Privacy Policy
How GVD Soni's Cafe collects, uses, stores, and protects personal data across orders, franchise inquiries, payments, and delivery — with India-first compliance framing.
Last updated: 27 September 2026
1. Introduction and scope
This Privacy Policy ("Policy") describes how GVD Soni's Cafe ("we", "us", "our") and its affiliates collect, use, store, disclose, and protect personal data when you access or use our websites, mobile applications, APIs, order dashboards, customer support channels, and related services (collectively, the "Platform").
This Policy applies to visitors, registered users, franchise partners, and delivery partners who interact with the Platform. It should be read together with our Terms of Service.
2. Data fiduciary and contact
2.1 Who is responsible
For personal data processed in connection with the Platform, the data fiduciary (controller) is the GVD Soni's Cafe entity identified on your tax invoices or order receipts.
2.2 Grievance Officer
For privacy requests, exercise of rights under applicable Indian personal-data law, and formal grievances about our processing, contact our Grievance Officer at privacy@justgvd.com.
3. Categories of personal data we collect
- Identity and account data: Name, phone number, email address, profile photo, and authentication tokens.
- Order and delivery data: Delivery addresses, geocoordinates, contact persons, food preferences, cart items, delivery instructions, and chat/call metadata between you and delivery partners.
- Payment and financial data: Transaction amounts, payment method type, and gateway transaction references. We do not store full card numbers on our servers.
- Franchise and business data: Business names, GSTIN, and documents you upload for franchise eligibility.
- Device, log, and diagnostic data: IP address, device type, operating system, browser type, precise or coarse location (when permitted), and crash logs.
- Communications: Emails, in-app tickets, SMS or WhatsApp content where you message our official lines.
4. How we collect personal data
Directly from you when you register, place an order, apply for a franchise, pay, or chat with support. Automatically through cookies, SDKs, and server logs when you use our digital properties. From delivery partners during order fulfillment (e.g. status updates, GPS pings).
5. Purposes and legal bases for processing
We process personal data where permitted under applicable Indian law, including the DPDP Act and the Information Technology Act, 2000.
- Operating the Platform: Authenticating users, displaying menus, routing orders, issuing invoices, and customer support.
- Payments and risk: Processing fees, detecting fraud, and meeting tax and audit obligations.
- Safety and integrity: Investigating incidents, securing systems against intrusion, and protecting users.
- Improvement and analytics: Debugging, product development, and understanding usage trends.
- Marketing: Sending promotional communications where permitted, with opt-out mechanisms.
7. Cross-border processing
Primary processing occurs in India. Subprocessors (e.g., cloud regions, global APIs) may use facilities outside India where contractually required compatibility with Indian cross-border transfer rules is maintained under the DPDP Act.
8. Retention
We retain personal data only as long as necessary for the purposes above. Order and billing records may be kept for multi-year periods consistent with GST, contract, and litigation limitation rules. Where retention is no longer required, we delete or de-identify data.
9. Security of personal data
We implement reasonable technical and organizational measures including access control, encryption in transit, segregation of environments, and vulnerability management. You are responsible for using strong passwords, protecting OTPs, and logging out of shared devices.
10. Your rights and choices
- Access and correction: You may update profile fields in-app or contact our Grievance Officer.
- Withdrawal of consent: You may withdraw consent using in-product controls or by contacting us.
- Erasure: You can initiate deletion from the GVD app under Account > More account options > Delete account, or follow the steps on our Account Deletion page. Minimal records may be retained for tax, payment, fraud-prevention, dispute, refund, and other legal obligations.
- Grievance redressal: Contact privacy@justgvd.com to escalate concerns. You also have rights under the Data Protection Board of India once operational.
12. SMS, WhatsApp, email, and push
Operational messages (order status, OTPs, invoices) are sent as needed to perform our contract. Marketing messages are sent where permitted, with controls to opt out. We strictly follow channel policies and India-specific TRAI frameworks.
13. Children
Our Platform is not directed to children under eighteen (18). We do not knowingly collect personal data from minors for contract formation. If you believe we have improperly collected a minor's data, contact us for prompt deletion.
14. Automated processing
We may use rules-based systems for fraud scoring, dynamic pricing, and delivery partner matching. We do not make solely automated decisions with legal effects without human review where required by law.
15. Fair processing notice
GVD Soni's Cafe processes personal data fairly and for specified purposes. Where consent is the basis, we seek clear, informed, opt-in consent and allow withdrawal as described in this Policy.
16. Changes to this Policy
We may update this Policy to reflect legal, technical, or business changes. Material updates will be communicated by email or in-app notice. The "Last updated" date at the top of this page will change when we publish revisions.
17. Contact
Grievance Officer & Nodal Contact (Data Protection): privacy@justgvd.com.
Legal notices may also be routed to our corporate registered addresses.