Privacy
What One India knows about you, why, who else sees it, and how to make us forget.
01Who is responsible
Just InstaStack Technology Private Limited, Thane, Maharashtra, India, is the data fiduciary for the One India buyer app. Questions and requests: support@instastack.io.
02What we collect
Your mobile number (to sign you in). Your name and the addresses you save, with a map pin, so shops can deliver. Your orders: what you bought, from whom, what you paid, deliveries, cancellations, returns, refunds and complaints, with any photos you attach to a return or complaint.
From your phone: the area you shop in (you choose it, or let the app find it), a notification token so we can tell you about your order, and the app's language. We ask for location only to set your delivery area, notifications only to update you about orders, and the camera or photos only when you attach a picture.
We do not collect your card, bank or UPI details — Razorpay does, under its own policy. We run no advertising and no analytics trackers in the app.
03Why
To sign you in, show shops that deliver to you, place and track your orders, take and refund payments, handle returns and complaints, and keep the records the law asks for. We do not sell your data and do not use it for advertising.
04Who else sees it
The shop you order from, and the delivery partner carrying the order, get what they need for that order: your name, phone number, delivery address, pin and the items. This happens over ONDC, one order at a time — that is how an open network works.
If you raise a complaint, its details and photos go to the shop and, if escalated, through ONDC's grievance system. Razorpay processes payments and refunds. Google shows the map and the pin you place. Google Firebase delivers notifications. A messaging provider delivers your sign-in code. Each gets only what its job needs. We share with authorities only when the law requires it.
05Where and how long
Your data is stored in India, in Mumbai: our servers run on Google Cloud and our database on MongoDB Atlas (Amazon Web Services), and it is encrypted in transit. Sign-in codes are deleted within a day; a sign-in lasts up to 90 days on a phone unless you sign out.
Order, payment, refund and complaint records (including photos attached to them) are kept as long as tax and consumer law require, because they are also the shops' records. Everything else goes when you delete your account.
06Your rights
You can see and correct your name and addresses in the app, ask us for a summary of what we hold, withdraw consent by deleting your account, and name someone to act for you if you cannot. Write to support@instastack.io.
If we do not resolve a privacy concern, you can complain to the Data Protection Board of India.
07Deleting your account
See Delete your account — in the app, in a minute.
08Changes
If this policy changes, we tell you in the app first.