Privacy Policy
Last updated: 9 August 2026
This policy explains what Goodwala collects when you order from thegoodwala.in, why we collect it, and what you can ask us to do with it. It is written to be read, not to be survived.
What we collect
Only what is needed to bring food to your door:
- Your name — so the delivery reaches the right person.
- Your mobile number — to send order updates on WhatsApp and to call you if the delivery cannot be completed.
- Your delivery address, area, PIN code and landmark — to deliver the order.
- Any order notes you write — gift messages, timing requests. Whatever you put in that box, we read.
- What you ordered and what you paid — to pack it, and to keep the accounting records the law requires us to keep.
We do not ask you to create an account, we do not ask for your date of birth or gender, and we run no advertising or analytics trackers on this site. Your cart is kept in your own browser’s local storage until you check out; it is not sent anywhere before then.
What we never see
Your card, UPI or bank details. Payment is handled entirely by Razorpay inside their own secure window. Those details are entered on Razorpay’s systems and are never transmitted to, processed by, or stored on ours. We receive only a confirmation that a payment succeeded and a reference number for it.
Who else sees your information
- Razorpay, our payment gateway, receives your mobile number and name to process the payment and send you a receipt. Their privacy policy governs what they do with it.
- Supabase, our database provider, stores your order record on our behalf. They do not use it for anything of their own.
- Our delivery partner is given your name, address, landmark and mobile number for the delivery, and nothing else.
We do not sell your information. We do not rent it, trade it, or share it with anyone for marketing — ours or anybody else’s. If we are ever legally compelled to disclose something, we will, and we will tell you unless we are barred from doing so.
How long we keep it
Order records are kept for as long as we need them for tax and accounting purposes, which in India is eight years from the end of the relevant financial year. Orders that were started but never paid for are deleted automatically after twenty-four hours.
Your rights
Under the Digital Personal Data Protection Act 2023 you can ask us to show you what we hold about you, correct anything that is wrong, or delete it. Message us on WhatsApp and we will respond within thirty days. Deletion requests are honoured except where a record must be retained for the tax purposes above — in which case we will tell you exactly what is being kept and why.
Keeping it safe
The site is served over HTTPS. Order data sits behind row-level security with no public access policy, reachable only by our own server code. The admin panel is password-protected and its pages are never cached or indexed. No system is perfect, and we will not pretend otherwise — but the sensitive part, your payment details, is one we deliberately never hold in the first place.
Children
This shop is not intended for children under 18, and we do not knowingly collect their information.
Changes
If this policy changes we will update the date at the top. Material changes will be flagged on the site.
Contact
For anything about this policy, or to exercise any of the rights above, reach us on our contact page. Complaints are acknowledged within 48 hours and resolved within one month of receipt.