Privacy Policy
Last updated: July 13, 2026
This Privacy Policy explains how eBasket ("eBasket", "we", "us", "our") collects, uses, shares, and protects your personal data when you use the eBasket mobile application, the website www.e-basket.in, and related services (the "Platform"). It is published in accordance with the Information Technology Act, 2000 and the rules thereunder, and the Digital Personal Data Protection Act, 2023 (DPDP Act).
By using the Platform, you consent to the practices described in this Policy.
1. Data We Collect
1.1 Data you provide
Identity & contact
Mobile number (required, verified via OTP), name (optional), email address (optional).
Delivery addresses
Address label, street, building/floor/house number, city, state, PIN code, receiver name and receiver phone number, and the location coordinates of the address.
Orders & preferences
Cart contents, wishlists, order history, order notes, coin redemptions.
Reviews & ratings
Product ratings, review text, photos you upload, and delivery-partner ratings.
Support & requests
Communications with support, and the reason you provide (optional) when requesting account deletion.
1.2 Data collected automatically
Location data
Your device's precise location, only while you actively use the app — to check whether we deliver to your area, assign the nearest store, and calculate delivery fees. We do not track your location in the background.
Device & app data
Push notification token, device platform (Android/iOS), app version.
Usage & diagnostics
Crash reports and error logs (which may include your IP address, device information, and the request that failed), and app analytics events.
1.3 Data generated while fulfilling your orders
Payment records
Payment method, amount, status, and gateway transaction references (e.g., Cashfree order/payment IDs) and failure reasons. We never receive or store your card numbers, CVV, UPI PIN, or banking credentials — these are handled solely by the payment gateway.
Invoices
GST tax invoices generated for delivered orders.
Proof of delivery
A photograph of the delivered order captured by the delivery partner at your doorstep as delivery confirmation.
2. How We Use Your Data
- Account & login: verifying your mobile number via OTP and securing your account.
- Order fulfilment: processing orders and payments, assigning the nearest store, calculating delivery fees, coordinating delivery, and generating invoices.
- Serviceability: determining whether your location is within our delivery area.
- Communication: sending OTPs, order status updates, payment confirmations/refund updates, and service notifications (push/SMS/in-app).
- Rewards: operating the eBasket Coins program (welcome bonus, order rewards, coin codes, redemptions, and reversals).
- Quality & safety: handling complaints, returns, refunds, and delivery-partner ratings; investigating fraud and abuse.
- Improvement & reliability: diagnosing crashes and errors, analysing usage patterns, and improving the Platform.
- Legal compliance: maintaining tax, invoicing, and financial records as required by Indian law.
We do not use your personal data for third-party advertising, and we do not sell or rent your personal data to anyone.
3. Who We Share Data With
We share personal data only with service providers ("processors") who need it to run the Platform, under contractual confidentiality and data-protection obligations:
| Service provider | Purpose | Data involved |
|---|---|---|
| Cashfree Payments India | Online payment, UPI QR payment, and refund processing | Name, phone, email (if provided), order amount, customer ID |
| Message Central | Sending login OTPs via SMS | Mobile number |
| Google Firebase | App configuration and analytics | App instance identifiers, analytics events |
| Expo | Delivering push notifications | Device push tokens |
| Ably | Real-time order status updates in the app | Order status events tied to your account ID |
| Amazon Web Services (S3) / CDN | Storage of product images, review photos, delivery-proof photos, and invoices | Uploaded images, invoice PDFs |
| Neon (PostgreSQL cloud) | Primary database hosting | Account and order records |
| Sentry | Crash and error monitoring | Error logs, which may include IP address and device/request metadata |
| Delivery partners | Fulfilling your delivery | Receiver name, delivery address, phone number, order contents, delivery location |
We may also disclose data where required by law, court order, or government authority, or to protect the rights, safety, and property of eBasket, our users, or the public.
4. Data Retention
| Data | Retention |
|---|---|
| Account profile (name, phone, email, addresses) | For as long as your account is active |
| Orders, invoices, payment and refund records | 5 years after the transaction, as required for tax, accounting, and legal compliance — retained even after account deletion |
| Delivery-proof photos | Retained for dispute-resolution purposes for a limited operational period, then deleted |
| Crash/error logs | Short-term, per our monitoring provider's rolling retention |
| Backups | Deleted data may persist in encrypted backups for up to 90 days before being purged |
5. Account Deletion
Option 1: Delete from the App (Self-Service)
Open the eBasket app and go to Profile → Delete Account. Follow the on-screen prompts to confirm your request.
Option 2: Request Deletion via Email
Email admin@e-basket.in from your registered contact, or include your registered mobile number in the email so we can verify your identity.
- Deletion requires all your orders to be completed (delivered, cancelled, or returned) first.
- Once requested, your account is immediately blocked from login, and deletion is processed within 30 days.
- After deletion, your personal profile data is removed; transaction records that we are legally required to keep (orders, invoices, payment records) are retained per Section 4 and not used for any other purpose.
- Unused coins are forfeited on deletion (they have no cash value).
6. Data Security
We protect your data using industry-standard measures, including:
- Encryption of all data in transit (HTTPS/TLS) across the app, website, and APIs.
- Token-based authentication and strict role-based access control — customers, delivery partners, store managers, and administrators can each access only the data their role requires.
- Cryptographic signature verification of all payment gateway callbacks.
- Time-limited, signed links for private files such as invoices.
- Hosting with reputed cloud providers with encryption at rest.
No system can be guaranteed 100% secure; in the unlikely event of a data breach affecting you, we will notify you and the authorities as required under the DPDP Act, 2023.
7. Your Rights
Under the DPDP Act, 2023 you have the right to:
- Access a summary of the personal data we hold about you.
- Correct inaccurate or incomplete data (name and addresses can be edited in the app).
- Erase your data (via account deletion, Section 5).
- Withdraw consent at any time, subject to which some Services (e.g., ordering) may become unavailable.
- Grievance redressal — raise a complaint with us, and if unresolved, with the Data Protection Board of India.
- Nominate an individual to exercise your rights in the event of death or incapacity.
To exercise any of these rights, email admin@e-basket.in from your registered contact. We respond within a reasonable time, and in any case within timelines prescribed by law.
8. Location Permission
The app requests location permission solely to check serviceability, assign the nearest store, auto-fill your delivery address, and compute delivery fees. Location is used only during active app sessions and is never collected in the background. You can deny the permission and enter your address manually, though serviceability checks still require address coordinates.
9. Cookies & Tracking
The mobile app does not use browser cookies. It uses in-app SDKs (analytics, crash reporting, push notifications) described in Section 3. The website uses only essential cookies/local storage necessary for it to function; we do not use advertising or cross-site tracking cookies.
10. Children's Privacy
The Platform is intended for users aged 18 and above. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.
11. Third-Party Links
The Platform may contain links to third-party sites or services (e.g., the payment gateway's checkout). Their privacy practices are governed by their own policies, which we encourage you to review.
12. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date reflects the latest version, and material changes will be notified via the app or website. Continued use of the Platform after changes take effect constitutes acceptance.
13. Grievance Officer & Contact
In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023:
Grievance Officer — eBasket
Shop No. 8, Mahendi Traders, Main Road, Fort Songadh, Dist. Tapi - 394670, Gujarat, India
Email: admin@e-basket.in
Grievances are acknowledged within 48 hours and resolved within the timelines prescribed by applicable law.