Privacy Policy

01Information We Collect

We only collect information that is necessary to operate the App and provide the features you use. The table below summarises every category of personal data the App collects, why it is collected, and where it is stored.

Information you choose to provide

Some information is collected only when you actively choose to use related features — for example, your saved delivery addresses, dietitian booking notes, support chat messages, and feedback submitted through the App.

02How We Use Your Information

We use your information for the following purposes only:

• Providing the service — placing and tracking orders, calculating delivery, processing payments via Razorpay, and sending order status notifications.
• AI features — analysing food photos via Google Gemini to estimate calories and provide nutrition insights.
• Health tracking — saving your daily calorie intake, water-glass count, and progress charts so you can review them later.
• Account security — authenticating sign-ins, detecting suspicious activity, and enabling secure account deletion.
• Communication — sending order status notifications, water-drink reminders you have opted into, and (only if you have not opted out) promotional offers from Intraeats.
• Improvement — diagnosing crashes and improving the reliability of the App.
• Legal compliance — when required to comply with applicable laws or respond to lawful requests by public authorities.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

03Legal Basis for Processing

Under the DPDP Act 2023, we process your personal data on the following lawful grounds:

• Your consent — given at signup (acceptance of this Privacy Policy) and again whenever the App requests a sensitive permission such as location, camera, or notifications. Your consent timestamp is recorded.
• Performance of contract — processing necessary to fulfil orders you place and deliver food to you.
• Legal obligation — retention of records as required by applicable Indian law (notably the Income Tax Act, 1961 and Central Goods and Services Tax Act, 2017, which require certain transactional records to be preserved).

You may withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

04Third-Party Services and Data Processors

The App relies on the following third-party services. Each is bound by its own privacy policy, which we encourage you to review.

Firebase (Google LLC)

We use Firebase Authentication, Cloud Firestore, Firebase Storage, and Firebase Cloud Messaging to handle sign-in, store user data, and deliver notifications. Firebase is operated by Google LLC. Firebase privacy details.

Google Gemini API

When you scan food, the photo is sent to Google's Gemini Generative Language API for analysis. Per Google's policy, this data is processed to return a result and is not used to train Google's models for paid API users. Gemini API terms.

Razorpay

Online payments are processed by Razorpay Software Private Limited, a PCI-DSS-compliant payment gateway. Intraeats does not see or store your card, UPI, or net-banking credentials. Razorpay privacy policy.

OpenStreetMap

We use OpenStreetMap tiles to display the delivery tracking map. Your IP address may be visible to the OpenStreetMap tile server when map tiles are fetched. OpenStreetMap privacy policy.

05Sharing and Disclosure

We share your information only in these limited circumstances:

• Restaurant partners — your name, phone number, items ordered, and delivery address are shared with the partnered restaurant preparing your order.
• Delivery partners — your name, phone number, and delivery address are shared with the assigned delivery partner so they can complete delivery and contact you if needed.
• Dietitian partners — when you book a dietitian consultation, your health profile is shared with the assigned dietitian solely to enable them to prepare for and conduct your session.
• Service providers — the third parties listed in Section 4, strictly to operate the App's features.
• Legal requirements — when required by law, court order, or a competent government authority in India.
• Business transfers — in the event of a merger, acquisition, or asset sale, your data may be transferred to the new entity, subject to the same protections as described in this policy.

06Data Retention

We retain your data only as long as it is needed for the purpose for which it was collected. The table below lists every category and the corresponding retention period.

07Security

We take reasonable technical and organisational measures to protect your personal data, including:

• All network traffic is encrypted using HTTPS / TLS 1.2+.
• Authentication is handled by Firebase Authentication; passwords are never stored in plaintext.
• Cloud Firestore security rules enforce that each user can read or write only their own data.
• Payment credentials are processed by Razorpay (PCI-DSS Level 1 certified) and never reach our servers.
• Health data is stored in a per-user private document not accessible by other users.
• Access to production Firebase data is restricted to authorised personnel.

No method of electronic storage is 100% secure. Please notify us immediately at privacy@intraeats.in if you believe your account has been compromised.

08Your Rights Under the DPDP Act

Under India's Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to access — request a summary of the personal data we hold about you.
• Right to correction — request correction of inaccurate or incomplete data. You can edit most information directly in the App under Profile → Edit Profile.
• Right to erasure — request deletion of your personal data via the in-app "Delete Account" option (see Section 9).
• Right to grievance redressal — raise concerns with our Grievance Officer (see Section 14). We will respond within 30 days.
• Right to nominate — nominate another individual to exercise your data rights on your behalf.
• Right to withdraw consent — withdraw any consent you have previously given.

To exercise any of these rights, contact our Grievance Officer using the details in Section 14.

09Account Deletion

You can delete your Intraeats account at any time directly from inside the App:

1. Open the App and go to Profile → Settings.
2. Scroll to the Account section and tap Delete Account.
3. Confirm the deletion in the dialog that appears.

When you delete your account, the following data is permanently removed:

• Your user profile (name, email, phone number, saved addresses)
• Your health profile and daily calorie history
• Your food scan logs
• Your water reminder preferences and glass-count history
• Your personal order history
• Your dietitian booking history
• Your used coupon records
• Your Firebase Authentication account (sign-in credentials)

If you are unable to access the App, you may request deletion by emailing privacy@intraeats.in from your registered email. We will process your request within 7 business days.

An overview of the deletion process is also published at https://intraeats.in/delete-account.html.

10Children's Privacy

The App is intended for users aged 18 and above. At signup, every user is required to confirm that they are 18 or older. We do not knowingly collect personal data from anyone under 18.

If you are a parent or guardian and believe that a child under 18 has provided personal data, please contact us at privacy@intraeats.in and we will delete the information promptly.

11App Permissions

The App requests the following Android permissions. Each is requested only when the related feature is first used. You may deny or revoke any permission via Settings → Apps → Intraeats → Permissions.

Revoking a permission will disable the related feature but will not affect other parts of the App.

12Cross-Border Data Transfers

Some of our processors (Google Firebase, Google Gemini API, Razorpay) may store or process data on servers located outside India. When data is transferred outside India, we ensure that the receiving processor provides protection comparable to the DPDP Act, in line with Section 16 of the Act.

13Changes to This Policy

We may update this Privacy Policy from time to time. The "Effective date" at the top will always indicate the latest version.

For material changes, we will provide at least 14 days' advance notice through an in-app notification before changes take effect.

Your continued use of the App after the effective date constitutes acceptance. If you do not accept the changes, you may delete your account before the effective date.

14Contact & Grievance Officer

If you have questions about this Privacy Policy, wish to exercise your rights, or want to raise a grievance, please contact our Grievance Officer.

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India as constituted under the DPDP Act, 2023.