compliance: To maintain mandatory accounting, invoicing, and tax audit trails as required under Indian commercial and tax laws.
• Optional Promotional Marketing: Subject strictly to your separate, explicit opt-in checkbox, we may send promotional offers, new launch alerts, and discounts via WhatsApp, SMS, Email, or Push Notifications.

4. Analytics Processing & UX Optimization

To continuously improve application performance, prevent fraudulent activities, and optimize the user shopping experience, we utilize usage telemetry tools including Google Analytics 4 and Firebase Analytics. These tools help us understand how our website and application are used, identify technical issues, improve performance, and enhance the user experience.

These services collect aggregated device interaction metrics. We do not use analytics to make automated decisions that produce legal or similarly significant effects on users. You retain full control over analytics collection and may disable or opt out of analytics tracking at any time by navigating to Profile → Privacy Settings within our website or mobile app.

5. Third-Party Processors & Infrastructure

We partner with verified, enterprise-grade cloud infrastructure and processing partners to operate our services efficiently. These third parties act as Data Processors strictly bound by confidentiality and security obligations. We may update this list from time to time as our infrastructure evolves:

• Razorpay: PCI-DSS compliant payment processing, checkout encryption, and tokenized transactions.
• Meta WhatsApp Cloud API & MSG91: Delivery of transactional OTPs, shipping notifications, and opted-in promotional messages.
• Google Analytics 4 & Firebase: Application usage telemetry and site performance monitoring.
• Supabase / Cloudflare: Cloud database hosting, Content Delivery Network (CDN), Web Application Firewall (WAF), and DDoS protection.

6. Data Retention & Secure Disposal

We retain your account profile and order records for the period required under applicable tax, accounting, and legal obligations, after which they are securely deleted or anonymized, unless a longer retention period is required by applicable law. Transient authentication logs, session data, and OTP records are automatically purged after 30 days. When you initiate an account deletion request, non-essential personal data is scheduled for automated disposal in accordance with our retention workflows.

7. Your Rights & Withdrawal of Consent

Under the DPDP Act, 2023, you possess comprehensive rights regarding your personal data:

• Right to Access & Update: You can view and edit your profile details directly in your account dashboard.
• Right to Withdraw Consent: You may seamlessly withdraw consent for optional promotional marketing or analytics tracking at any time inside Profile → Privacy Settings without needing to delete your account or affecting your ability to place orders.
• Right to Erasure: You can request complete account deletion directly from the app or website settings, triggering our secure data disposal workflow.

8. Children's Privacy Policy

Our services are intended for individuals who are legally permitted to use them under applicable law. Where required, we obtain the necessary consent from a parent or lawful guardian before processing the personal data of children. If you believe we have inadvertently processed data of a minor without appropriate authorization, please contact our Grievance Officer immediately for rapid remediation.

10. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or business practices. Material changes will be reflected by updating the Version, Effective Date, and Last Updated date at the top of this page.