1 Scope & Preamble
VITRO Technologies Private Limited ("VITRO", "Company", "we", "our", or "us") operates a multi-vertical on-demand technology ecosystem comprising the VITRO Customer App, VITRO Merchant Partner App, VITRO Rider Partner App, and associated web properties.
We consider user privacy and data security foundational to our service. This Privacy Policy sets forth our mandatory data handling practices under the Digital Personal Data Protection (DPDP) Act, 2023 (India), the Information Technology Act, 2000 (along with the Sensitive Personal Data or Information Rules, 2011), the General Data Protection Regulation (GDPR), and Google Play Store and Apple App Store user data safety policies.
2 Data Taxonomy & Categories Collected
We limit data collection to the absolute minimum necessary to fulfill our contracts with you. The categories of data processed include:
| Data Category | Specific Data Points | Primary Purpose |
|---|---|---|
| Identity Data | Full Name, Mobile Number, Email Address, Profile Avatar | Account authentication, OTP verification, customer support, and user profile management. |
| Spatial & Geolocation | Real-time GPS coordinates (latitude, longitude), geocoded addresses, route vectors | Store proximity matching, turn-by-turn navigation, geofenced OTP validation, and rider dispatch. |
| Transaction & Financial | Order records, transaction reference IDs, UPI UTR numbers, Wallet balance | Order settlement, automated refunds, billing reconciliation, and anti-fraud auditing. |
| Partner KYC & Vetting | Driving License, Vehicle Registration (RC), Aadhaar verification, Store FSSAI/GST certificates | Mandatory regulatory compliance, criminal background vetting, and transport safety assurance. |
| Technical Telemetry | Device OS, app build version, IP address, push notification tokens (FCM/APNS) | Push alerts for order tracking, crash reporting, API rate limiting, and brute-force intrusion defense. |
3 Legal Grounds for Processing
Under applicable data protection frameworks, we process your personal data under the following legitimate grounds:
- Contractual Performance: Necessary to match, execute, route, and deliver your food, grocery, ride, or courier request.
- Explicit Consent: Granted by you when enabling device permissions (e.g., GPS background location, push notifications, camera for QR code scanning).
- Legal Obligation: Necessary to comply with tax laws, transport safety regulations, fraud prevention statutes, and lawful law enforcement requests.
- Vital Interests & Emergency Safety: In urgent situations involving passenger or driver road safety, sharing real-time ride tracking with designated emergency contacts.
4 Precise Location & Geofencing Policies
Precise location is critical to the operation of an on-demand logistics network. We operate under strict spatial minimization rules:
- Customer App: Location coordinates are requested solely during app active use to present nearby serviceable stores and deliver to your doorstep. We do not track customer location in the background when the app is closed.
- Rider Partner App: Location tracking operates while the rider is marked "On-Duty" to assign nearby pickup orders and provide passengers with live turn-by-turn ETA. Riders can toggle "Go Offline" at any time to immediately cease telemetry broadcasting.
- Geofenced Handshake: To protect merchants and consumers from false status updates, order arrival at store and customer doorstep requires a 300-meter GPS radius validation before status transitions are permitted.
5 Data Retention & Automated Purge Cycles
We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy:
- Live Telemetry & GPS Breadcrumbs: Active ride and delivery breadcrumbs are downsampled and converted to aggregated distance records within 90 days of order completion.
- Order & Financial Records: Retained for 7 years in compliance with Indian taxation, GST, and corporate audit statutes.
- Authentication Tokens & Sessions: Mobile JWT session tokens expire automatically within 30 days of inactivity; Redis rate-limit tokens expire within 5–15 minutes.
- Partner KYC Archives: Maintained for the duration of the partner's active platform contract plus statutory limitation periods for road liability.
6 Technical & Organizational Security
VITRO implements defense-in-depth security controls reviewed against the OWASP Top 10 and ISO 27001 guidelines:
- Data in Transit: 100% of network traffic enforced via TLS 1.3 with HSTS (HTTP Strict Transport Security) and strong cipher suites.
- Data at Rest: MongoDB databases and backup snapshots are encrypted using AES-256 bit hardware-level encryption.
- Credentials: Passwords are one-way hashed using
bcryptwith 12 salt rounds. Secret keys and JWT signing credentials utilize distinct per-role secrets. - Dual OTP Handshake: Pickups and deliveries utilize cryptographically generated 4-digit codes with timing-safe comparison to prevent theft and unauthorized deliveries.
7 Third-Party Sub-Processors & Data Sharing
To provide high-availability infrastructure, VITRO contracts with SOC-2 and ISO-27001 certified sub-processors under strict Data Processing Agreements (DPAs):
- Cloud Infrastructure: MongoDB Atlas (Database), Cloudflare (CDN & Edge Security), AWS (Cloud Computing).
- Payment Processing: Razorpay Software Pvt. Ltd. (RBI-authorized Payment Aggregator, PCI-DSS Level 1 compliant).
- Mapping & Routing: MapLibre, OpenStreetMap, and OSRM for privacy-friendly geospatial road routing.
- Communication & SMS: Firebase Cloud Messaging (Google) for transactional push alerts; Telecom-authorized SMS gateways for login OTPs.
8 User Rights & Statutory Account Deletion (DPDP Act 2023)
In strict compliance with the Digital Personal Data Protection (DPDP) Act, 2023 (Section 12 - Right to Correction and Erasure of Personal Data), Information Technology (IT) Rules, and international privacy standards, VITRO guarantees every Data Principal (Customer, Delivery Partner, and Merchant Partner) comprehensive control over their personal data:
- Right to Access & Portability: You can inspect and obtain a machine-readable summary of your profile and transaction records directly via your app profile or by contacting our data protection team.
- Right to Rectification: Edit or update inaccurate phone numbers, names, locations, and bank payout credentials in your respective app settings.
- Right to Erasure ("Right to be Forgotten"): You have the statutory right to request permanent deletion and withdrawal of consent for personal data processing.
How to Request Account Deletion in VITRO Applications
To ensure seamless user self-service, a dedicated "Request Account Deletion" action is integrated directly inside all VITRO mobile applications:
Administrative Verification & Data Scrubbing Procedure
Upon submitting a deletion request, the application places the account into an audited pending queue:
- Settlement & Operational Clearance (48–72 Business Hours): An administrative compliance check verifies that there are no active in-flight deliveries, pending customer refunds, unsettled merchant payouts, or ongoing safety/fraud investigations.
- Irreversible Anonymization & De-identification: Upon administrator approval, personal data points (name, phone number, email address, physical delivery coordinates, KYC documents, avatar images) are scrubbed and replaced with non-reversible cryptographic hashes (e.g.
anon_user_xxxx). - Immediate Session Revocation: All authentication tokens, device access permissions, and cloud push notification tokens (FCM) are permanently invalidated, immediately logging the user out across all devices.
- Statutory Financial Records Exemption: In compliance with Section 194-O of the Indian Income Tax Act, Goods and Services Tax (GST) rules, and Prevention of Money Laundering Act (PMLA), bare transactional ledger entries are retained in strictly pseudonymized form for the mandatory statutory limitation period, completely disconnected from personal identifiers.
9 Grievance Redressal & Data Protection Officer
Pursuant to Section 5(9) of the Digital Personal Data Protection Act, 2023 and Rule 5(9) of the Information Technology Rules, 2011, the details of our designated Grievance Redressal Officer are as follows:
Grievance & Data Protection Officer
VITRO Technologies Private Limited