Privacy Policy

1. Introduction

Tiffin & Mess CRM ("T/M CRM," "we," "us," or "our") operates websites, web dashboards, and mobile applications that help tiffin and mess businesses manage customers, plans, deliveries, payments, and related operations (collectively, the "Services").

This Privacy Policy explains how we access, collect, use, share, and safeguard personal information when you use our Services as a business owner (vendor), delivery partner, customer/member, or website visitor. By using the Services, you acknowledge the practices described in this policy.

2. Information We Collect

Depending on how you use the Services, we may collect the following categories of information:

2.1 Account and identity information

• Name, email address, phone number, and profile photo
• Login credentials and authentication data
• Role information (vendor, delivery partner, customer/member, staff)

2.2 Business and operational information

• Business name, address, contact details, tax or registration identifiers
• Customer/member records, meal plans, attendance, leaves, enquiries, and feedback
• Delivery routes, assigned areas, delivery status, box counts, and cash collection notes
• Messages, reviews, support requests, and other content you submit

2.3 Payment and billing information

• Subscription plan details, invoices, and payment transaction records
• Payment method details processed by our payment providers (we do not store full card numbers on our servers)

2.4 Location information

We access and collect location data as described below. This is a core disclosure for our delivery features.

• Precise location (GPS and related sensors): When a delivery partner uses the delivery app and starts or continues an active delivery route, we access the device's precise location (latitude, longitude, and optionally accuracy) through the device operating system's location services (for example GPS, Wi‑Fi, and mobile network data made available by the OS).
• Foreground and background collection: Location may be collected while the delivery app is open and in use. On Android, location may also continue through a foreground service (with a persistent notification) so the kitchen/vendor can track active deliveries. Where background location permission is granted (for example "Allow all the time" on Android or "Always Allow" on iOS), location may also be accessed when the app is not in the foreground, solely to support live delivery tracking for that signed-in delivery partner.
• Business and customer addresses: We store delivery addresses and map coordinates that vendors or customers enter or select (for example customer home addresses or business locations). This is address/location data you provide, not continuous GPS tracking of customers.
• Approximate location / IP-derived location: We may derive approximate location from IP address for security, fraud prevention, analytics, and to improve service reliability.

We do not use delivery-partner live location for advertising, resale, or unrelated profiling. Live GPS sharing is used to operate and monitor tiffin/mess deliveries.

2.5 Device, usage, and technical information

• Device type, operating system, app version, and device identifiers
• Log data, crash reports, performance metrics, and feature usage
• Push notification tokens (to send operational alerts)
• Cookies and similar technologies on our websites (see our Cookie Policy)

2.6 Camera and media (where permitted)

• Camera or photo-library access when you scan QR codes, upload a profile image, or attach media you choose to provide

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, maintain, and improve the Services
• Enable delivery operations, including live location sharing from delivery partners to the assigned kitchen/vendor so vendors can track active routes and deliveries
• Show maps, optimize routes, and help partners navigate to customer addresses
• Create and manage accounts, roles, and business profiles
• Process subscriptions, payments, invoices, and related communications
• Send transactional notices, support messages, and (where permitted) product updates
• Respond to support requests and troubleshoot issues
• Monitor usage, prevent fraud/abuse, and protect the security of the Services
• Comply with legal obligations and enforce our terms
• Personalize in-app experience (such as language preferences)

4. How We Share Information

We may share information in these circumstances:

• With the kitchen/vendor: Delivery-partner live location, delivery status, and related operational data are shared with the business that employs or assigns the delivery partner, so the kitchen can manage deliveries.
• Within a business workspace: Vendor staff accounts may access customer/member and delivery data for that business, according to role permissions.
• Service providers: Hosting, analytics, crash reporting, maps, payment processing, email/SMS, and push notification providers that process data on our behalf under contractual safeguards.
• Legal and safety: When required by law, or to protect rights, safety, and property of users, our company, or others.
• Business transfers: In connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections.
• With your consent: When you direct us to share information or otherwise consent.

We do not sell personal information, and we do not share live location data with third parties for advertising purposes.

5. Location Permissions and Your Choices

Before we access location on a delivery partner's device, the app presents an in-app disclosure and requires an affirmative action (for example, tapping "I Agree" or "Continue"). After that, the operating system permission prompt appears. You can:

• Decline the in-app disclosure or deny OS location permission (live tracking will not work)
• Change or revoke location permission anytime in device Settings
• Stop live sharing by closing the active route, closing the app, or signing out
• Contact us to request deletion of account-related personal data where applicable

6. Data Retention

We retain personal information for as long as needed to provide the Services, fulfill the purposes described in this policy, comply with legal obligations, resolve disputes, and enforce agreements. Live location points used for active delivery tracking are retained only as needed for operational visibility and may be cleared when sharing stops; related delivery history and business records may be retained longer for business and audit purposes.

7. Data Security

We implement technical and organizational measures designed to protect personal information. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

8. Children's Privacy

The Services are intended for business and adult users. We do not knowingly collect personal information from children under 13 (or the equivalent minimum age in your jurisdiction). If you believe a child has provided personal information, contact us and we will take appropriate steps to delete it.

9. Your Rights

Depending on your location and applicable law, you may have rights to:

• Access your personal information
• Correct inaccurate or incomplete information
• Request deletion of your personal information
• Restrict or object to certain processing
• Data portability
• Withdraw consent where processing is based on consent (including location)

To exercise these rights, contact us at the email below. We may need to verify your identity before fulfilling a request.

10. International Users

We primarily operate Services for users in India. If you access the Services from another country, your information may be processed in India or other locations where we or our service providers operate.

11. Third-Party Links and Services

The Services may link to third-party sites or open third-party apps (for example maps or payment providers). Their privacy practices are governed by their own policies. We are not responsible for those third parties' practices.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and revise the "Last updated" date. Continued use of the Services after changes become effective constitutes acknowledgment of the updated policy where permitted by law. For material changes affecting location collection, we may also present an updated in-app disclosure where required.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:
tiffinandmesscrmofficial@gmail.com

Product: Tiffin & Mess CRM (T/M CRM)
Website: https://apnathali.com