Privacy Policy for Pench.

Introduction

Welcome to Pench ("we," "our," "us," or "Platform"). Pench operates a multi-tenant logistics, recurring delivery, and ERP platform comprising the Pench Backend Services, Pench Mobile Applications (Customer & Driver apps), and Pench Web Frontends.

This Privacy Policy explains how we collect, use, disclose, process, and safeguard your personal information when you use our websites, mobile applications, services, and software solutions (collectively, the "Services").

By registering, accessing, or using the Pench Platform, you consent to the practices described in this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Services.

Applicability & Covered Roles

This Privacy Policy applies to all users interacting with the Pench Platform across different roles:

• Customers / End-Users: Individuals subscribing to or ordering daily essentials, dairy products, meal deliveries, or goods.
• Delivery Drivers / Agents: Personnel conducting last-mile delivery operations using the Pench Driver Mobile Application.
• Merchants / Business Owners / Admins / Employees: Enterprise users, tenant managers, and staff managing city operations, inventory, routes, and subscriptions via the ERP web dashboard.

Information We Collect

We collect information directly from you, automatically when you interact with our Services, and from third-party services as described below.

Information You Provide to Us

• Account & Registration Data: Full name, mobile phone number, email address, password/passcode, user role, and city/region.
• Delivery & Address Information: Street address, building/flat details, landmark, geo-coordinates (latitude and longitude), delivery instructions, and designated delivery zone.
• Subscription & Order Details: Daily or recurring delivery schedules, custom frequencies (daily, alternate days, weekdays), order history, product preferences, and vacation pause schedules.
• Payment & Invoicing Information: Transaction IDs, payment modes (UPI, credit/debit card, net banking, prepaid wallet balance), billing history, and tax/invoicing identifiers, processed via PCI-DSS compliant payment gateways.
• Customer Support & Communications: Feedback, support tickets, chat logs, and email or phone inquiries.

Information Collected Automatically

• Real-time GPS & location data: for delivery drivers, foreground and background precise GPS coordinates (latitude, longitude, speed, heading) while active on a delivery trip, used for live route tracking, ETA estimation, path trail logging, and dispatch optimisation; for customers, device location (with consent) to pin delivery addresses and verify service availability.
• Proof of Delivery (POD) media & metadata: camera photos taken by drivers upon delivery completion, with timestamp and geotagged GPS coordinates.
• Device & technical data: IP address, device identifier, OS version, browser type, hardware model, mobile network details, and push notification tokens.
• Usage & log information: access times, app features used, API request logs, crash reports, and WebSocket connection logs.
• Cookies & session tokens: session identifiers and authentication tokens (JWT) to maintain secure sessions across tenant subdomains.

How We Use Your Information

• Service provision & order fulfilment: processing daily orders, recurring subscriptions, vacation pauses, and inventory adjustments across tenant schemas.
• Route optimisation & driver dispatch: using location data with routing engines to generate efficient delivery routes and assign drivers to zones.
• Real-time tracking & proof of delivery: displaying live delivery progress, calculating ETAs, and generating geotagged POD records.
• Billing & financial management: automated invoices, payment status, wallet balances, and financial ledgers.
• Notifications & alerts: transactional updates, OTP verification, trip status, and bill reminders via SMS, WhatsApp, push notifications, and email.
• Multi-tenant data security: enforcing schema separation between city tenants to keep data isolated.
• Platform analytics & system improvement: monitoring performance, diagnosing bugs, and improving delivery density and app experience.
• Legal compliance & security: preventing fraud and unauthorised access, and meeting statutory and tax obligations.

Information Sharing & Disclosure

We do not sell personal data. We share it only in the following circumstances:

Operational sharing within the platform

• Drivers: assigned drivers receive customer delivery names, address details, GPS pins, contact numbers, and order items needed for delivery coordination.
• City tenants & admin staff: authorised managers of a specific city tenant can access customer profiles, orders, and delivery histories confined to their own tenant schema.

Third-party service providers

• Routing & mapping: OpenStreetMap, OSRM, Nominatim, and Google Maps API for geocoding and map rendering.
• Communications: SMS providers, WhatsApp Business API, and Firebase Cloud Messaging for push notifications.
• Payments: PCI-DSS certified payment gateways for processing transactions.
• Cloud infrastructure: hosting, database, and caching providers that process data on our instructions.

Legal requirements & business transfers

We may disclose information where required by law, court order, or regulatory mandate, or to protect the rights, property, or safety of Pench, our users, or the public. In a merger, acquisition, or asset sale, user data may be transferred as part of that transaction, subject to confidentiality commitments.

Data Security & Storage

• Multi-tenant database isolation: tenant schemas physically isolate city data, preventing cross-tenant exposure.
• Encryption: data encrypted in transit via SSL/TLS, token-based authentication (JWT/OAuth2), and salted password hashing.
• Access controls: role-based access control so staff only see data necessary for their role.
• Background location security: driver GPS streaming is restricted to active trip durations and encrypted over secure WebSockets.

Data Retention

• Account & subscription data: retained for the lifetime of the account plus statutory periods for legal and tax compliance.
• Driver GPS logs & POD photos: retained for operational verification, dispute resolution, and audit trails.
• Invoices & financial ledgers: retained as mandated by financial, accounting, and GST regulations (typically 6-8 years).

When data is no longer required, it is securely deleted, anonymised, or destroyed.

Your Privacy Rights & Choices

• Access & update: update profile, address, and delivery preferences via account settings.
• Subscription control & vacation mode: pause, modify, or cancel recurring subscriptions at any time.
• App permissions: manage or revoke location, camera, and notification permissions via device settings — revoking essential permissions (e.g. location for drivers) may impact functionality.
• Account deletion: request deletion of your account and personal data by contacting support, subject to legal retention obligations.
• Marketing preferences: opt out of promotional communications at any time.

Children's Privacy

The Pench Platform is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child has provided personal data without parental consent, we will take immediate steps to delete it.

Changes to This Policy

We may update this policy periodically to reflect changes in our practices, technology, or legal requirements. We'll revise the "Last updated" date above and notify users via app alerts, email, or a prominent notice for material changes. Continued use of the Services after updates constitutes acceptance of the revised policy.

Contact Us & Grievance Officer

If you have questions, concerns, feedback, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection & Grievance Officer: