Privacy Policy

1. About this Privacy Policy

This Privacy Policy explains how Bakali ("Bakali", "we", "us" or "our") collects, uses, shares, stores and protects personal data when you use www.bakali.in, the Bakali mobile application, place an order, buy or manage a meal/juice plan, communicate with support, or otherwise interact with our services. It is intended for users in India and should be read together with our Terms and Conditions and Refund Policy.

2. Personal data we may collect

2.1 Information you provide

• Account information: mobile number, name, email address (if provided), OTP/authentication records and profile preferences.
• Delivery information: address, landmark, pincode, city, delivery instructions and saved address labels.
• Order and plan information: products ordered, quantities/variants, order history, subscription/plan details, credits, skips, pauses, cancellations, delivery status and support history.
• Payment-related information: payment method, transaction reference, payment status, amount and refund status. Full card credentials are normally handled by authorised payment service providers and are not intended to be stored by Bakali.
• Communications: messages, feedback, complaints, photos or videos you send when reporting a quality or delivery issue, and other customer-support records.
• Promotion and referral information: coupon use, campaign source, referral details and reward eligibility, where such features are offered.

2.2 Information collected automatically

• Device and app data such as device type, operating system, app version, language, IP address, crash logs, diagnostics and basic usage events.
• Approximate or precise location, only where you enable location permissions or use location-based address selection. You can change device permissions through your phone settings.
• Website cookies or similar technologies used for security, session management, analytics and performance, where applicable.
• Push-notification token and notification interaction data, when notifications are enabled.

3. Why we use your personal data

• To create and secure your account, send OTPs and authenticate you.
• To determine serviceability, route orders, prepare and deliver fresh fruits, vegetables, veg salads, healthy veg bowls and fresh juices.
• To process one-time orders, prepaid plans/credits, payments, COD reconciliation, refunds and customer-support requests.
• To communicate order confirmations, delivery updates, plan reminders, service notices and responses to your queries.
• To prevent fraud, misuse, duplicate promotions, unauthorised access and security incidents.
• To improve product discovery, app performance, service quality, delivery operations and customer experience using aggregated or appropriately limited analytics.
• To send promotional messages where permitted and where you have consented or can opt out under applicable law.
• To comply with legal, accounting, tax, consumer-protection and regulatory obligations, and to establish or defend legal claims.

4. Consent and other lawful processing

Where consent is required, we aim to present a clear notice describing the data requested and the purpose for which it will be used. You may withdraw consent through the relevant app setting, communication preference, device permission, or by contacting us. Withdrawal does not affect processing already lawfully carried out, and some services may no longer function where the data is necessary to fulfil an order or provide the service.

5. When we share personal data

• Delivery and fulfilment personnel, only to the extent needed to deliver your order and communicate about the active delivery.
• Payment gateways, banks and payment processors for payment authorisation, settlement and refunds.
• OTP, SMS, email and push-notification providers for authentication and service communications.
• Cloud hosting, database, cybersecurity, analytics, crash-reporting and technology vendors that support the app/website.
• Mapping/geocoding providers where location or address features are used.
• Professional advisers, auditors, insurers or service providers where reasonably necessary for business administration or legal compliance.
• Government, regulators, law-enforcement agencies, courts or other authorities where disclosure is required by law or lawful process.
• A successor or acquirer in connection with a lawful merger, acquisition, restructuring or transfer of business, subject to applicable safeguards.

We expect service providers to process personal data only for authorised purposes and to apply reasonable security measures. We do not authorise service providers to use your data for unrelated advertising.

6. Data storage, retention and security

• We retain personal data only for as long as reasonably necessary for the stated purpose, to provide services, resolve disputes, prevent fraud, maintain records and comply with legal obligations.
• Order, tax, payment and transaction records may be retained for longer periods where required by law or legitimate recordkeeping needs.
• We use reasonable administrative, technical and organisational safeguards designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. No online system can be guaranteed to be completely secure.
• Where data is processed or stored outside India, we intend to do so only as permitted by applicable law and subject to appropriate contractual/technical safeguards.

7. Your privacy rights

Subject to applicable law and the stage at which relevant provisions apply, you may have rights to:

• request information about the personal data we process and the purposes of processing;
• ask us to correct, complete or update inaccurate personal data;
• request erasure of personal data where there is no lawful reason to retain it;
• withdraw consent for consent-based processing;
• raise a grievance about how your personal data is handled; and
• nominate another individual to exercise applicable rights in the event of death or incapacity, where provided by law.

To make a privacy request, email info@bakali.in from the mobile number/email associated with your account. We may verify your identity before acting on a request.

8. Marketing and notifications

Transactional communications relating to account security, orders, delivery, refunds and active plans are necessary to provide the service. Promotional notifications, SMS, email or WhatsApp communications can be managed through available settings or opt-out mechanisms, where applicable. Disabling marketing does not stop essential service communications.

9. Children and minors

Bakali is a food-ordering service and is not designed to knowingly solicit personal data from children independently of a parent or lawful guardian. If a user is under the age at which they may validly consent or contract under applicable law, use of the service should be supervised/authorised by a parent or guardian. If you believe a child has provided personal data without required authorisation, contact us so we can review and take appropriate action.

10. Third-party services and links

The app or website may link to payment providers, mapping services, app stores, social platforms or other third-party services. Their privacy practices are governed by their own policies, and Bakali is not responsible for independent third-party practices.

11. Data breaches and incident response

If we become aware of a personal-data breach, we will assess the incident, take reasonable containment and remediation measures, and make notifications to affected users and/or competent authorities where required by applicable law.

12. Changes to this Privacy Policy

We may update this Privacy Policy to reflect service, technology or legal changes. The latest version will be posted on our website/app with the updated effective date. Where required, we will provide additional notice or seek fresh consent for material changes in processing.

13. Contact and grievance redressal