Legal
Privacy policy
We collect only what we need to run Yamunaa, deliver your orders and keep the community safe. We never sell your personal data. This policy explains what we collect, why, who sees it and how you control it, in line with the data protection laws of each country we serve, such as UK GDPR, EU GDPR, US state privacy laws like the CCPA, and India’s DPDP Act. Svayam Incarnation Limited, a company registered in the United Kingdom, is responsible for your data as the data controller.
On this page
What we collect
- Account: your name, mobile number and email if you add one.
- Orders: addresses, items, payment method type and order history. Card details are handled by our payment partners, not stored by us.
- Location: your precise location only when you allow it, to show delivery times and nearby stores.
- Content: reviews, photos, messages, follows and reactions.
- Device and usage: app version, device type, IP address and how you use Yamunaa, to keep it secure and working well.
- Sellers: identity documents, tax registration numbers such as a VAT number or GSTIN, bank details and licences, as needed by law.
Why we use it
- To take, deliver and support your orders, and process refunds.
- To show relevant products, stores and delivery times near you.
- To detect and prevent fraud, abuse and policy violations.
- To meet legal duties such as tax, KYC and law enforcement requests.
- To send order updates, and marketing only if you agree. You can opt out at any time.
- Where the law asks for a legal reason, such as under GDPR, we rely on our contract with you, our legal duties, our legitimate interest in keeping Yamunaa safe, or your consent.
Your rights
- See and download the personal data we hold about you.
- Correct or update it.
- Withdraw consent for optional uses such as marketing and location.
- Delete your account and data, except what we must keep by law, such as tax records for as long as each country requires.
- Object to or limit some uses, and opt out of targeted advertising or any sale or sharing of data as US state laws define it. We do not sell your data.
- Nominate someone to exercise your rights if you are unable to, where your local law allows it.
- Complain to us, and then to your data protection regulator, such as the ICO in the UK, your supervisory authority in the EU, your state attorney general in the US, or the Data Protection Board of India.
- Your exact rights depend on where you live. Where a local law gives you more rights than this policy, the local law wins.
Keeping it safe
Data is encrypted in transit and at rest, access is limited to people who need it, and we test our systems regularly. Your data may be stored and processed in the UK, the EU, India and other countries where we or our service providers work, with the safeguards the law requires. Where a country requires some data to stay within its borders, we keep it there. If a breach affects you, we will tell you and the authorities as the law requires.
How long we keep it
We keep data only as long as needed for the purpose it was collected, or as required by law. Chat messages are kept for 2 years, then deleted. Location data is kept for 30 days. Order and tax records are kept for as long as tax law requires in each country, usually 6 to 8 years.
Contact and local representatives
You can reach our Data Protection Officer at [email protected]. Where the law requires it, we also have a local contact, such as a data protection representative in the EU or a Grievance Officer in India. Their details for your country are listed in the app.