Privacy policy
Last updated: 21 October 2026
This policy explains what personal data ChotaBox collects through ChotaBox, why, and your choices. We follow the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.
What we collect
- Account details: name, email address, phone number and a securely hashed password.
- Delivery details: saved addresses and, if you pin one on the map, its location.
- Order details: what you ordered, amounts, and payment status.
- Delivery partner location: for delivery partners only, live location while they choose to share it on duty. Only the latest position is kept, and it is erased when they go offline.
- Technical data: a session cookie that keeps you signed in, and IP addresses in security logs.
Why we use it
To create your account, take and deliver orders, process payments and refunds, send order and account emails, prevent fraud, and meet legal obligations. We do not sell your personal data.
Who we share it with
- The restaurant and delivery partner handling your order (name, phone, delivery address).
- Razorpay, to process payments and refunds.
- Google Maps, when you search for or pin a location.
- Our email provider, to send order and account emails.
- Authorities, where the law requires it.
How long we keep it
Account data is kept while your account is open. Order and payment records are kept as long as tax and accounting law requires.
Your rights
You can view and edit your addresses in your account, and ask us to access, correct or delete your personal data, or withdraw consent. To do so, use the details on our Contact us page.
Grievance officer
ChotaBox. We acknowledge complaints within 48 hours and aim to resolve them within 30 days. To reach us, use the details on our Contact us page.