Privacy Policy

• Direct Identifiers: Name, verified mobile phone number, delivery address, nearby landmarks, and optional email address provided during account creation and checkout.
• Geolocation Data: On-demand location coordinates collected strictly with explicit user consent to calculate storefront serviceability and pin delivery drop-off points. HaatKaro does not track background location when the app is closed. Delivery partner location is collected only during active dispatch sessions.
• Financial and refund information: Customer checkout currently accepts Cash on Delivery only. HaatKaro processes order and payment-status records, COD collection and refund reconciliation information, and may collect a customer's bank-account or UPI payment address only when needed for an approved refund, subject to appropriate verification and security. For merchants and delivery partners, HaatKaro collects verified bank or UPI payout details to make settlement payouts. HaatKaro does not ask customers to provide card numbers, CVVs or UPI PINs for COD checkout. If online customer payments are activated in the future, payment processing will use appropriately authorised external payment providers, and the then-applicable provider and data-handling disclosures will be updated before activation. HaatKaro will not request or store card security codes or UPI PINs.
• Technical Metadata: IP address, browser User-Agent, operating system type, and standard access timestamps for authentication security, rate limiting, and fraud prevention.

Your information is utilized solely to route and fulfill local retail orders, coordinate delivery handovers, and prevent fraud.

Communication Channels: All operational order updates, OTPs, and receipts are delivered via in-app notifications and transactional email. HaatKaro does not send unsolicited SMS marketing or promotional spam.

We share data strictly on a need-to-know operational basis:

• Assigned Local Merchants: Relevant customer contact and delivery details (customer name, contact phone number, delivery address, and order items) as necessary to prepare, pack, and fulfill the order.
• Assigned Delivery Partners: Relevant customer contact and delivery details (customer name, contact phone number, and physical delivery address) as necessary for transit and doorstep fulfillment.
• Legal & Regulatory Authorities: Only when compelled by valid legal process under applicable Indian law.

Users have the statutory right to review their accepted legal policy versions and request account deletion directly through our self-service portal at /account/privacy.

HaatKaro maintains production backend microservices and databases hosted in secure enterprise cloud facilities located in Singapore (Render Singapore Region) with edge acceleration:

• Cross-Border Transfer Disclosure: Customer and merchant transaction and account metadata are processed through our Singapore cloud infrastructure in accordance with the Digital Personal Data Protection Act and Section 43A of the Information Technology Act, 2000.
• Encryption Standards: All data transmitted between client applications and our cloud infrastructure is encrypted using Transport Layer Security (TLS 1.3). Sensitive credentials and database backups are encrypted at rest using industry-standard AES-256 encryption.
• Access Governance: Administrative access to production databases and servers is restricted via role-based access control, multi-factor authentication, and audited operational jump hosts.