Privacy Policy

1. Introduction

Swapify Foods Pvt. Ltd. ("Swapify", "Company", "we", "our", or "us") is a food and tiffin service provider currently operating in Indore, India. We are committed to protecting the privacy and security of personal data entrusted to us by our users, customers, and business partners. This Privacy Policy explains how we collect, use, process, store, disclose, and safeguard personal data when you access or use our website https://www.swapify.in/, register for an account, place food orders, interact with our customer support team, or otherwise engage with our services

This Privacy Policy (“Privacy Policy”) is issued in compliance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and other applicable Indian laws governing the protection of personal data. Swapify acts as a Data Fiduciary in respect of personal data collected through its platform. We collect and process personal data only for lawful purposes related to providing food delivery services, improving user experience, fulfilling legal obligations, and ensuring the safety and integrity of our platform.

At present, our services are primarily offered within Indore, Madhya Pradesh. However, this Privacy Policy applies to all personal data processed through our website and any future mobile applications or digital platforms operated by us. In the event of expansion to additional locations or introduction of new services, this Policy will continue to govern how personal data is handled unless otherwise updated.

By accessing or using our website or services, you acknowledge that you have read, understood, and agreed to the terms of this Privacy Policy. If you do not agree with this Policy, you should refrain from using our services.

2. Identity of the Data Fiduciary

Swapify, a company incorporated under the laws of India and having its registered office at F.206, Manas Mayfair, 8/5 Nath Mandir road, South Tukoganj, Indore, 452001, acts as the “Data Fiduciary” in respect of personal data processed through its website and services in accordance with the DPDP Act. As the Data Fiduciary, the Company determines the purpose and means of processing personal data collected from users, customers, and business partners.

For any questions, concerns, or requests relating to the processing of personal data, users may contact us at customersupport@swapify.in or via phone/WhatsApp at 7208474620. In compliance with applicable law, the Company has designated a Grievance Officer to address complaints or concerns regarding personal data processing. 

Users may submit grievances or data protection-related requests by writing to customersupport@swapify.in.
We endeavor to acknowledge and respond to such grievances within the timelines prescribed under applicable law.

3. Categories of Personal Data Collected

Swapify collects personal data that users voluntarily provide when creating an account, placing orders, or interacting with our platform. Such personal data may include the user’s full name, mobile phone number, email address, delivery address, and account login credentials. This information is necessary to create and manage user accounts, process food orders, and enable secure access to our services.

In connection with orders placed through our platform, we collect transactional information including order details, delivery instructions, payment confirmation information, and refund-related details. Where refunds are required, we may collect UPI identifiers or bank account details for the limited purpose of processing such refunds. Payment card information, where applicable, is processed by authorized third-party payment gateways and is not stored by Swapify.

We may also collect information provided voluntarily when users contact customer support, submit feedback, respond to surveys, or otherwise communicate with us. This may include correspondence records, preferences, and service-related communications.

In addition to information provided directly by users, we automatically collect certain technical and usage-related information when users access or interact with our website. This may include IP address, browser type, device model, operating system, approximate location information, pages visited, interaction logs, timestamps, and other diagnostic data.

Such information is collected through cookies and analytics tools, including Google Analytics, to understand user behavior, improve platform performance, enhance security, and optimize service delivery.

We collect and process only such personal data as is reasonably necessary for providing our services, maintaining platform security, fulfilling contractual obligations, and complying with applicable legal requirements.

4. Automatic Data Collection and Analytics

When you access or use our website, certain information is automatically collected through cookies and similar tracking technologies. This information may include your IP address, browser type, device information, operating system, referral source, pages visited, time spent on pages, date and time of access, and other technical usage data. This information helps us understand how users interact with our platform and enables us to improve the performance, functionality, and user experience of our services. 

We use third-party analytics tools, including Google Analytics, to collect and analyze usage information. Google Analytics uses cookies and similar technologies to gather data about website traffic and user behavior. The information generated may be transmitted to and stored on Google’s servers, which may be located outside India. Google processes this information on our behalf to provide reports and insights regarding website usage. We do not use Google Analytics to directly identify individual users, and we do not merge analytics data with personally identifiable account information. Cross-border transfers shall be subject to any restrictions notified by the Government of India under applicable law.

You may control or disable cookies through your browser settings. Disabling cookies may limit certain functionalities of the website. Additionally, users may opt out of Google Analytics tracking by using the Google Analytics Opt-out Browser Add-on made available by Google.

5. Purpose of Processing and Use of Personal Data

Swapify processes personal data solely for lawful and clearly defined purposes connected with the provision and improvement of its food and tiffin delivery services. The personal data collected through our website and related platforms is used to create and manage user accounts, authenticate users, process and deliver food orders, coordinate with vendors and delivery partners, facilitate secure payment processing, and issue refunds where applicable.

Without such processing, we would be unable to provide our core services.

We also process personal data to communicate with users regarding order confirmations, delivery updates, service notifications, account-related information, and customer support responses. 

