Privacy policy

This policy explains how TiffinFlow (proprietorship) (“TiffinFlow”, “we”) collects and uses personal data when you use the TiffinFlow website and app. We follow India’s Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

Who is responsible

TiffinFlow provides software to independent tiffin kitchens. For customer orders, the kitchen you subscribe to decides how it serves you; TiffinFlow processes the data needed to run the service for both of you.

Data we collect

• Account: mobile number, name, language and optional email.
• Delivery: address, landmark, delivery instructions and, if you allow it, your location pin.
• Meal activity: subscriptions, skips, extra meals, deliveries, ratings and requests you send to your kitchen.
• Payments: amount, plan and the UPI reference number (UTR) you enter. We never receive your bank, card or UPI PIN details; payments go directly from your UPI app to the kitchen.
• Device: notification token (if you enable notifications), and basic technical logs such as IP address and browser type for security.
• Riders: location at the moment a delivery is marked delivered, used as proof of delivery.
• Contact form: name, mobile number, optional email, city and your message, used only to reply to you.

Why we use it

• To log you in with a one-time password and keep your account secure.
• To show your kitchen how many meals to cook and where to deliver them.
• To keep an accurate passbook of meals and payments.
• To send service notifications (menu, delivery, payment, reminders).
• To answer enquiries sent through our contact form.
• To prevent fraud and abuse and to meet legal obligations.

We do not sell your personal data and we do not use it for third-party advertising.

Who we share it with

• Your kitchen and its staff and riders, limited to what they need (riders see only their own deliveries).
• Service providers who process data on our behalf: Google Firebase (login and notifications), our hosting provider in India, and our SMS provider. They may only use the data to provide their service to us.
• Authorities when required by law.

How long we keep it

We keep account data while your account is active. Passbook and payment records are kept for up to 8 years where needed for accounting and dispute resolution, in anonymised form after account deletion. Contact form messages are kept for up to 2 years. Technical logs are kept for up to 90 days.

Your rights

You can access and correct your data in the app, withdraw consent for optional features (location, notifications) in your device settings, and delete your account at any time. You may also nominate a person to exercise your rights. To make a request, email support@harshitchouhan.com.

Security

Data is encrypted in transit (HTTPS), access is limited by role, every sensitive change is logged, and login uses one-time passwords. No system is perfectly secure; we will notify you and the Data Protection Board of India of a personal data breach as required by law.

Children

TiffinFlow is not meant for children under 18 to use without a parent or guardian. We do not knowingly collect children’s data without verifiable parental consent.

Cookies and storage

This website does not use advertising or tracking cookies. The app stores your login token and language on your device so you stay signed in.

Grievance officer

Grievance Officer, TiffinFlow
Email: support@harshitchouhan.com
Phone: +91 83199 01547
Bhopal, Madhya Pradesh, India. We respond within 30 days.

Changes

We will post updates on this page and notify you in the app for important changes.