Privacy Policy
Last updated: 2026-11-01
Draft — legal review is required before these details are final.
1. Who we are
Buyflit is a platform that connects customers with nearby shops. The legal entity operating Buyflit and its registered address are pending confirmation.
2. What we collect
The app and its service handle the following information when you use the related features. The data inventory lists the code and contract sources.
•
Account: mobile number and one-time code used for login; account name and email when supplied; profile image URL when an avatar is uploaded. Google sign-in may also be available when configured. Shop accounts can submit owner and business contact details, shop address and location, and optional GSTIN or FSSAI licence fields.
•
Location: delivery address details and coordinates; current location coordinates only when you choose a location feature that requests or selects them.
•
Orders and payments: selected products, quantities, delivery address, payment method, order status, payment status, and payment identifiers returned by the service.
•
Content you upload: profile avatar, shop logo or cover image, and product images through the image upload service.
•
Device and technical: access and refresh session tokens, selected app mode, app/platform state, and an Expo push token on supported native builds. No external client analytics or crash-reporting SDK was found in the frontend source scan; native unhandled errors may be written to the device or Metro console.
•
Notifications: Expo push token when notification registration is permitted, plus notification content and read state returned by the service.
3. Why we use it
The code uses this information to sign you in, save profile and delivery details, show local shops, place and manage orders, process payment status, upload images, and deliver notifications you have enabled.
4. Consent and legal basis
You choose whether to provide optional profile details and whether to grant location or notification permission. The exact legal basis for each data use needs review. This notice is written with India’s Information Technology Act, 2000 and applicable rules, the Digital Personal Data Protection Act, 2023, and the Digital Personal Data Protection Rules, 2025 in view. The DPDP Act has phased commencement; legal review must confirm which provisions apply on the date of use.
5. Location data
The app asks for device location when you tap “Use current location”. You can also choose a point on the map or enter an address. The selected location and coordinates are used for nearby shop serviceability and delivery. Saved delivery addresses are account records. You can deny or turn off location permission in your device or browser settings and select or enter an address instead.
6. Who we share data with
The app sends order and delivery details to the shop handling your order. Delivery partners receive pickup and drop details needed for delivery. Web checkout integrates Razorpay. Images are uploaded through the Cloudinary-backed image service. Depending on configuration and screen, maps use Google Maps JavaScript, Leaflet with CARTO tiles, and OpenStreetMap Nominatim for geocoding. OTP delivery uses MSG91 according to the API contract, and push notifications use Expo. The frontend is deployed on Vercel. The hosting provider for the API is not identified in the repository.
7. Retention
Retention periods by information type have not been confirmed.
8. Security
The app uses authenticated service requests and session tokens. A complete description of technical and organizational safeguards has not been verified.
9. Your choices and rights
You can correct profile information through profile settings, change location or notification permissions on your device, and request account deletion from Settings. For access, correction, erasure, consent withdrawal, or a privacy grievance, use the in-app controls or contact Buyflit using the details below. The request process and response times need confirmation.
10. Children
Buyflit is for people aged 18 and over. The service is not intended for children.
11. Cookies and local storage on the web
The web app uses browser local storage for app session and selected settings, including selected location and on-device merchant preview preferences. The API contract also describes an HTTP-only refresh-token cookie. No advertising or analytics cookie was identified in the frontend code scan.
12. Changes to this policy
The current version and update date appear above. How Buyflit will notify users about material changes is pending confirmation.
13. Contact, grievance officer and data protection contact
The support and grievance contacts below will appear when their details are confirmed.