Privacy Policy

Last updated: 17 October 2026

BachatBites ("we", "us") is a local delivery app in Sambalpur, currently delivering food from local hotels (restaurants). It is run by BACHATBITES, a sole proprietorship of Sayed Abdul Karim, Sambalpur, Odisha, India. This policy explains what information the BachatBites app and this website collect, why, who it is shared with, and the choices you have.

1. Information we collect

Everyone who signs in

• Phone number, to sign you in with a one-time password (OTP).
• Name, and optionally an email address and profile photo.
• Device push token, to send order updates as notifications.

Customers

• Delivery addresses, including the map location you pick and a contact phone number.
• Orders: items, hotels, amounts, order status and reviews you write.
• Payments are processed by Razorpay. We receive the payment status and reference IDs. We never see or store your card, UPI PIN or bank login details.
• Chat messages and photos you send to your delivery partner about an order.

Delivery partners

• Precise location, only while a delivery trip is under way: from tapping "Going to this hotel" until the order is delivered. It is used to show the customer where their order is, estimate the arrival time and detect arrival at the hotel and the customer's door. While a trip is active the app shows a persistent "Delivery on" notification, and location may be collected when the app is in the background (for example while you use Google Maps for navigation). It stops when the trip ends.
• Delivery proof photos you take when handing over an order.

Hotel owners

• Hotel name, address, map location, phone numbers, opening hours, menu and photos.

Technical data

• Crash reports and error logs (device model, OS version, app version, the screen or request that failed), to find and fix bugs.

2. How we use it

• To create your account and sign you in.
• To take, prepare, deliver and track your orders, and to let you contact the other party about an order.
• To process payments and refunds.
• To send notifications about your orders.
• To handle complaints, prevent fraud and misuse, and keep the service working.

We do not sell your personal information and we do not use it for advertising.

3. Who we share it with

• The people in your order: the hotel sees what you ordered, not your name, phone or address. The delivery partner sees your initials and order code (not your full name), your delivery address and map location, and the contact phone you give for delivery, so they can find you and call you. You see your delivery partner's name and live location during the trip.
• Service providers that run parts of the app for us, only for that purpose: Razorpay (payments), Google (Maps, routes and travel times, Firebase push notifications), Meta (WhatsApp OTP messages) and our SMS provider (OTP messages), Cloudinary (photo storage), Sentry (crash reports), and our hosting and database providers (Railway, Neon).
• Authorities, when the law requires it.

4. How long we keep it

• Chat messages and photos: 15 days after the delivery (longer only while a complaint about that chat is open). They are stored encrypted.
• Delivery partner location trail: 15 days, then deleted.
• Orders and payment records: as long as accounting, tax and legal rules require.
• Account details and addresses: until you delete your account.

5. Your choices and rights

• You can edit or delete saved addresses in the app.
• You can turn off notifications and location permission in your phone's settings. Delivery partners need location on during a trip to deliver orders.
• You can ask for a copy of your data, a correction, or deletion of your account by emailing bachatbites@gmail.com. You can also delete your account yourself in the app: Profile → Delete account.
• You can nominate another person to use these rights for you if you die or become unable to.
• If you have a complaint about how we handle your data, contact our Grievance Officer below first. If it isn't resolved, you can approach the Data Protection Board of India.

6. Security

Data is sent over encrypted connections (HTTPS). Access is limited to the people who need it to run the service. No system is perfectly secure, but we work to protect your information.

7. Children

BachatBites is not meant for children under 18, and we do not knowingly collect their data.

8. Changes

We may update this policy. The date at the top shows the latest version. Important changes will be shown in the app.

Contact & Grievance Officer