Privacy Policy

Effective Date: February 11, 2026

GrabToGo ("we", "us", "our") is committed to protecting your personal data in accordance with the Digital Personal Data Protection (DPDP) Act, 2023 of India. This policy explains how we collect, use, store, and protect your information.

1. Data We Collect

Data Type	Details	Purpose
Account Information	Full name, email address, phone number	Account creation, communication
Location Data	GPS coordinates (with permission)	Show nearby offers within selected radius
Shop Information (Vendors)	Shop name, category, address, FSSAI license, business documents	Vendor verification, listing creation
Payment Information	Transaction IDs, subscription plan, billing cycle	Payment processing, subscription management
Device Information	Push notification token, device type, OS version	Push notifications, crash reporting
Usage Data	App interactions, viewed offers, saved items	Service improvement, personalized experience

2. Purpose of Data Collection

Providing hyperlocal offer discovery services
Processing vendor registrations and verification
Managing subscriptions and payments via Razorpay
Sending push notifications for nearby offers and order updates
Ensuring platform safety and preventing fraud
Crash reporting and app stability monitoring via Sentry
Compliance with legal obligations

3. Consent

By registering and using GrabToGo, you consent to the collection and processing of your personal data as described in this policy. You may withdraw consent at any time by deleting your account through Settings > Data & Privacy > Delete My Account.

4. Data Retention

Data Type	Retention Period
Account data	Until account deletion + 30 days for processing
Payment records	7 years (as required by Indian tax law)
Vendor documents	Until account deletion or vendor deactivation
Location data	Not stored permanently; used only during active session
Push notification tokens	Until token refresh or account deletion
Crash reports	90 days (Sentry retention policy)

5. Your Rights Under DPDP Act

As a data principal, you have the following rights:

Right to Access: Request a copy of all personal data we hold about you via Settings > Data & Privacy > Export My Data.
Right to Correction: Update your personal information through your profile settings at any time.
Right to Erasure: Request permanent deletion of your account and associated data via Settings > Data & Privacy > Delete My Account.
Right to Data Portability: Export your data in a machine-readable JSON format.
Right to Withdraw Consent: Withdraw consent by deleting your account. Certain data may be retained as required by law.
Right to Grievance Redressal: Contact our Data Grievance Officer for any data-related concerns.

6. Third-Party Data Sharing

We share data with the following third-party services to operate the platform:

Service	Data Shared	Purpose	Location
Supabase	All app data	Database, authentication, storage	US (AWS us-east-1)
Razorpay	Payment details, email	Payment processing	India
Expo (EAS)	Push tokens, device info	Push notifications, app updates	US
Sentry	Crash data, device info	Error monitoring, crash reporting	US
Google Play Services	Location, device info	Maps, location services	Global

We do not sell your personal data to any third party.

7. Cross-Border Data Transfer

Your data may be transferred to and processed in the United States through our service providers (Supabase, Expo, Sentry). These transfers are necessary for the provision of our services and are conducted with appropriate safeguards as required by the DPDP Act.

8. Data Security

All data transmitted via HTTPS/TLS encryption
Row Level Security (RLS) enforced at the database level
Authentication tokens stored securely on device
Vendor documents stored in access-controlled storage buckets
Rate limiting on sensitive API endpoints

9. Children's Data

GrabToGo is not intended for users under 18 years of age. We do not knowingly collect data from minors. If you believe a minor has provided us personal data, please contact our Grievance Officer immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated via in-app notification. Continued use of the app after changes constitutes acceptance of the updated policy.

11. Data Grievance Officer

GrabToGo Data Grievance Officer

Email: privacy@grabtogo.in

Response time: Within 72 hours of receiving your request

Resolution time: Within 30 days as per DPDP Act requirements

Last updated: February 11, 2026