Privacy Policy

[operating company] operates CookCart. This explains what personal data we hold, why we hold it, and what you can ask us to do with it. It is written to meet India’s Digital Personal Data Protection Act, under which we are a Data Fiduciary.

Who holds what

Two different organisations hold data about a diner, and it matters which:

The cook

Receives your name, phone number, delivery address and order so they can cook and deliver it. The cook is an independent business and decides what they do with it. Ask them directly about their handling of it.

CookCart

Stores that same information on the cook’s behalf, because we run the software the order was placed through. We do not use it for our own purposes, do not market to diners, and do not sell it to anyone.

What we collect

From cooks: name, kitchen name, email address, phone number, password (stored only as a cryptographic hash, never in readable form), UPI ID, kitchen address, menu and photographs, opening hours, and subscription and payment records.

From diners: name, phone number, delivery address, any note left for the cook, order contents and totals, and — if you choose to give it — a UPI reference number so the cook can match your payment.

Automatically: ordinary server logs, including IP address and browser, kept briefly for security and debugging.

We do not collect payment card numbers, bank credentials or UPI PINs. Payment for an order happens in your own UPI app, or in cash, directly with the cook. We never see it.

Why we hold it

• To let a cook receive and fulfil an order — the reason you gave it.
• To let you see the status of an order you placed.
• To let a cook see their own order history and takings.
• To bill a cook’s subscription.
• To keep the service secure and working.
• To meet legal and tax obligations.

We do not advertise to diners, profile them, or share their details with anyone except the cook they ordered from.

Who else sees it

We use a small number of service providers to run CookCart: hosting, and a payment gateway for cook subscriptions. They process data only on our instructions. We will also disclose data where the law requires it.

Your data is stored on servers in India.

How long we keep it

Order records

While the cook’s account is active, because a cook needs their own history and records for tax. Deleted when the account is deleted, unless the law requires us to keep them longer.

Diner names, phone numbers and addresses

Cleared automatically 12 months after an order is finished. What was sold, when, and what it cost stays, because that is the cook’s business record rather than anything about you.

Cook accounts

Until deleted, then removed within 30 days.

Server logs

Around 30 days.

Backups

Kept for 30 days, then deleted automatically. Anything we clear or delete is gone from the backups within that time too.

Your rights

You can ask us to:

• tell you what personal data we hold about you;
• correct anything inaccurate;
• delete your data, where we are not required to keep it;
• nominate someone to exercise these rights if you cannot.

You do not have to ask us to remove your details from an order. Open the order from the link the kitchen gave you and, once the order is finished, use “Remove my details from this order” at the bottom of the page. Your name, phone number, address and note are cleared straight away. The kitchen keeps what it sold and what it was paid, for its own accounts.

For anything else, write to [support email] and we will respond within 30 days. If you are a diner asking about an order, tell us the cook and roughly when, so we can find it.

If you are unhappy with how we handle a request you can complain to the Data Protection Board of India.

Keeping it safe

All traffic is encrypted in transit. Passwords are hashed and cannot be read, by us or anyone else. Each kitchen’s data is separated so one cook cannot see another’s. Access to production systems is limited to those who need it.

No system is perfectly secure. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board as the law requires.

Children

CookCart is not intended for children. We do not knowingly create accounts for anyone under 18.

Cookies

We set one cookie, to keep a cook signed in. There is no advertising cookie, no analytics cookie and no third-party tracker on this site.

Changes

If we change this policy materially we will say so by email to cooks before it takes effect.

Contact

Data protection queries: [support email]. Our postal address is on the contact page.