Privacy policy

The short version: we collect your phone number, your name, your delivery addresses and your order history — because we cannot deliver groceries without them. We do not sell your data, we run no advertising trackers, we send offers only if you switch them on, and you can erase your account from inside the app at any time.

1. Who we are

Kada is a grocery ordering and delivery service operated by Preethi Stores ("Kada", "we", "us"), with its place of business at 1/405, Princess Street, Fort Kochi, Ernakulam, Kerala 682001, India. We are the data fiduciary for the personal data described here.

This policy covers the Kada customer app for Android and iOS, the Kada Rider app our delivery partners use, and our website. Section 2 describes what we collect from customers; section 3 from delivery partners.

2. What we collect from customers

Information you give us

• Mobile number — at sign-in. It is your account identifier and how the rider reaches you.
• Name, and email address if you add one — on first sign-in, and editable in Profile. Your email is passed to our payment provider so it can send you a payment receipt.
• Delivery addresses — the address text, a map pin, a label, and the receiver's name and number if you set a different one.
• Delivery instructions ("ring the second bell") — at checkout, if you write them.
• Orders, carts, payment status and invoices — every order.
• Product ratings and reviews — only after that item has been delivered to you.
• Messages you send support — when you contact us.
• Your agreement to our terms — each time you sign in, we record that you agreed to our terms of service and this policy, the exact versions you were shown, the date and time, the app version, and the IP address it came from.

Information collected automatically

• Approximate or precise device location — only while you are choosing a delivery address or checking whether we serve your area. See section 5.
• Device model, OS version, app version, language — supporting the app, fixing crashes, and telling you when an update is required.
• Push notification token — sending order updates, and offers if you have switched them on.
• In-app activity — searches, products viewed, items added. Used to order search results sensibly and arrange the home screen. Kept against your account so "buy it again" works.
• Crash diagnostics — if the app crashes, a technical report including the error, the device model and OS version, and the app's state at the time. This goes to Google Firebase Crashlytics. It is not linked to advertising and is not used to profile you.
• Log data — IP address, timestamps, requests to our servers. Used for security, rate limiting and abuse prevention.
• A photo taken at the doorstep on delivery, where the rider is asked for proof of delivery. It is attached to that order and visible to you and to our staff.

Voice search. If you tap the microphone in search, the app listens only while the button is active. Your phone's own speech service turns what you say into text — on Android this is Google's speech service, on iPhone Apple's — under that company's terms. We receive only the text, which is handled like a typed search. We never receive or store a recording.

We do not collect your contacts, photos from your gallery, SMS content, call logs, health data, or biometric data. We do not use advertising identifiers, and we run no advertising SDKs and no behavioural-advertising trackers in the app.

3. What we collect from delivery partners

If you deliver for us with the Kada Rider app:

• Your name, mobile number and sign-in details — set up by the store when you join. Your password is stored only as a one-way hash.
• Vehicle type, vehicle number and driving licence number — to know who is carrying an order and on what.
• Your live location — only while a delivery run is assigned to you or you are out delivering it, including when the screen is off; Android shows a notification for as long as this runs. We keep only your latest position, not a history of where you have been. It powers the customer's tracking map, the delivery route, and the store's dispatch screen.
• Proof-of-delivery photos — taken at the customer's door when asked for; kept as described in section 9.
• Delivery records — runs, stops, attempts, cash collected, and your availability.
• Ratings and comments customers leave about a delivery.
• Device and crash data — as for customers in section 2.

Customers see your name, your vehicle type and number, your live position on the map while you are bringing their order, and can call you through the app for that order.

4. Why we collect it

• To provide the service you asked for — taking your order, charging for it, routing a rider to your door, handling refunds and returns, keeping your account and orders safe from fraud and abuse, and showing you sensible search results and the products you buy again. You give us this information for these purposes, and we use it only for them.
• With your consent — your device location, notifications, and offers and reminders. Each is asked for separately and is never a condition of using Kada.
• To comply with the law — tax invoices, accounting records, security logs, and lawful requests from authorities.

You can withdraw consent at any time: location and notifications from your phone's settings, offers from Profile → Notifications. Withdrawing consent does not affect what we processed before.

5. Device permissions

• Location — to centre the map on you when saving an address and to check you are inside the delivery area. If you refuse, the app still works: type or drag the pin to your address instead.
• Notifications — order confirmed, packed, out for delivery, delivered. If you refuse, you will not get live order updates, but everything is still in Orders.
• Microphone — only for voice search, only while you tap the microphone. If you refuse, type your search instead.
• Camera (Kada Rider app only) — proof-of-delivery photo. If refused, the rider marks delivery without a photo.
• Code autofill (Android) — when your sign-in code arrives on WhatsApp, WhatsApp can hand that one code to the app so you do not have to type it. The app cannot read your WhatsApp messages or your SMS, and never sees any other message. You can always type the code yourself.

