Privacy Policy

Privacy Policy

Last updated: 14 October 2026

This explains what personal data STACHY DIGITAL PRIVATE LIMITED ("Stachy", "we") collects when you use the Stachy customer app, the Stachy Seller app, the Stachy Rider app or our website, why we collect it, who it is shared with, how long it is kept, and what you can do about it.

Contact: support@stachy.in, +919581423817

1. What we collect, and why

**Everyone who signs in**

• –Mobile number, and the one-time codes used to sign in. Used to create and secure your account and to contact you about orders.
• –Name, if you give one. Shown on your orders so a shop or delivery partner knows who the order is for.
• –Email address, only if you choose to add and verify one. Used for account messages.
• –Records of the terms and agreements you accepted, with the version, the time and the network (IP) address it came from. Kept as a record of what you agreed to.

**Customers**

• –Delivery addresses and your location. Used to show the shops that serve where you are and to deliver your orders. The app asks your permission before using your phone's location, and you can choose a place on the map instead.
• –Orders: what you ordered, from whom, the amounts, the payment status, and the order's progress. This is your record and the shop's.
• –Photographs you send: a picture of a shopping list, a reference picture for a cake, or a photograph with a complaint.
• –Voice, if you speak a shopping list. It is converted to text by your phone's speech service. We keep the text, not the recording.
• –Ratings, reviews and support conversations.
• –If a refund has to be paid to you outside your original payment method, the UPI ID or bank account you give us for it. Used only to pay that refund.

**Sellers (shop owners and their staff)**

• –Your name, phone number, email, and your shop's name, address and location.
• –Business details: your FSSAI licence for food businesses; the PAN of the business and the legal name on it; your GST registration status and GSTIN, or the enrolment number for selling without registration; with any documents you upload for them. Used to verify your business, to generate invoices in your name, and to collect, deduct and report the taxes the law requires.
• –Payout details: bank account number, IFSC and account holder name, or UPI ID. Used to pay you.
• –Your catalogue or menu, prices, photographs and opening hours, which are shown to customers.
• –Orders, settlements and payouts.

**Delivery partners (riders)**

• –Your name, phone number, city, photograph and vehicle details.
• –Identity and eligibility documents you give us when you apply: a masked copy of your Aadhaar card (we keep only the last four digits of its number, never the full number), your PAN card and driving licence with their numbers, and your photograph. Used to check who you are and that you may drive. Your PAN is also used to deduct and report income tax on what we pay you.
• –Your location while you are online for deliveries. Used to offer you nearby orders and to show customers where their delivery is. We do not use it when you are offline.
• –Delivery records, including photographs taken at handover, cash you collected, and your earnings.
• –Payout details: bank account or UPI ID.

**People who apply for a job with us**

• –What you send in the application, including your CV.

**Devices**

• –Crash reports and basic technical details of your device and app version, used to find and fix faults.
• –A notification token, used to send notifications to your phone.
• –Security checks that confirm requests come from a genuine copy of our app.

We do not collect card numbers or UPI PINs. Those go directly to our payment provider. We do not read your contacts, messages or call history. Our apps do not use advertising or third-party analytics trackers.

2. Who we share it with

We share personal data only as needed to provide the service:

• –**Shops** see the orders placed with them: your name, what you ordered, and your delivery or collection details. A shop cannot see your orders with other shops.
• –**Delivery partners** see what they need for the delivery in hand: where to collect, where to deliver, your name, and a way to contact you. They see your address only once they have accepted the delivery.
• –**Customers** see a shop's public details, and the name, vehicle, phone number and live location of the delivery partner carrying their order, with the route the partner is expected to take.

**Phone numbers are shared for calls about an order.** So that an order can be sorted out quickly, the shop you order from and the delivery partner carrying it can see your phone number and call or message you from their own phone, and you can call or message them from yours. Numbers are shared only for the order in hand: a shop or delivery partner must not use your number for anything else. If you would rather not be called, add a note to your order and use Need help? in the app instead.

