Customer Privacy Policy

This Customer Privacy Policy (“Privacy Policy” or “Policy”) governs the collection, receipt, storage, processing, transfer, disclosure, and protection of personal information and sensitive personal data collected from customers and end-users (“Customer,” “User,” “you,” or “your”) by Kalp Intelligence Private Limited (“Company,” “Gram,” “we,” “us,” or “our”).

This Policy applies comprehensively to all interactions with Gram, including downloading, browsing, or using our Android and iOS mobile applications, visiting our official website at gramapp.co, subscribing to daily homestyle meal plans, communicating with our support representatives, and availing of our food delivery services.

We are committed to upholding the highest standards of digital privacy, transparency, and data integrity. This Policy has been formulated in strict compliance with all relevant legislation and rules governing electronic data protection in India, including:

• The Digital Personal Data Protection Act, 2023 (“DPDPA 2023”) and any operational rules notified thereunder, recognizing Gram as a Data Fiduciary and the customer as a Data Principal.
• The Information Technology Act, 2000 (“IT Act”), as amended from time to time.
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”).
• The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, concerning grievance officer appointment, user notices, and statutory compliance.
• The Consumer Protection (E-Commerce) Rules, 2020, enacted under the Consumer Protection Act, 2019.
• Reserve Bank of India (“RBI”) Directives regarding Card-on-File Tokenization (CoFT) and electronic payment transaction protocols.

Our lawful grounds for collecting and processing your personal data include: (i) your specific, informed, and unambiguous consent; (ii) necessary performance of our meal delivery contract with you; (iii) compliance with Indian statutory and taxation mandates; and (iv) legitimate business interests such as fraud prevention, platform security, and service reliability.

To facilitate food ordering, coordinate preparation with home kitchens, assign delivery partners, and ensure smooth delivery handoffs, we collect the following categories of data:

In accordance with Google Play Developer Policy and Apple App Store Review Guidelines, we transparently disclose every hardware and system permission requested by the Gram Mobile Application:

* You can modify or revoke any optional permission at any time through your mobile device’s operating system settings (Android Settings > Apps > Gram > Permissions, or iOS Settings > Gram).

Gram processes personal data strictly for legitimate operational, commercial, and legal purposes:

• Account Setup & Authentication: Registering and authenticating your customer account using verified phone OTPs and email notifications.
• Fulfillment of Food Orders & Subscriptions: Transmitting order specifications and dietary instructions to our partner home kitchens, routing courier partners to your doorstep, and managing recurring meal plans.
• Customer Service & Dispute Resolution: Reviewing inquiries, handling delivery delays, replacing items, and processing approved refunds within our 48-hour SLA.
• Platform Safety, Fraud Prevention & Integrity: Preventing fraudulent order bookings, verifying payment authenticity, preventing abusive behavior toward delivery partners, and enforcing our Terms of Service.
• Personalization & Operational Analytics: Recommending regional cuisines based on dietary choices, evaluating kitchen preparation speeds, and optimizing courier dispatch routes.
• Statutory Compliance & Tax Audits: Generating GST invoices, maintaining financial accounts under the Companies Act, 2013, and complying with statutory inspection orders from Indian authorities.
• Direct Marketing & Promotional Offers: Sending updates regarding meal discounts, curated regional menus, and seasonal culinary festivals directly from Gram. You can opt out of non-essential promotional messages at any time.

We only share necessary subsets of your data with verified third parties under strict confidentiality agreements:

• Partner Home Kitchens: Provided only with your first name, order items, allergy warnings, and special cooking instructions. Kitchens never receive your private phone number, email address, or billing details.
• Delivery & Logistics Partners:Provided with your first name, delivery address, geocoded map pin, delivery instructions (e.g. “leave at reception”), and a masked telephone contact number via our cloud telephony bridge to facilitate handoff.
• RBI-Licensed Payment Gateways: Transmit order values and transaction identifiers to PCI-DSS compliant payment gateways (such as Razorpay / Cashfree) for secure online payment authorization.
• Cloud Infrastructure & Technical Sub-processors: Encrypted hosting on cloud servers located in India (e.g., AWS / GCP), transactional SMS providers for one-time passwords, and transactional email providers.
• Statutory & Law Enforcement Authorities: Disclosures made exclusively in compliance with valid court orders, written summons, or mandatory statutory requirements under Section 69, 79, or 91 of the Code of Criminal Procedure / Indian criminal law.

In alignment with Indian data sovereignty principles and the provisions of the Digital Personal Data Protection Act, 2023, all primary customer personal data, active databases, transaction logs, and billing archives are stored and hosted within secure cloud data centers located within the territory of India.

In the event that limited technical sub-processing (such as specialized security analytics or crash telemetry) involves cross-border transmission, such transfer is conducted strictly in compliance with central government regulations, utilizing high-grade cryptographic encryption and contractual safeguards.

Gram complies with Rule 8 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and international ISO/IEC 27001 data security standards:

We retain your personal data only for as long as your Gram account remains active or as needed to provide you with meal subscriptions, enforce agreements, and comply with legal requirements:

• Active Account Data: Maintained for the entire duration of your registered profile.
• Tax & Invoicing Archives: Maintained for up to 8 financial years as mandated under the Goods and Services Tax (GST) Act and the Companies Act, 2013.
• Inactive Accounts: Where an account has had zero login or transaction activity for 24 continuous months, it is slated for automated anonymization.

Under the Digital Personal Data Protection Act, 2023, you have clear statutory rights regarding the personal data we hold about you:

Gram is designed and intended strictly for use by individuals who have attained the age of majority (18 years and above under the Indian Majority Act, 1875).

In strict adherence to Section 9 of the DPDP Act, 2023, we do not undertake tracking, behavioral monitoring, or targeted advertising directed at children, nor do we knowingly process personal data of individuals under 18 years without verifiable parental consent. If we become aware that personal information of a child has been gathered without parental consent, we take immediate steps to delete such data from our servers.

Gram provides fresh homestyle meal deliveries directly from verified neighborhood culinary partners. To maintain accountability and food safety standards:

• Delivery Verification: Delivery partners may log a digital timestamp or capture a photo of the handed-over parcel at your doorstep as proof of completed delivery.
• Issue Reporting & Photographic Evidence: In case of packaging compromise, damaged containers, spoiled meals, or missing dishes, customers are invited to share a photograph via the in-app support chat within 2 hours of delivery.
• 48-Hour Refund Crediting SLA: Once a claim is verified and approved by our support desk, the refund amount is initiated immediately and credited back to your original source of payment (UPI ID, card, or original bank account) within a maximum SLA of 48 hours.

For full terms on meal replacement policies and subscription credits, please inspect our dedicated Refund & Cancellation Policy.

Our website and web views utilize essential session cookies and local storage tokens to recognize authenticated users, retain shopping cart selections across navigation, and remember language preferences.

You can configure your browser settings to reject non-essential cookies. However, disabling all cookies may impair certain features of the web platform, such as persistent cart contents or automated address lookups.

We may update this Privacy Policy periodically to reflect changes in our operational procedures, culinary features, or updated statutory rules under the DPDP Act or IT Act.

Whenever material updates are introduced, we will revise the “Last Updated” date at the top of this document, publish the amended policy across our website and mobile application, and notify you through an in-app banner or push notification where legally required.