This Privacy Policy explains how Dwinsome Food Private Limited
("Dwinsome", "we", "us", "our") — the company that operates the
Cravitoo brand — collects, uses, shares, retains and protects Personal Data when you use the
Cravitoo mobile application (the customer / employee app, com.cravitoo.app) and the
Cravitoo Partner mobile application (the vendor / partner app, com.cravitoo.partner),
together with any related services and websites (collectively, the "Services").
By using the Services, you acknowledge that you have read and understood this Privacy Policy. This policy is issued under and complies with the Digital Personal Data Protection Act, 2023 (India) ("DPDP Act"), the Information Technology Act, 2000 and the rules made thereunder (including the SPDI Rules, 2011), and, where applicable, the EU/UK GDPR.
Under the DPDP Act, Dwinsome Food Private Limited is the Data Fiduciary for Personal Data processed through the Services. Under the GDPR (where it applies), Dwinsome is the Data Controller.
This policy applies to Personal Data we collect when you download, install or use the Cravitoo or Cravitoo Partner mobile app; sign in via OTP or email; browse cafeterias, vendors and menus; place, pay for, or pick up food orders; receive push or email notifications from us; contact us for support; or use the Cravitoo Partner app to accept and fulfil orders as a vendor.
It does not cover data practices of your employer, your cafeteria vendor, or third-party services we integrate with — each has its own privacy policy.
| Category | Examples | Where captured |
|---|---|---|
| Identity data | Full name, employee ID (if shared by your employer), phone number, email address | Sign-up, profile screen |
| Employer / site link | Corporate client, city, site, cafeteria you are entitled to order from | Provisioned by your employer's admin |
| Order data | Items ordered, quantities, special instructions, pickup counter, order status | Cart, checkout, order history |
| Payment metadata | Amount, currency, order reference, Razorpay payment ID, refund status. We do NOT store card numbers, UPI PINs, CVVs or wallet passwords — those are handled directly by Razorpay | Checkout |
| Feedback / ratings | Star rating, free-text comments on orders and vendors | Feedback screen |
| Support content | Emails, chat messages you send to info@cravitoo.com | Email / in-app support |
| Category | Examples |
|---|---|
| Device data | Device model, OS version, app version, install ID, locale, timezone |
| App usage / diagnostics | Screens viewed, orders placed, error logs, crash reports |
| Push token | Expo push token issued to your device, used only to deliver order status notifications |
| Network data | IP address at the time of API requests, used only for rate-limiting, fraud prevention and abuse detection |
We do not collect precise or coarse location, contacts, SMS, call logs, media library contents, biometric data, advertising identifiers (IDFA / GAID), or sensitive personal attributes such as health, sexual orientation, caste, religion or political data. We do not store camera frames or photos.
The vendor app uses your device camera only to scan customer pickup QR codes. The decoded QR token is sent to our backend to mark an order as "picked up". No photos, video frames or camera streams are transmitted or stored by us.
The Services are intended for adult employees at partner corporate sites. We do not knowingly collect Personal Data from anyone under 18. If you believe a minor has provided us data, email info@cravitoo.com and we will delete it.
Under the DPDP Act, our legal basis for processing is your consent (obtained when you sign up) and, in a limited set of cases, legitimate uses (performance of contract, legal compliance, response to a medical emergency).
| Purpose | Data used | DPDP basis | GDPR basis |
|---|---|---|---|
| Authenticate you (OTP login, session refresh) | Phone/email, OTP, JWT | Consent + performance of contract | Art. 6(1)(b) |
| Show cafeterias / vendors / menus you're entitled to | Employer/site link | Consent + contract | Art. 6(1)(b) |
| Take, prepare, fulfil and reconcile your orders | Order data, payment metadata | Consent + contract | Art. 6(1)(b) |
| Send order status push and email updates | Push token, email | Consent + contract | Art. 6(1)(b) |
| Provide customer support | Support content, order data | Consent + legitimate interest | Art. 6(1)(f) |
| Improve reliability, prevent fraud and abuse | Device / network / diagnostics | Legitimate use — fraud prevention | Art. 6(1)(f) |
| Comply with legal, tax, accounting and audit obligations | Transaction records | Legal obligation | Art. 6(1)(c) |
| Anonymised analytics (aggregated) | Order counts, item popularity | Legitimate use | Art. 6(1)(f) |
We do not use your Personal Data for advertising, cross-context tracking, profiling, selling to data brokers, or automated decisions with legal or similarly significant effects.
| Recipient | Purpose | Data shared |
|---|---|---|
| Your employer / corporate admin | Confirm you are an authorised employee, reconcile invoices | Name, email, employee ID, order totals — not individual item choices |
| Your cafeteria vendor (via Cravitoo Partner app) | Prepare and hand over your order | First name, order items, pickup token — not phone / email |
| Razorpay Software Private Limited | Process payments and refunds | Order amount, order reference, name, email |
| Resend Inc. | Deliver transactional email (OTP, receipts) | Email address, message content |
| Expo (650 Industries, Inc.) | Deliver push notifications, host OTA updates | Expo push token, device metadata |
| MongoDB, Inc. (Atlas) | Managed database hosting | All server-side application data |
| Legal, tax, audit advisors | Compliance, statutory audit | Only as strictly necessary |
| Government authorities / courts | Only when compelled by valid legal process | Only as strictly required |
Some processors (MongoDB Atlas, Resend, Expo) may store data outside India. We transfer Personal Data outside India only to countries and entities that are not restricted by a notification of the Central Government under the DPDP Act, and, for GDPR data subjects, only under Standard Contractual Clauses or an adequacy decision.
| Data | Retention |
|---|---|
| Account profile (name, email, phone, site link) | Life of your account + 30 days after deletion request |
| Order and payment records | 8 years from order date (Indian tax and accounting laws) |
| Feedback / ratings | 3 years from submission |
| Support emails and chats | 3 years from ticket closure |
| Server access logs (IP, request path) | 90 days |
| Crash / diagnostic logs | 30 days |
| Push tokens | Until you uninstall the app or disable notifications |
In-app data rights already shipped: Profile → Download my data returns a JSON export of
your account, orders, feedback and notification preferences. Profile → Delete my account runs a 10-second
countdown + type-DELETE confirmation and then deletes your account and Personal Data (subject to Section
7 retention). You can also exercise any right by emailing info@cravitoo.com.
We apply reasonable security safeguards, including TLS 1.2+ in transit, encryption at rest for the MongoDB Atlas cluster, hashed OTPs, short-lived JWT access tokens and rotating refresh tokens, SecureStore (iOS Keychain / Android Keystore) for tokens on device, role-based access control for internal staff, and regular dependency and security reviews. If we become aware of a breach that is likely to result in significant harm, we will notify the Data Protection Board of India and affected users as required by the DPDP Act.
The mobile apps do not use browser cookies. On cravitoo.com we use only strictly necessary cookies; if any analytics or preference cookies are introduced in the future, we will update this policy and, where required, obtain your consent.
We may update this Privacy Policy from time to time. Material changes are notified in-app or by email at least 7 days before they take effect. The current version is always at https://cravitoo.com/privacy.
grievance@cravitoo.com alias is recommended — see still_needed.md)If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India (once operational) or, if the GDPR applies to you, with the supervisory authority of your habitual residence.
Email (all questions, all rights requests): info@cravitoo.com
Address: Dwinsome Food Private Limited, Pune, Maharashtra, India
Website: https://cravitoo.com
You can copy this document, print it, or request an alternate format by writing to
info@cravitoo.com.