Legal
Privacy Policy
This policy explains how Way2Door ("we", "us") handles personal data when you use the Way2Door app (for customers), the Way2Door Business app (for businesses and their staff), our activation and connect web pages, and way2door.com (together, the "Services"). It is written for the Digital Personal Data Protection Act, 2023 (India) and the Information Technology Act, 2000.
1. Who is responsible for your data
Way2Door is software that local businesses (for example a dairy or a water supplier) use to run subscriptions, deliveries and billing for their customers.
- If you are a customer of a business on Way2Door, that business decides why and how your data is used (it is the Data Fiduciary). Way2Door processes the data on the business's behalf, as its Data Processor. Questions about your orders, bills or the messages a business sends you are best sent to that business first; we will help them answer.
- For your Way2Door account itself (your login, devices and app settings) and for business owners and staff who sign up, Way2Door is the Data Fiduciary.
2. What we collect
You give us
- Identity and contact: your name, mobile number, and for businesses, the business name, address and staff members.
- Address and location: your delivery address and, if you choose, a map pin. When you search for an address we send what you type to Google Maps Platform to suggest places.
- Orders and subscriptions: products, quantities, delivery schedule, pauses, vacations and change requests.
- Payments and bills: amounts paid, balances, invoices and payment references recorded by the business. We do not collect or store card numbers, UPI PINs or bank passwords.
- Messages: WhatsApp messages exchanged with a business that has connected WhatsApp (see section 4), and support messages you send us.
Collected automatically
- Device and app data: device identifier, app version, language, operating system, and a push notification token from Firebase Cloud Messaging.
- Delivery location (delivery staff only): while a delivery run is in progress in the Business app's Delivery mode, the app records the device location with each delivery so the business can confirm where it was made. It is not collected outside a delivery run.
- Logs: technical logs (time, request, error codes, IP address) used to keep the Services secure and working. Logs do not contain message contents or passwords.
We do not use advertising trackers, and we do not sell personal data.
3. How we use it
- To sign you in with a one-time password sent by SMS or WhatsApp.
- To plan, deliver and record orders, and to calculate bills and balances.
- To send you service messages: delivery updates, bills, payment reminders and activation links, by app notification and/or WhatsApp, as the business has set up and as you allow.
- To let businesses and their staff manage their operations and reply to customers.
- To keep the Services secure, prevent fraud and abuse, fix problems and improve features.
- To meet legal obligations, such as tax and accounting records kept by businesses.
We rely on your consent (which you can withdraw at any time, see section 7) and on legitimate uses permitted by law, such as providing a service you asked for.
4. WhatsApp messages
A business can connect its own WhatsApp Business number to Way2Door through Meta's WhatsApp Business Platform. When it does:
- The business may send you bills, delivery updates and links on WhatsApp, and you can chat with the business there.
- Messages you send to that business's number, and its replies, are stored by Way2Door so the business can see and answer them in the Business app. Messages are kept for 12 months and then deleted automatically. Media (photos, voice notes) is not stored by Way2Door.
- Reply STOP at any time to stop WhatsApp messages from that business; reply START to resume. You will still get important updates by app notification if you use the Way2Door app.
- Meta processes WhatsApp messages under its own terms and privacy policy (whatsapp.com/legal).
5. Who we share it with
We share personal data only as needed to run the Services:
- The business you buy from and its authorised staff (for example delivery staff see the addresses on their route).
- Service providers that process data for us under contract:
- Amazon Web Services (servers and database, Mumbai region, India)
- Google (Firebase Cloud Messaging for notifications, Firebase Hosting for this website, Google Maps Platform for address search)
- Meta Platforms (WhatsApp Business Platform, when a business connects WhatsApp)
- An SMS provider in India (for one-time passwords)
- Apple and Google (app stores, and their push notification services)
- Authorities, when the law requires it or to protect the rights and safety of people.
- A successor, if Way2Door is merged or sold, under this same policy.
6. Where it is stored and for how long
Data is stored on servers in India (AWS Mumbai). Some service providers above may process data outside India, where permitted by law.
- Account and order data: for as long as your account or the business's account is active.
- Bills, payments and ledger records: as long as the business is required to keep them under tax and accounting law (typically up to 8 years).
- WhatsApp messages: 12 months.
- Technical logs: up to 90 days.
- Backups: up to 30 days after deletion from the live system.
When data is no longer needed we delete it or make it anonymous.
7. Your rights
You can ask us, or the business you buy from, to:
- give you a summary of the personal data we hold about you and how it is used;
- correct, complete or update your data;
- delete your data and account, unless we or the business must keep it by law (for example bills);
- withdraw consent, for example to WhatsApp messages (reply STOP) or notifications (turn them off in your phone's settings);
- nominate someone to exercise these rights if you die or are unable to;
- have a grievance addressed (see section 11).
To make a request, use the contact details below. We will reply within 30 days.
8. Security
We use encryption in transit (HTTPS), encryption of sensitive credentials at rest, strict separation of each business's data, least-privilege access for our services and staff, and regular backups. No system is perfectly secure; if a breach affects your data we will inform you and the Data Protection Board of India as the law requires.
9. Children
The Services are not meant for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
10. Changes to this policy
We may update this policy. We will change the date at the top and, for important changes, tell you in the app or by message before they take effect.
11. Contact and grievances
Grievance Officer, Way2Door
WhatsApp: +91 88853 84558
We acknowledge grievances within 48 hours and resolve them within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.