Privacy Policy - Enything

1. Data Controller

The data controller for your personal information is Enything, a sole proprietorship owned by Muhtaashim Kamran Nazki, located at Plan Bandipora, Ward No. 2, Bandipora, Jammu & Kashmir — 193502, India. For data-related queries, contact: support@enything.in.

2. Data We Collect

We collect: (a) Identity data — name and phone number provided at registration; (b) Location data — your GPS coordinates to enable hyper-local delivery; (c) Order data — items ordered, delivery address, payment reference IDs; (d) Device data — device type, OS version, and app version for troubleshooting.

3. How We Use Your Data

Your data is used to: process and deliver your orders; send transactional SMS/push notifications; resolve support tickets; improve platform quality; and comply with Indian tax and legal obligations.

4. Payment Data & PCI DSS

We do not store, process, or transmit any payment card details directly. All payment data is handled by Razorpay Software Private Limited under PCI DSS Level 1 compliance. We only retain the Razorpay payment reference ID and order ID for reconciliation purposes.

5. Data Sharing

Your information is shared on a need-to-know basis: Seller receives your name, delivery address, and phone number to prepare and hand over your order; Delivery Partner receives your name, live delivery location, and phone number to complete delivery; Razorpay receives order amount and reference for payment processing; Indian tax authorities receive transaction data as required by law. We do not sell your data to any third party for marketing.

6. Data Retention & Account Deletion

We retain your account data for as long as your account is active. Order records are retained for 7 years as required by Indian accounting standards. You may delete your account and associated personal data at any time directly within the app under Profile Settings > Delete Account, or by emailing support@enything.in. Initiating deletion permanently removes your profile, saved addresses, and credentials.

7. Your Rights

You have the right to: access the personal data we hold about you; correct inaccurate data; request deletion of your account and data (subject to legal retention requirements); withdraw consent for marketing communications at any time. To exercise these rights, contact support@enything.in.

8. Security

We use industry-standard encryption (TLS 1.2+) for all data in transit. Our backend infrastructure is hosted on Supabase, which is SOC 2 Type II certified. Access to your data is restricted to authorised personnel only.