Privacy policy

The short version: we collect your phone number, your name, your delivery addresses and your order history — because we cannot deliver groceries without them. We do not sell your data, we run no advertising trackers, and you can erase your account from inside the app at any time.

1. Who we are

Kada is a grocery ordering and delivery service operated by Preethi Stores ("Kada", "we", "us"), with its place of business at 1/405, Princess Street, Fort Kochi, Ernakulam, Kerala 682001, India. We are the data fiduciary for the personal data described here.

This policy covers the Kada customer app for Android and iOS, our delivery partner app, and our website.

2. What we collect

Information you give us

• Mobile number — at sign-in. It is your account identifier and how the rider reaches you.
• Name, and email address if you add one — on first sign-in, and editable in Profile.
• Delivery addresses — the address text, a map pin, a label, and the receiver's name and number if you set a different one.
• Delivery instructions ("ring the second bell") — at checkout, if you write them.
• Orders, carts, payment status and invoices — every order.
• Product ratings and reviews — only after that item has been delivered to you.
• Messages you send support — when you contact us.

Information collected automatically

• Approximate or precise device location — only while you are choosing a delivery address or checking whether we serve your area. See section 4.
• Device model, OS version, app version, language — supporting the app, fixing crashes, and telling you when an update is required.
• Push notification token — sending order updates.
• In-app activity — searches, products viewed, items added. Used to order search results sensibly and arrange the home screen. Kept against your account so "buy it again" works.
• Crash diagnostics — if the app crashes, a technical report including the error, the device model and OS version, and the app's state at the time. This goes to Google Firebase Crashlytics. It is not linked to advertising and is not used to profile you.
• Log data — IP address, timestamps, requests to our servers. Used for security, rate limiting and abuse prevention.
• A photo taken at the doorstep on delivery, where the rider is asked for proof of delivery. It is attached to that order and visible to you and to our staff.

We do not collect your contacts, photos from your gallery, SMS content, call logs, health data, or biometric data. We do not use advertising identifiers, and we run no advertising SDKs and no behavioural-advertising trackers in the app.

3. Why we collect it

• To perform the contract — taking your order, charging for it, routing a rider to your door, handling refunds and returns.
• Because you asked us to — saving an address, sending order notifications, remembering your last basket.
• For our legitimate business interests — keeping the service secure, preventing fraudulent or abusive orders, improving the catalogue, and understanding demand in aggregate.
• To comply with the law — tax invoices, accounting records, and lawful requests from authorities.

Where the law requires consent — location, notifications, and marketing messages — we ask for it, and you can withdraw it at any time from your device settings or your profile. Withdrawing consent does not affect what we processed before.

4. Device permissions

• Location — to centre the map on you when saving an address and to check you are inside the delivery area. If you refuse, the app still works: type or drag the pin to your address instead.
• Notifications — order confirmed, packed, out for delivery, delivered. If you refuse, you will not get live order updates, but everything is still in Orders.
• Camera (delivery partner app only) — proof-of-delivery photo. If refused, the rider marks delivery without a photo.
• SMS auto-read (Android) — Android passes the app our own OTP message only, matched by an app signature, so you do not have to type the code. The app has no permission to read your messages and never sees any other SMS. If you refuse, type the code in yourself.

5. Who we share it with

We do not sell personal data and we do not share it for anyone else's advertising. We share the minimum necessary with:

• Our delivery riders — your name, delivery address, map pin, instructions, and a masked or direct phone number for that order only.
• Razorpay, our payment gateway, for online payments and refunds.
• Communication providers that send your OTP and order updates by WhatsApp, SMS and push notification.
• Google Maps Platform, for maps, address search and geocoding inside the app.
• Google Firebase, for crash reporting and for delivering push notifications to your device.
• Our hosting and infrastructure providers — cloud servers, the database, and object storage for images.
• Professional advisers, auditors and authorities, where we are legally required to disclose.

If the business is sold or reorganised, account data may transfer to the new owner under the same commitments; we will tell you in the app before that happens.

6. Where your data is stored and processed

Our servers and database are hosted in India (Mumbai region).

Some of the providers named in section 5 process data on infrastructure outside India — this includes Google Maps Platform, Google Firebase, the messaging provider that delivers your OTP, and Cloudflare, which stores images, including proof-of-delivery photos. Where that happens, the transfer is limited to what that service needs to work, and is made under the provider's own contractual and security commitments. We do not transfer personal data to any country the Government of India has restricted under the Digital Personal Data Protection Act, 2023.

7. Payments

We never see your card, UPI PIN or bank credentials. Online payments are processed by Razorpay Software Private Limited on their own infrastructure under RBI rules. We receive only a payment reference, the amount, the method type (for example "UPI") and whether it succeeded. Razorpay processes your data under their own privacy policy. Cash on delivery involves no payment data at all.

8. How long we keep it

• Account profile and addresses — until you delete your account.
• Order and invoice records — retained as long as tax and accounting law requires, currently up to eight financial years, even after account deletion, reduced to what the law needs.
• Delivery photos — up to 90 days after delivery.
• OTPs — minutes. They are single-use and expire.
• Server and security logs — up to 90 days.
• Crash diagnostics — up to 90 days.
• Search and browsing signals — deleted or de-linked from you when you delete your account.

9. Your rights and choices

Under India's Digital Personal Data Protection Act, 2023, you may:

• ask what personal data we hold about you and who we shared it with;
• correct or complete anything inaccurate — most of it is editable in Profile;
• erase your data, subject to what the law requires us to keep;
• withdraw consent for location, notifications or marketing;
• nominate someone to exercise these rights if you die or become incapacitated;
• complain to us, and then to the Data Protection Board of India.

Write to preethistores@gmail.com from your registered number's account, or contact the grievance officer in section 15. We answer within 30 days, and acknowledge complaints within 48 hours.

10. Deleting your account

Two ways, both available to you directly:

1. In the app — Profile, then Delete account.
2. On the web — our account deletion page, without installing anything.

Deletion is immediate and permanent. Your name, email, addresses, delivery instructions, notification tokens, reviews and saved carts are erased; there is no grace period and no restore. Completed order and payment records survive in anonymised or legally-required form for tax and accounting, and we keep a one-way cryptographic fingerprint of your phone number so a deleted account cannot be recycled to claim first-order offers repeatedly. That fingerprint cannot be turned back into your number.

11. How we protect it

Traffic between the app and our servers is encrypted with TLS. Sign-in uses single-use one-time codes with attempt limits and rate limiting; session tokens are short-lived, rotate, and are revoked as a family if one is ever replayed. Access to production data is limited to staff who need it.

No system is perfectly secure — if a breach affects you, we will notify you and the Data Protection Board as the law requires.

12. Children

Kada is not intended for anyone under 18. We do not knowingly create accounts for children or profile them. If you believe a child has an account with us, tell us and we will delete it.

13. This website

Our website sets no cookies, runs no analytics and has no tracking pixels. Its text, prices and delivery details are loaded from our own server, and its fonts from Google Fonts, which receives the request as part of serving the file. Our host and our server record standard server logs.

14. Changes

If we change this policy we will update the date at the top, and for anything material we will tell you in the app before it takes effect. Continuing to use Kada after that means you accept the updated policy.

15. Contact and grievance officer

Questions, requests or complaints about privacy:

• Email — preethistores@gmail.com
• Phone — +91 98956 83683
• Grievance officer — Adil Mohamed, 1/405, Princess Street, Fort Kochi, Ernakulam, Kerala 682001

We acknowledge every grievance within 48 hours and resolve it within one month, as required by the Consumer Protection (E-Commerce) Rules, 2020.