6. Who we share it with

We do not sell personal data and we do not share it for anyone else's advertising. We share the minimum necessary with:

• Our delivery riders — your name, delivery address, map pin, instructions, and a masked or direct phone number for that order only.
• Razorpay, our payment gateway, for online payments and refunds.
• Meta (WhatsApp) — or an SMS provider, when a code is sent by text — which delivers your sign-in code.
• Google Firebase, which delivers push notifications to your device and receives crash reports.
• Google Maps Platform, for maps, address search and geocoding inside the app.
• Google Fonts, which serves the app its typeface the first time it opens; Google receives that download request.
• Our hosting and infrastructure providers — cloud servers, the database, and object storage for images.
• Professional advisers, auditors and authorities, where we are legally required to disclose.

If the business is sold or reorganised, account data may transfer to the new owner under the same commitments; we will tell you in the app before that happens.

7. Where your data is stored and processed

Our servers and database are hosted in India (Mumbai region).

Some of the providers named in section 6 process data on infrastructure outside India — this includes Google Maps Platform, Google Firebase, Google Fonts, Meta, and Cloudflare, which stores images, including proof-of-delivery photos. Where that happens, the transfer is limited to what that service needs to work, and is made under the provider's own contractual and security commitments. We do not transfer personal data to any country the Government of India has restricted under the Digital Personal Data Protection Act, 2023.

8. Payments

We never see your card, UPI PIN or bank credentials. Online payments are processed by Razorpay Software Private Limited on their own infrastructure under RBI rules. We receive only a payment reference, the amount, the method type (for example "UPI") and whether it succeeded. Razorpay processes your data under their own privacy policy. Cash on delivery involves no payment data at all.

9. How long we keep it

• Account profile and addresses — until you delete your account.
• Order and invoice records — retained as long as tax and accounting law requires, currently up to eight financial years, even after account deletion, reduced to what the law needs.
• Records of your agreement to our terms — as long as the order records they relate to; the IP address and device details are removed when you delete your account.
• Delivery photos — up to 90 days after delivery.
• OTPs — minutes. They are single-use and expire.
• Server and security logs — one year, stored in India, as Indian cyber-security and data-protection rules require.
• Crash diagnostics — up to 90 days.
• Search and browsing signals — deleted or de-linked from you when you delete your account.
• Delivery partners' location — only the latest position is kept; each new one replaces the last.

10. Your rights and choices

Under India's Digital Personal Data Protection Act, 2023, you may:

• ask what personal data we hold about you and who we shared it with;
• correct or complete anything inaccurate — most of it is editable in Profile;
• erase your data, subject to what the law requires us to keep;
• withdraw consent for location, notifications or offers;
• nominate someone to exercise these rights if you die or become incapacitated;
• complain to us, and then to the Data Protection Board of India.

Write to support@kadabypreethi.in from your registered number's account, or contact the grievance officer in section 16. We answer within 30 days, and acknowledge complaints within 48 hours.

This policy is available in Malayalam, or in any other language listed in the Eighth Schedule to the Constitution of India, on request.

11. Deleting your account

Two ways, both available to you directly:

1. In the app — Profile, then Account privacy, then Request to delete account.
2. On the web — our account deletion page, without installing anything.

Deletion is immediate and permanent. Your name, email, addresses, delivery instructions, notification tokens, reviews and saved carts are erased; there is no grace period and no restore. Completed order and payment records survive in anonymised or legally-required form for tax and accounting, and we keep a one-way cryptographic fingerprint of your phone number so a deleted account cannot be recycled to claim first-order offers repeatedly. That fingerprint cannot be turned back into your number.

12. How we protect it

Traffic between the app and our servers is encrypted with TLS. Sign-in uses single-use one-time codes with attempt limits and rate limiting; session tokens are short-lived, rotate, and are revoked as a family if one is ever replayed. Access to production data is limited to staff who need it.

No system is perfectly secure — if a breach affects you, we will notify you and the Data Protection Board as the law requires.

13. Children

Kada is meant for adults. If you are under 18, you may use Kada only through a parent or legal guardian who has accepted our terms and this policy on your behalf, and under their supervision. We do not knowingly profile children, track their behaviour or send them offers. If you believe a child is using Kada without a parent or guardian, tell us and we will delete the account.

14. This website

Our website sets no cookies, runs no analytics and has no tracking pixels, and everything it shows — text, fonts and images — is served from our own servers. Its prices and delivery details are loaded from our own server. Our host and our server record standard server logs.

15. Changes

If we change this policy we will update the date at the top, and for anything material we will tell you in the app before it takes effect. Continuing to use Kada after that means you accept the updated policy.

16. Contact and grievance officer

Questions, requests or complaints about privacy:

• Email — support@kadabypreethi.in
• Phone — +91 98956 83683
• Grievance officer — Adil Mohamed, 1/405, Princess Street, Fort Kochi, Ernakulam, Kerala 682001

We acknowledge every grievance within 48 hours and resolve it within one month, as required by the Consumer Protection (E-Commerce) Rules, 2020.