BiteFast Food Delivery — Privacy & Data Protection Policy

Sk Wasim Akram / Demoody (Sole Proprietorship), operating under the trade name and brand BiteFast (“Demoody”, “BiteFast”, “Company”, “We”, “Us”), operates an online technology marketplace intermediary connecting customers with independent restaurant merchants and freelance delivery partners. As a Data Fiduciary under the Digital Personal Data Protection Act, 2023, we are committed to upholding the privacy rights of all users across our website and mobile applications.

1. Personal Data We Collect

• Identity & Contact Data: Name, verified mobile phone number, email address, and saved delivery addresses with landmarks.
• Transactional Data: Order items, invoices, payment method used (UPI, Card, NetBanking, COD), and transaction reference IDs. Raw debit/credit card numbers and CVVs are NEVER stored.
• Support & Communications: Support chat transcripts, masked call logs, and customer feedback inquiries.
• Device Telemetry: Device model, OS version, unique device identifier (UUID), IP address, and push notification tokens.

2. Prominent Geolocation Disclosure (Google Play Console Compliance)

Customer Geolocation (Foreground Only): We collect precise and approximate GPS coordinates only while the app is actively in use to detect delivery addresses, display operating restaurants nearby, calculate delivery fees, and show live delivery progress.

Delivery Partner Geolocation (Background & Foreground): For Delivery Partners using the BiteFast Delivery Partner App, we collect continuous location data (ACCESS_BACKGROUND_LOCATION) even when the app is minimized, closed, or the screen is locked during active delivery shifts. This enables live order tracking for customers, automated order assignment to the nearest rider, accurate distance-based payouts, and emergency road assistance. Tracking ceases immediately when the rider toggles their shift to “Offline”.

3. Account Deletion & Data Retention (Google Play & App Store Compliance)

You have the absolute right to delete your BiteFast account and erase your personal data:

• In-App Deletion: Open BiteFast App → Profile → Settings → Delete My Account → Verify with OTP.
• Web Deletion Portal: Visit our dedicated automated web deletion page at https://demoody.in/delete-account.html.
• Email Deletion Request: Email privacy@demoody.in or bitefast@demoody.in with the subject "Account Deletion Request" from your registered email address.

Data Erased: Profile name, phone number, email, saved addresses, and device tokens are permanently wiped within 7 business days.
Data Retained: In compliance with Section 36 of the Central Goods and Services Tax Act, 2017, and the Income Tax Act, 1961, tax invoices and financial transaction ledgers are retained for the mandatory statutory period of 6 to 8 years.

4. Children's Privacy Protection (DPDP Act 2023 Sec 9)

BiteFast is not directed toward children under 18 years of age. We do not knowingly collect personal data from minors. We strictly prohibit tracking, behavioral profiling, or targeted advertising directed at children.

5. Data Storage Sovereignty & Security

In accordance with Indian regulatory mandates, all personal data is stored on secure, encrypted servers physically located within the Republic of India. We enforce TLS 1.3 encryption in transit, AES-256 encryption at rest, and strict role-based access control.

7. Data Protection Officer (DPO) & Grievance Redressal