Privacy Policy

1. Introduction

Aquacart Enterprises, operating under the brand “AquaCart” (“AquaCart,” “we,” “us,” or “our”), provides on-demand and subscription delivery of packaged drinking water, cans, and bottles through our mobile application and website (together, the “Platform”). We are committed to protecting your personal data and being transparent about how we handle it.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and the choices and rights available to you. We process personal data in accordance with the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), the Information Technology Act, 2000 and the rules thereunder, and other applicable laws of India. By creating an account or using the Platform, you acknowledge that you have read and understood this Policy.

Under the DPDP Act, you are the “Data Principal” and AquaCart is the “Data Fiduciary” that determines the purpose and means of processing your personal data.

2. Information We Collect

3. How We Use Your Information

• Creating and securing your account and verifying your identity.
• Fulfilling your orders and subscriptions, and routing deliveries to a serviceable warehouse.
• Processing payments, operating your wallet, and managing refundable can deposits and returns.
• Sending you service communications, such as order confirmations, delivery status, delivery reminders, and low-balance notices, by push notification, WhatsApp, or email.
• Providing customer support and responding to your requests.
• Detecting, preventing, and addressing fraud, abuse, and security issues.
• Operating, maintaining, analysing, and improving the Platform and our services.
• Complying with legal, tax, accounting, and regulatory obligations, and enforcing our terms.
• Sending promotional messages, where you have consented; you can opt out at any time.

4. Legal Basis for Processing

We process your personal data on the basis of your consent and for the “legitimate uses” recognised under the DPDP Act, including where processing is necessary to provide a service you have requested, and to comply with legal obligations. Where we rely on your consent (for example, for location access or promotional messages), you may withdraw it at any time; withdrawing consent will not affect processing carried out before the withdrawal, and may limit features that depend on that data.

5. How We Share Your Information

We do not sell your personal data. We share it only as needed to run our service, with:

• Payment processor: Razorpay, to process payments, refunds, and wallet recharges.
• Delivery personnel: the name, delivery address, contact number, and order details needed to complete your delivery.
• Cloud and infrastructure providers: Amazon Web Services, which hosts our application and stores data on our behalf within India.
• Google / Firebase: for map and address look-ups and for delivering push notifications.
• Meta (WhatsApp Business Platform): to send one-time passwords and order updates and to receive your support messages.
• Email provider: to send transactional emails such as receipts and order updates.
• Professional advisers and auditors: such as accountants and legal advisers, under confidentiality obligations.
• Legal and government authorities: where required by law, legal process, or to protect our rights, users, or the public.
• In a business transfer: if AquaCart is involved in a merger, acquisition, or sale of assets, subject to this Policy.

We require the service providers who process data on our behalf to protect it and to use it only for the purposes we specify.

6. Payment Security

All payments are handled by Razorpay, a PCI-DSS compliant payment gateway. Sensitive payment credentials are collected and processed directly by Razorpay and are not stored on our servers. We recommend you also review Razorpay's privacy policy.

7. Data Retention

We keep your personal data for as long as your account is active and as needed to provide our services. When you delete your account, we remove your personal profile data after a 15-day recovery window (see Section 8). However, records of your orders, invoices, payments, and taxes are retained in an anonymised form (no longer linked to your identity) for the period required under applicable tax, accounting, and company-law obligations, after which they are permanently deleted. One-time passwords and similar security tokens are short-lived and expire automatically.

8. Deleting Your Account

You can request deletion of your account and personal data at any time, either from within the app (Profile → Edit profile → Delete account) or from the Delete Account page linked at the end of this Policy. To protect you, we verify the request with a one-time password sent to your registered mobile number.

• Your account is deactivated immediately and your active subscriptions are cancelled.
• You have a 15-day grace period during which you can restore your account simply by logging back in.
• After the grace period, your personal data (name, email, phone number, saved addresses, and communications) is deleted or anonymised. Financial and tax records are retained in anonymised form for the period described in Section 7.
• Before deletion can proceed, you may need to settle any outstanding items, such as using up a wallet balance, returning cans held on deposit, or waiting for an in-progress order to be delivered.

9. Data Security

We use reasonable technical and organisational safeguards to protect your personal data, including encryption of data in transit (HTTPS/TLS), secure storage of authentication tokens, access controls that limit who can view your data, and hosting with a reputable cloud provider. While we work hard to protect your information, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Where Your Data Is Stored

Your personal data is primarily stored and processed on cloud infrastructure located in India. Some of our service providers (such as Google and Meta) may process limited data outside India in accordance with their own terms and applicable law; where they do, we take steps intended to keep your data protected.

11. Your Rights

Subject to applicable law, you have the right to:

• Access and obtain a summary of the personal data we hold about you.
• Correct or update inaccurate or incomplete data (you can edit your profile in the app).
• Request erasure (deletion) of your personal data, as described in Section 8.
• Withdraw a consent you previously gave, and opt out of promotional communications.
• Nominate another individual to exercise your rights in the event of your death or incapacity.
• Register a grievance and seek redressal (see Section 15).

You can exercise most of these rights directly in the app, or by contacting us using the details below. We may need to verify your identity before acting on a request.

12. Marketing Communications

We send service (transactional) messages that are necessary to operate your account and deliveries. We send promotional messages only where permitted, and you can opt out of them at any time without affecting essential service communications.

13. Children's Privacy

The Platform is intended for users aged 18 and above and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us so we can take appropriate steps.

14. Cookies and Third-Party Links

Our website uses only the cookies and similar technologies necessary for it to function and to keep it secure; we do not use them for third-party advertising. Our services may contain links to third-party sites or services that we do not control and that have their own privacy practices; we encourage you to review their policies.

15. Grievances and Contact

If you have questions about this Policy or wish to exercise your rights or raise a grievance, you can contact our Grievance Officer:

• Company: AquaCart Enterprises
• Grievance Officer: Anil Kumar
• Email: support@aquacart.store
• Phone: +91-9972488362
• Address:
  B2-505, Wonderwall, Sompura Village, Sarjapura Road, Bengaluru, Karnataka - 562125

We will acknowledge your request within a reasonable time and endeavour to resolve it within the timelines required by applicable law.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or the law. When we make material changes, we will update the effective date at the top and, where appropriate, notify you. Your continued use of the Platform after an update means you accept the revised Policy.