Privacy Policy

1. Who we are

Value Workers ("FoodValve", "we", "us", "our") operates the FoodValve workplace food-court platform, comprising the FoodValve app (for employees and guests), the FoodValve Vendor app (for food businesses), the FoodValve Ops app (for site operations teams), the FoodValve admin console and this website.

This policy explains what personal data we collect, why we collect it, how it is used and shared, and the choices you have. It is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023.

2. Data we collect

2.1 Data you provide

Category	Examples	Who provides it
Identity & contact	Name, phone number, email address, password (stored hashed)	All users
Workplace details	Employer/company, employee ID, office site, work email (for SSO)	Employees (often via your employer's roster)
Vendor business details	Business name, category, outlet details, bank account details for payouts	Vendors
Vendor compliance documents	FSSAI license, GST certificate, Shop & Establishment license, PAN, bank proof, owner ID proof	Vendors (during registration)
Order & preference data	Orders, subscriptions, favourites, ratings, special instructions	Employees & guests
Support communications	Grievances, support tickets, feedback	All users

2.2 Data collected automatically

Transaction data — order amounts, payment status, subsidy usage, refunds. Card/UPI credentials are processed by our payment partner (Razorpay) and are never stored by FoodValve.
Device & app data — device type, operating system, app version, push-notification token, crash and diagnostic logs.
Usage data — screens visited, features used, session timestamps (used to improve the product).

3. How we use data

Create and operate your account, verify your identity via OTP, and secure your sessions.
Process orders, apply employer meal subsidies, collect payments and issue invoices.
Route orders to the right vendor and enable QR-verified pickup.
Verify vendor businesses (KYC/FSSAI compliance) and process vendor payouts.
Send transactional notifications (order status, OTPs, payout updates) via push, SMS and email.
Provide customer support and resolve grievances.
Produce aggregated analytics for vendors, employer companies and platform operations.
Meet legal, tax and regulatory obligations (e.g. GST records).

We do not sell your personal data.

Recipient	What & why
Your employer (tenant company)	Subsidy utilisation and aggregate dining reports tied to their subsidy programme. Your employer does not see your payment instrument details.
Food vendors	Your name, order contents and pickup details — only for orders you place with that vendor.
Razorpay (payments)	Payment processing, refunds and settlement. Governed by Razorpay's own privacy policy.
Communication providers	SMS/OTP delivery (e.g. MSG91) and transactional email (e.g. SendGrid/Twilio).
Cloud infrastructure	Hosting, database and file storage providers (e.g. Supabase/AWS data centres) under contractual safeguards.
Authorities	Where required by law, court order or to protect the rights and safety of users and the platform.

5. App permissions we request

Camera — to scan QR codes at pickup counters (Vendor app) and to upload documents or images. The camera is used only while you are actively using these features.
Notifications — order status, OTPs and service updates. You can disable these in your device settings.
Storage / photos — to attach documents (vendor registration) or images (menu photos, profile pictures) that you choose.

We do not access your contacts, call logs or SMS inbox.

6. Data retention

Account data — retained while your account is active.
Transaction & invoice records — retained for up to 8 years after the transaction, as required by Indian tax and accounting law, even after account deletion.
Vendor KYC documents — retained for the duration of the vendor relationship plus the statutory record-keeping period.
Support & grievance records — retained for up to 3 years after closure.

7. Security

We use industry-standard safeguards: encrypted transport (HTTPS/TLS), hashed passwords, token-based session management with rotation, role-based access control, private (non-public) document storage with time-limited access links, and audit logging of administrative actions. No system is 100% secure; if we become aware of a breach affecting your data, we will notify you and the authorities as required by law.

8. Your rights & choices

Access & correction — view and edit your profile details in the app, or ask us for a copy of your data.
Erasure — request deletion of your account and associated personal data (see Account Deletion).
Grievance — raise a complaint with our Grievance Officer (see Grievance Redressal); if unresolved, you may approach the Data Protection Board of India.
Notifications — opt out of non-essential notifications in app or device settings. Transactional messages (e.g. OTPs) cannot be disabled while you use the service.

9. Account deletion

You can delete your account from within the app (Profile → Delete Account) or request deletion without the app via our Account Deletion page. On deletion, your personal profile is removed or irreversibly anonymised; transaction records we must keep by law are retained in de-identified or restricted form for the statutory period.

10. Children's privacy

FoodValve is intended for users aged 18 years and above (or the age of majority required to transact). We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified in-app or by email, and the "Last updated" date above will always reflect the current version. Continued use of the service after an update constitutes acceptance of the revised policy.

12. Contact us

Privacy queries: privacy@foodvalve.com
Grievance Officer: see Grievance Redressal
Postal address: Value Workers, [Registered Office Address]

Before publishing: replace the highlighted placeholders (dates, addresses, registration numbers) with your final details, and ensure this page's URL is entered in Google Play Console (Store listing → Privacy Policy) and App Store Connect (App Privacy).