• Full name, email address, and phone number
• Delivery addresses and location preferences
• Payment information is handled exclusively by our PCI-DSS compliant payment partner, [Razorpay / PayU / Cashfree]. We do not store your card number, CVV, or net banking credentials on our servers.
  
  For UPI-based payments, we collect and transmit your UPI Virtual Payment Address (VPA) to our payment partner solely for the purpose of processing your transaction. This information is not stored beyond the transaction window and is not used for any other purpose.
• Order history and preferences
• Profile photo (optional)

• Device type, operating system, and app version
• IP address and general location data
• Usage patterns, session duration, and feature interactions
• Crash reports and diagnostic data

• Process and fulfill your orders
• Send order confirmations, updates, and delivery notifications
• Improve app performance and personalize your experience
• Offer relevant promotions and loyalty rewards
• Detect and prevent fraud or unauthorized activity
• Comply with legal obligations

We send push notifications to your device for the following purposes:

• Order Confirmations: Status updates on your order (confirmed, preparing, out for delivery, delivered)
• Delivery Alerts: Real-time updates from your delivery rider
• Promotional Offers: Discount codes, seasonal offers, and loyalty rewards (only with your consent)
• App Updates: Important announcements or policy changes

You may manage your notification preferences at any time through the App Settings under 'Notifications' or your device's operating system notification settings. Disabling promotional notifications will not affect transactional notifications related to active orders.

• Delivery riders — name, phone, and delivery address only for order fulfillment
• Payment processors for secure transaction handling
• Cloud service providers and analytics partners under strict confidentiality agreements
• Law enforcement or regulatory authorities when required by law

Your personal data may be stored and processed on servers located outside India through our cloud infrastructure and analytics partners (such as [Provider Name, e.g., Amazon Web Services / Google Cloud]). These providers are bound by contractual obligations to maintain the confidentiality, integrity, and security of your data.

All cross-border transfers are conducted in compliance with the Digital Personal Data Protection Act, 2023 and applicable rules. By using this App and providing your personal data, you consent to such transfers. We will only transfer your data to countries that provide an adequate level of data protection or where appropriate contractual safeguards are in place.

The App requests access to your device location to suggest nearby café branches, enable accurate delivery, and estimate delivery times.

You may disable location access in device settings, though this may limit some App features. We do not track your location when the App is not in use.

We retain your personal data for as long as your account is active or as required to fulfil the purposes outlined in this Policy. Upon account deletion, your data will be removed within 30 days, except where retention is required by law.

How We Obtain Consent: When you register on the eChai App, we present a clear and specific consent notice describing what data we collect, the purposes of processing, and your rights. Your continued use of the App after reviewing this notice constitutes your consent.

Withdrawal of Consent: You have the right to withdraw your consent to data processing at any time. You may do so by accessing Privacy Settings within the App or by emailing us at echai.gps@gmail.com. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal. Certain core features of the App (such as order placement) may become unavailable upon withdrawal of consent, as they require your data to function.

You also have the right to:

• Access and review the personal data we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your account and associated data
• Opt out of marketing communications at any time
• Right to Complain: If you believe your data has been processed in violation of applicable law and your concerns have not been resolved to your satisfaction by our Grievance Officer, you may approach the Data Protection Board of India (DPBI) once it becomes fully operational, as provided under the Digital Personal Data Protection Act, 2023. Details of the DPBI and its complaint process will be published at www.meity.gov.in.

As a mobile application, we use software development kits (SDKs) and device-level identifiers rather than browser cookies to understand how you interact with the App.

Tracking Technologies We Use:

• Analytics SDKs (e.g., Firebase Analytics, Mixpanel): To track feature usage, session duration, and app performance
• Crash Reporting SDKs (e.g., Firebase Crashlytics): To detect and fix app crashes
• Advertising IDs: Google Advertising ID (GAID) on Android or Identifier for Advertisers (IDFA) on iOS, used for understanding ad effectiveness

You may limit ad tracking by limiting it on Android (Settings > Privacy > Ads > Opt out of Ads Personalisation) or iOS (Settings > Privacy > Tracking > Disable tracking for this App). Disabling these identifiers may affect personalisation features but will not prevent core App functionality.

The eChai App may contain links to third-party websites, social media platforms, or partner services. This Privacy Policy applies solely to data collected by GPS ENTERPRISES and does not govern the privacy practices of any third party.

We encourage you to review the privacy policies of any third-party platforms you visit via links within our App. GPS ENTERPRISES accepts no responsibility or liability for the data practices of external sites or services.

We implement industry-standard security measures including SSL/TLS encryption, secure storage, and regular security audits to protect your data. However, no method of transmission over the internet is 100% secure.

The eChai Customer App is not intended for users under 13 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such data, please contact us immediately.

We may update this Privacy Policy periodically. The updated version will be posted within the App with a revised effective date. We encourage you to review this Policy regularly.

We aim to respond to all privacy-related enquiries within 30 working days.