Your privacy at Chatpata Express

Chatpata Express is a chaat and street-food kitchen in Gomti Nagar, Lucknow. We take orders on our website chatpataexpress.com and in the Chatpata Express app, cook them to order and deliver them nearby. This policy explains what personal data we collect when you use either, why, who sees it, and the choices you have.

• Your account: your name, email address, mobile number and a password (stored only as a one-way hash), and the consent you gave at sign-up (date, time and IP address).
• Delivery addresses: the address you type (house / flat, street, landmark, a label such as Home or Work) and the point you pin on the map, so the rider reaches your door and we can tell how far you are from our kitchen.
• Your location (only if you allow it): the app can read your phone’s location to fill in your delivery address and show whether we deliver there. It is read while you use the app, never in the background, and is not stored unless you save it as an address.
• Orders: the dishes, quantities, prices, your note for the kitchen, the delivery name and phone, the time of each step (placed, accepted, ready, out for delivery, delivered or cancelled) and, if you cancel, the reason you give.
• Profile photo (only if you add one): the one photo you take or choose for your account in the app. We keep a small square copy to show on your profile; you can change or remove it any time in Profile → Profile photo.
• Messages: what you write to us in an order’s chat or the support chat, and our replies.
• Notifications: a notification address for your phone (from Google Firebase / Expo) so we can tell you your order’s progress and our replies.
• Technical data: if the app crashes, a short report (the error, the screen, the app version and your phone’s system) helps us fix it. Our servers keep ordinary access logs, and the website uses a few first-party cookies to keep your cart and your sign-in — no advertising trackers.

You pay the rider in cash or by UPI when your food arrives, or — on the website — online through our payment partner Razorpay, who handles the payment; we receive only whether it succeeded and its reference. We do not collect or store any card, bank or UPI details. We do not read your contacts, or the photos and messages on your phone (only a photo you choose yourself for your profile), and we do not sell your data.

• to create and secure your account and let you sign in;
• to take, cook, deliver and support your orders, and to tell you how each order is going;
• to answer your messages and complaints;
• to check that an address is inside our delivery area and estimate the delivery time;
• to keep records the law requires (for example, tax records of orders);
• to improve the menu and the app (for example, which dishes sell, and fixing crashes).

Our kitchen team and delivery staff see what they need to prepare and deliver an order: your name, the delivery phone number and address, the dishes and your note.

Service providers who run parts of the service for us, under confidentiality: our hosting and website platform, Google Firebase and Expo (notification delivery), Google’s Gmail (our order and account emails), Razorpay (online payments on the website), and map tiles and place names (OpenStreetMap-based services). They may process data only to provide that service.

We disclose data to authorities only when the law requires it. We never sell or rent your personal data.

• your account and saved addresses — until you delete your account;
• orders — as long as tax and accounting law requires (generally up to 8 years), even after an account is deleted, without your contact details where the law allows;
• chats — until you delete your account;
• crash reports and server logs — a few months.

You can change your name, phone, profile photo and addresses in the app at any time, turn off notifications or location in your phone’s settings, and ask us for a copy of your data or to correct it.

You can delete your account in the app (Profile → Delete my account) or without the app — see Delete your account. You may withdraw your consent at any time; we will then stop using your data except where the law requires us to keep it. These rights follow India’s Digital Personal Data Protection Act, 2023.

Data travels over encrypted connections (HTTPS). Passwords are stored only as hashes, sign-in sessions are signed, and access to orders is limited to our team. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

Accounts are for people aged 18 or over. A younger person may order only with a parent or guardian.

If we change what we collect or how we use it, we will update this page and the date at the top, and tell you in the app if the change is significant.

Chatpata Express, Gwari, Vikas Khand 4, Gomti Nagar, Lucknow – 226010.

Email: chatpataexpresslucknow@gmail.com · Phone: +91 70078 70993

Grievance Officer — write to the email above with the subject “Grievance”. A complaint is acknowledged within 24 hours and resolved within 15 days.