Where users have provided consent, we may use contact details to send promotional communications, offers, discounts, or updates regarding our services. Users may withdraw consent for marketing communications at any time in accordance with applicable law.

Personal data may further be used to improve platform functionality, enhance user experience, analyze website performance, monitor service quality, prevent fraudulent transactions, detect misuse of the platform, ensure network and information security, and comply with applicable legal and regulatory requirements. Technical and usage-related data collected through cookies and analytics tools, including Google Analytics, is used in aggregated or pseudonymized form to understand usage trends, measure performance, and optimize operational efficiency.

We do not use personal data for purposes that are incompatible with those described in this Privacy Policy. 

Where required under applicable law, we process personal data based on the consent of the user. Users may withdraw their consent at any time by contacting us; however, such withdrawal shall not affect the lawfulness of processing carried out prior to the withdrawal and may impact our ability to provide certain services.

6. Sharing and Disclosure of Personal Data

Swapify does not sell, rent, or trade personal data to third parties for monetary consideration. We share personal data only where such sharing is necessary to provide our services, comply with legal obligations, protect our legitimate interests, or support operational requirements directly connected to our business activities.

In order to fulfill food orders and ensure timely delivery, we may share limited personal data with our registered vendors and delivery partners. Such data may include the user’s name, contact number, delivery address, and order details strictly to the extent necessary for order processing and delivery coordination. Vendors and delivery partners are expected to use such information solely for fulfilling the specific order and not for independent marketing or unrelated purposes.

We may also share personal data with third-party service providers who assist us in operating our website and delivering our services. This includes payment gateway providers for processing transactions, cloud hosting providers for secure data storage, analytics providers such as Google Analytics for performance measurement, communication service providers for transactional messaging, and IT support vendors.

These entities process personal data on our behalf under contractual arrangements that require them to maintain confidentiality, implement reasonable security safeguards, and process data only in accordance with our instructions and applicable law.

Personal data may further be disclosed where required by applicable law, regulation, court order, or lawful request by government authorities. We may also disclose information where necessary to protect our rights, prevent fraud, investigate misuse of our platform, enforce our Terms and Conditions, or safeguard the security and integrity of our services.

In the event of a merger, acquisition, restructuring, investment transaction, or transfer of business assets, personal data may be transferred to the acquiring or successor entity as part of the transaction, provided that such entity agrees to continue processing personal data in a manner consistent with this Privacy Policy and applicable legal requirements.

We take reasonable steps to ensure that any third party receiving personal data implements appropriate data protection measures and processes such data only for authorized purposes.

7. Data Retention

Swapify retains personal data only for as long as it is reasonably necessary to fulfill the purposes for which it was collected, including providing services, complying with contractual obligations, resolving disputes, enforcing our agreements, and meeting legal or regulatory requirements. We follow the principle of data minimization and do not retain personal data for longer than required.

Personal data associated with user accounts is retained for as long as the account remains active. If a user chooses to deactivate or delete their account, we will initiate deletion or anonymization of personal data within a reasonable period, except where retention is required for legal compliance, fraud prevention, dispute resolution, or enforcement of our rights.

Transaction-related records, including order history and payment confirmations, may be retained for a longer duration where required under applicable tax, accounting, or regulatory laws. Refund-related financial information may also be retained for compliance and audit purposes in accordance with statutory record-keeping requirements.

Technical and usage-related data collected through analytics tools, including Google Analytics, is retained in accordance with configured retention settings and may be stored in aggregated or anonymized form for performance analysis and security monitoring.

Where personal data is no longer required for the purposes for which it was collected, and where retention is not required by law, such data will be securely deleted, anonymized, or otherwise disposed of in a manner designed to prevent unauthorized access or misuse.

8. Data Security

Swapify implements reasonable technical and organizational measures to protect personal data against unauthorized access, misuse, alteration, disclosure, or destruction. We are committed to maintaining the confidentiality, integrity, and availability of personal data processed through our platform in accordance with applicable legal requirements.

Our security measures include the use of Secure Socket Layer (SSL) encryption to protect data transmitted through our website, restricted access controls to limit data access to authorized personnel only, secure cloud hosting infrastructure, password-protected systems, and periodic monitoring of our platform to detect potential vulnerabilities or suspicious activity. Access to personal data is granted strictly on a need-to-know basis and subject to appropriate confidentiality obligations.

Payment-related information is processed through authorized third-party payment gateways that are required to implement industry-standard security safeguards. Swapify does not store full payment card details on its servers. We take reasonable steps to ensure that third-party service providers engaged by us maintain appropriate data protection and security measures.

While we endeavor to implement commercially reasonable safeguards to protect personal data, no method of transmission over the internet or method of electronic storage is completely secure. Users acknowledge that the transmission of information to and from our platform is at their own risk. In the event of a data breach that is likely to result in significant harm, we will take appropriate remedial steps and comply with applicable notification requirements under law.

