Privacy Notice
Version 2026-10-13 · Last updated 13 October 2026
1. Who we are
WicketKart is a hyperlocal delivery platform in New Delhi, India, connecting customers with local stores, riders and service providers. For the personal data described here, WicketKart is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). This notice explains what we collect, why, who we share it with, how long we keep it and your rights.
2. Customers — what we collect, why, and for how long
| Data | Why we use it | How long we keep it |
|---|---|---|
| Email, password (handled by AWS Cognito — we never see it), optional mobile number | Create and secure your account, log you in, send order and account emails | Until you delete your account |
| Name, phone, delivery addresses and landmarks (e.g. nearby place) you save or enter at checkout | Deliver your order; the store and rider see what they need to fulfil it | Profile: until you delete it. On orders: see "Order records" |
| Optional profile details: date of birth, gender, profession, city | Only to personalise your account — you can leave them blank | Until you remove them or delete your account |
| Order records: items, prices, payment method/status, delivery status, ratings, cancellations, refunds | Process, deliver, support and refund orders; accounting and GST | As long as tax and accounting law requires (generally up to 8 years). If you delete your account, they are anonymised instead of deleted |
| Order reliability indicators (e.g. repeated cancellations or refused cash-on-delivery orders) | Prevent fraud and losses — may restrict cash-on-delivery for an account. You can ask us to review this | While relevant, reviewed at least yearly |
| Quality complaints and the photos you upload with them | Investigate and resolve the complaint, refund where due | Up to 1 year after the complaint is closed |
| Delivery proof photo (the package at your door), delivery OTP checks | Prove delivery and settle disputes | Up to 1 year |
| Push-notification subscription (only if you turn notifications on) | Send order updates to your device | Until you turn them off or delete your account |
| Property / service enquiries: name, phone and the listing you asked about | Connect you with the property owner or service provider you chose | Up to 1 year after the enquiry |
| Technical data: IP address, browser type, error logs | Security, fraud prevention, fixing problems | 1 year |
We collect only what is needed for these purposes. We do not sell your personal data and do not use it for advertising.
3. Riders and store partners
| Data | Why we use it | How long we keep it |
|---|---|---|
| Riders: name, phone, alternate/emergency contact, present and permanent address | Onboarding, contacting you on duty, safety | While you work with us + up to 3 years after (disputes) |
| Riders: Aadhaar (we check the full number once, then keep only the last 4 digits), driving licence, vehicle registration and insurance details | Identity and eligibility checks required to deliver orders. Visible only to our admins | While you work with us; removed automatically 6 months after you stop working with us |
| Riders: live GPS location — only while you are on duty with the app open | Assign nearby orders, show delivery progress to the customer and admin | Live location auto-deletes after 24 hours |
| Riders: attendance, shifts, deliveries, cash collected, deposits, UPI ID, earnings and payouts | Pay you correctly, reconcile cash, resolve disputes | As long as tax and accounting law requires (generally up to 8 years) |
| Store owners: name, contact details, store address, FSSAI/business details, UPI ID, settlements | List your store, route orders to you, settle payments | While you are a partner; financial records as tax law requires |
4. Our basis for using your data
We use your personal data on the basis of your consent, which you give when you sign up or when you accept this notice in the app, and for the legitimate uses the DPDP Act allows — for example where you voluntarily give us your details to fulfil an order, or where the law requires us to keep records (such as GST). You can withdraw consent at any time (section 8); this does not affect processing already done, and we may then be unable to deliver orders to you.
5. Who we share it with
- The store fulfilling your order and the rider delivering it see your name, phone number, delivery address and order details — only for that order.
- Customers see their rider's first name, phone number and live location during an active delivery.
- Service providers (Data Processors) who work for us under contract and may use the data only on our instructions:
| Amazon Web Services (AWS) | Hosting, database, file storage, login (Cognito), emails. Data is stored in the United States (AWS us-east-1, N. Virginia). |
| Razorpay | Online payments. We never receive your card or UPI PIN details. |
| Cloudflare | Domain name and network services for our website. |
| Wickzo (WhatsApp messaging) | Order status messages to your phone number on WhatsApp. |
| Map providers (Esri, OpenStreetMap / Nominatim, CARTO, MapmyIndia, Google Maps — depending on the map shown) | Showing maps and finding addresses. They receive your IP address, the map area viewed and any address text searched. |
We may also disclose data where the law requires it, for example to a court, tax authority or the police with a valid request.
6. Where your data is stored
Your data is stored on Amazon Web Services servers in the United States (AWS us-east-1, N. Virginia). Some service providers above may process data outside India. We only transfer data to countries not restricted by the Government of India under the DPDP Act.
7. How we protect it
- Encryption in transit (HTTPS) and at rest; passwords are handled only by AWS Cognito.
- Role-based access: customers, riders and store partners see only their own data; identity documents are visible only to admins.
- Encrypted backups kept separately, so data can be recovered after an incident.
- Access and error logs kept for 1 year to detect and investigate misuse.
If a personal data breach affects you, we will inform you and the Data Protection Board of India without delay, explaining what happened, the likely impact and the steps you can take.
8. Your rights
- Access — a summary of the personal data we hold about you and how we use it, and who we have shared it with.
- Correction and completion — fix anything wrong or incomplete (most details can be edited on your Profile page).
- Erasure — delete your account and personal data. Order records we must keep by law are anonymised instead.
- Withdraw consent — as easily as you gave it; notifications can be turned off on your Profile page.
- Grievance redressal — complain to our Grievance Officer (section 10).
- Nominate someone to exercise these rights if you die or become unable to.
In the app: Profile → Settings → Your data & privacy lets you download your data or delete your account straight away.
For anything else, email hyattyasir21@gmail.com from your registered email address. We will reply within 30 days.
9. Children
WicketKart is only for people aged 18 or over, and you confirm this when you sign up. We do not knowingly collect data about children. If you believe a child has given us their data, contact us and we will delete it.
10. Grievance Officer
Grievance Officer
Email: hyattyasir21@gmail.com
We acknowledge complaints within 48 hours and resolve them within 30 days.
If you are not satisfied with our response, you may complain to the Data Protection Board of India.
11. Cookies and browser storage
We use only what the app needs to work: your login session, cart, saved preferences and consent choice are stored in your browser's local storage. We do not use advertising or cross-site tracking cookies.
12. Changes to this notice
When we change this notice in a way that matters, we update the version number above and ask you to review and accept it the next time you use the app.
13. Language
To receive this notice in Hindi or another language listed in the Eighth Schedule to the Constitution of India, email hyattyasir21@gmail.com.