Privacy Policy - Enything

1. Data Controller

The data controller for your personal information is Enything, a sole proprietorship owned by Muhtaashim Kamran Nazki, located at Plan Bandipora, Ward No. 2, Bandipora, Jammu & Kashmir — 193502, India. For data-related queries, contact: support@enything.in.

2. Data We Collect

We collect: (a) Identity data — name and phone number provided at registration; (b) Location data — your GPS coordinates to enable hyper-local delivery; (c) Order data — items ordered, delivery address, payment reference IDs; (d) Device data — device type, OS version, and app version for troubleshooting.

3. How We Use Your Data

Your data is used to: process and deliver your orders; send transactional SMS/push notifications; resolve support tickets; improve platform quality; and comply with Indian tax and legal obligations.

4. Payment Data & PCI DSS

We do not store, process, or transmit any payment card details directly. All payment data is handled by Razorpay Software Private Limited under PCI DSS Level 1 compliance. We only retain the Razorpay payment reference ID and order ID for reconciliation purposes.

5. Data Sharing

Your information is shared on a need-to-know basis: Seller receives your name, delivery address, and phone number to prepare and hand over your order; Delivery Partner receives your name, live delivery location, and phone number to complete delivery; Razorpay receives order amount and reference for payment processing; Indian tax authorities receive transaction data as required by law. We do not sell your data to any third party for marketing.

6. Data Retention

We retain your account data for as long as your account is active. Order records are retained for 7 years as required by Indian accounting standards. You may request account deletion by emailing support@enything.in; this will anonymise your personal data within 30 days while retaining transaction records for legal compliance.

7. Your Rights

You have the right to: access the personal data we hold about you; correct inaccurate data; request deletion of your account and data (subject to legal retention requirements); withdraw consent for marketing communications at any time. To exercise these rights, contact support@enything.in.

8. Security

We use industry-standard encryption (TLS 1.2+) for all data in transit. Our backend infrastructure is hosted on Supabase, which is SOC 2 Type II certified. Access to your data is restricted to authorised personnel only.