We also use service providers who process data on our behalf:

• –Google Firebase and Google Cloud, for sign-in, our database, file storage, notifications, crash reports and security checks. Google Cloud Vision reads the text in photographs of shopping lists and documents you upload.
• –Google Maps, for maps, addresses and the road route a delivery partner is expected to take, which is worked out from the partner's position during a delivery.
• –Razorpay, for payments, refunds and payouts.
• –Twilio, for sending text and WhatsApp messages.
• –Vercel, which hosts our website. Our server runs on Google Cloud.
• –An email provider, if email messages are switched on.

We also share what the law requires with government bodies:

• –**Tax authorities.** We report to the GST Network and the Income Tax Department the details the law requires: sellers' GSTINs or enrolment numbers and PANs, and delivery partners' PANs, with the amounts of their sales or payouts and the tax collected or deducted.
• –**Labour authorities.** Where the Code on Social Security, 2020 requires, delivery partners' details are shared to register them as platform workers.

Our accountants and auditors see our records to keep our books and file our returns, under a duty of confidentiality.

We may disclose information where the law requires it, for example in response to a court order or a lawful request from a government authority, or to protect the safety of our users or prevent fraud.

We do not sell personal data, and we do not share it for advertising.

3. Where it is stored

Our main database is hosted in India (Mumbai). Some of our service providers may process data outside India. Where they do, we use them only as permitted by Indian law.

4. How long we keep it

• –Account details, saved addresses and preferences: until you delete your account.
• –Photographs of shopping lists: deleted automatically after 3 days.
• –Reference pictures for cakes: deleted automatically after 7 days.
• –Photographs attached to a complaint, and photographs taken at delivery handover: 180 days.
• –Product lists and documents uploaded for a catalogue import: 90 days.
• –CVs sent with a job application: 365 days.
• –Order, payment, settlement and invoice records: as long as tax and accounting law requires. When you delete your account, these are kept without your contact details.
• –Records of terms you accepted: kept as long as they may be needed to show what was agreed.
• –Seller and delivery partner verification documents: while the partnership is active, and afterwards only as long as needed for legal, tax or dispute purposes.

The photograph deletions above are rules applied by the storage itself, not tasks that have to be remembered.

5. Your rights

You can ask to:

• –see the personal data we hold about you;
• –correct or update it;
• –delete it;
• –withdraw a consent you gave, such as location permission;
• –nominate someone to exercise these rights for you if you are unable to.

You can delete your account in the app, under Profile, or by writing to us. An account cannot be deleted while an order, refund or complaint on it is still open; we will tell you what is outstanding. Some records must be kept by law after deletion, as described in section 4.

Withdrawing a consent does not affect what was done before, but some features, such as delivery, need the related data to work.

To exercise any of these rights, write to support@stachy.in. We respond within the time allowed by law.

6. Security

Data is encrypted in transit. Access is limited by role: a shop sees its own orders, a delivery partner sees the delivery in hand, and our team sees what their work requires. When you contact customer care, our team may find your orders by your phone number or an order or payment reference; each such search is recorded. Full bank account numbers are shown only to the Stachy staff who make payouts, and each time they are viewed it is recorded.

No system is completely secure. If a personal data breach affects you, we will tell you without delay, in plain language, what happened, what it may mean for you, what we are doing about it, and who to contact.

7. Children

Stachy is for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

8. Changes to this policy

We may update this policy. The date at the top shows when it last changed. For a material change, we tell you in the app before it takes effect.

9. Contact and complaints

For any question or request about your personal data, contact our grievance officer: Harsha Vardhan, support@stachy.in.

Address: VV Vintage, Somajiguda, Hyderabad, Telangana 500082

Support: support@stachy.in

Phone: +919581423817

Support hours: Email us. We usually reply within 2 hours.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.