Privacy Policy

1. Information We Collect

When you create an account, place an order, or browse Lazy Biryani, we collect:

• Personal Information: Full name, verified email address, phone number, and delivery street address with landmark and PIN code.
• Order History: Meal kits purchased, quantities, billing amounts, order status, and transaction timestamps.
• Device & Geolocation Data: IP address and browser headers for security auditing. When you explicitly click "Use my location" at checkout, your device coordinates (latitude and longitude) are captured solely to reverse-geocode your address.

2. How We Use Your Information

• To cook, assemble, dispatch, and fulfill meal kit orders to your delivery address.
• To send transactional receipts, status updates, and support notifications.
• To prevent fraud, payment tampering, account takeover, and ensure platform security.

3. Payment Security & Financial Credentials

All online payments are processed through PCI-DSS Level 1 compliant bank checkout gateways (HDFC SmartGateway / Juspay Hypercheckout). Lazy Biryani and KMK Enterprises never ask for, collect, or store raw debit/credit card numbers, CVVs, expiry dates, net banking passwords, or UPI MPINs on our servers.

4. Third-Party Data Disclosures & Sub-Processors

We never sell, rent, or trade your personal data. We disclose information strictly to trusted sub-processors necessary for operations:

• OpenStreetMap Foundation (Nominatim): When you use the "Use my location" delivery autofill, coordinates are sent via encrypted HTTPS to nominatim.openstreetmap.org/reverse solely to identify your street and area name.
• HDFC Bank / Juspay: Order amount, customer identifier, and order ID are passed securely for processing payments.
• Supabase Inc.: Encrypted cloud database and authentication provider located in ISO 27001 / SOC 2 Type II compliant data centers.

5. Data Retention & User Rights (DPDP Act, 2023)

In compliance with India's Digital Personal Data Protection Act (DPDP Act, 2023):

• Retention Period: Active account data is retained for the lifetime of your account. Order financial transaction logs are retained for 3 years to comply with statutory taxation and accounting obligations under Indian commercial laws, after which they are permanently anonymized or deleted.
• Right to Access & Correction: You may view or update your delivery information and account details directly in the app.
• Right to Erasure / Account Deletion: You have the right to request deletion of your account and personal data. Send an email from your registered address to privacy@lazybriyani.com with the subject "Data Erasure Request". Deletion is processed within 7 business days.

6. Grievance Redressal Officer

For questions, concerns, or grievances regarding your personal data or compliance with the DPDP Act 2023, you may contact our designated Grievance Officer: