Privacy Policy

1. Information we collect

We collect the following categories of personal data:

• Account details — your name, phone number, and email address used to sign in.
• Delivery addresses — the addresses you save to receive tiffin orders, including their map coordinates.
• Order & subscription data — items ordered, meal preferences, schedules, and order history.
• Payment & wallet data — your Tiffexx wallet balance and transactions. Wallet top-ups are processed by our payment partner (Razorpay); we do not store your full card, UPI, or bank credentials.
• Location data — while an order is out for delivery, we process the assigned delivery partner’s live location to show you order tracking. We access your device location only with your permission, to help you set a delivery address.
• Device & usage data — app version, device type, and diagnostic logs used to keep the service reliable.

2. How we use your data

• To create and manage your account and authenticate you.
• To process, prepare, deliver, and track your orders and subscriptions.
• To operate your Tiffexx wallet and process refunds.
• To provide customer support and respond to your tickets.
• To send transactional notifications about your orders (and, where you have not opted out, occasional service updates).
• To detect, prevent, and address fraud, abuse, and security issues.
• To comply with legal and tax obligations, including issuing GST invoices.

3. Sharing your data

We share personal data only as needed to run the service:

• Tiffin partners (kitchens) — receive the order details and delivery address needed to prepare and hand over your order.
• Delivery partners — receive your delivery address and contact details to complete the delivery.
• Payment partner — Razorpay processes wallet top-ups and refunds.
• Infrastructure providers — we host data with Supabase (managed Postgres, authentication, and storage). Push notifications are delivered via Firebase Cloud Messaging.
• Legal & regulatory authorities — where required by applicable law.

We do not sell your personal data.

4. Data retention

We retain your account and order data for as long as your account is active and as required to meet legal, tax, and accounting obligations. You may request deletion of your account at any time (see "Your rights"). Some records, such as GST invoices, are retained for the period mandated by law.

5. Security

Access to your data is enforced at the database level through row-level security, so you can only access your own records. Data is encrypted in transit. While no system can be guaranteed perfectly secure, we apply reasonable technical and organisational measures to protect your data.

6. Your rights

Subject to applicable law, you may:

• Access and review the personal data we hold about you.
• Correct inaccurate data (you can edit your name and addresses in the app).
• Request deletion of your account and associated personal data.
• Withdraw consent for optional processing, such as promotional notifications.

To exercise these rights, contact our Grievance Officer below.

7. Children

Tiffexx is not intended for use by children under 18. We do not knowingly collect personal data from children.

8. Changes to this policy

We may update this policy from time to time. Material changes will be notified in the app. Continued use of Tiffexx after an update constitutes acceptance of the revised policy.

9. Grievance Officer & contact

For any privacy questions or to exercise your rights, contact us:

• Email: privacy@tiffexx.com
• Phone: +91 92170 49217
• Address: Workwings, H-187, Sector 63, Noida, Uttar Pradesh – 201307, India