We periodically review and update our security practices to align with evolving technological standards and legal obligations.

9. Rights of Users (Data Principals) under the DPDP Act

Under the DPDP Act, individuals whose personal data is processed by Swapify are recognized as “Data Principals” and are entitled to certain statutory rights in relation to their personal data. Swapify is committed to facilitating the exercise of these rights in a transparent and timely manner, subject to verification of identity and applicable legal limitations.

Users have the right to request confirmation as to whether their personal data is being processed and to seek access to a summary of the personal data being processed, along with information regarding the purposes of processing and the categories of recipients with whom such data has been shared. Users also have the right to request correction, completion, or updating of inaccurate or outdated personal data.

Where personal data is no longer necessary for the purposes for which it was collected, or where consent has been withdrawn, users may request erasure of such personal data, subject to legal or regulatory retention requirements. Users have the right to withdraw consent previously provided for processing of personal data, and such withdrawal shall not affect the lawfulness of processing carried out prior to withdrawal. However, withdrawal of consent may impact our ability to provide certain services.

In accordance with applicable law, users also have the right to nominate another individual to exercise their rights in the event of death or incapacity. Additionally, users have the right to seek grievance redressal if they believe that their personal data has been processed in a manner inconsistent with applicable law or this Privacy Policy.

Requests relating to the exercise of these rights may be submitted using the contact details provided in Clause 2 of this Privacy Policy. 

We may require reasonable verification of identity before responding to such requests and will endeavor to respond within the timeframes prescribed under applicable law.

10. Grievance Redressal Mechanism

Swapify has established a grievance redressal mechanism in accordance with the DPDP Act to address concerns or complaints relating to the processing of personal data. Users who have questions, concerns, or complaints regarding the handling of their personal data may contact our designated Grievance Officer by writing to using the contact details provided in Clause 2 of this Privacy Policy or by contacting us at the phone number provided in this Privacy Policy.

Upon receipt of a grievance, we will acknowledge the complaint within 48 hours and take appropriate steps to investigate and address the concern in accordance with applicable law.

We endeavor to resolve grievances in a fair, transparent, and timely manner. Where required, we may seek additional information from the user to verify identity or better understand the nature of the complaint.

If a user is not satisfied with the resolution provided by us, the user may have the right to escalate the matter to the Data Protection Board of India or any other competent authority as prescribed under applicable law, subject to statutory procedures.

We are committed to maintaining accountability and continuously improving our data protection practices to ensure that user concerns are handled responsibly and effectively.

11. Children’s Privacy

Swapify’s services are intended for individuals who are eighteen (18) years of age or older. We do not knowingly collect or process personal data of children. Users are required to ensure that they are legally competent to enter into binding contracts under applicable law before creating an account or placing orders on our platform. If we become aware that

personal data of a minor has been collected without appropriate authorization, we will take reasonable steps to delete such data promptly. 

Parents or legal guardians who believe that a child may have provided personal data to us may contact us at using the contact details provided in Clause 2 of this Privacy Policy.

12. Changes to This Privacy Policy

Swapify reserves the right to modify, update, or revise this Privacy Policy from time to time to reflect changes in our services, operational practices, legal requirements, or technological developments. Any updated version of this Privacy Policy will be posted on our website with a revised “Effective Date.” Users are encouraged to review this Privacy

Policy periodically to stay informed about how we process and protect personal data.

Continued access to or use of our services after the publication of changes constitutes acceptance of the updated Privacy Policy.

13. Contact Information

For any questions, requests, concerns, or communications relating to this Privacy Policy or the processing of personal data, users may contact Swapify using the contact details provided in Clause 2 of this Privacy Policy. We are committed to addressing privacy-related inquiries in a responsible and timely manner.

14. Governing Law and Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the laws of India. Any dispute, claim, or controversy arising out of or relating to this Privacy Policy, including issues relating to the processing of personal data, shall be subject to the exclusive jurisdiction of the competent courts located in Mumbai, Maharashtra, unless otherwise required under applicable law. Nothing in this clause shall limit any statutory rights available to Data Principals under the DPDP Act.

15. Limitation of Liability

To the fullest extent permitted under applicable law, Swapify shall not be liable for any indirect, incidental, consequential, special, or punitive damages arising out of or relating to the use of its website or services, including but not limited to loss of profits, loss of data, loss of business opportunity, or reputational harm, even if advised of the possibility of such damages.

While we implement reasonable technical and organizational safeguards to protect personal data, users acknowledge that no method of transmission over the internet or method of electronic storage is completely secure. Accordingly, Swapify shall not be liable for unauthorized access to or alteration of personal data resulting from circumstances beyond our reasonable control, including but not limited to cyber-attacks, technical failures, third-party service provider failures, or force majeure events.

Nothing in this Privacy Policy shall limit or exclude liability where such limitation or exclusion is prohibited under applicable law, including liability arising from willful misconduct, fraud, or statutory violations.