Privacy Policy

Good To Treat (“Good To Treat”, “we”, “us”) runs the Good To Treat mobile app, this website and the business portal used by partner stores. We decide how and why your personal data is used, so we are the “Data Fiduciary” under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”).

We only collect what we need to run the service:

• Account details — name, email address, phone number and country. If you sign in with Google, Apple or Facebook, we receive your name, email and an account identifier from that provider.
• Optional profile details — date of birth, gender, dietary preferences, preferred collection times, avatar and saved addresses, if you choose to add them.
• Location — the city or area you pick, and your device's location if you allow it, so we can show stores near you. We don't track your location in the background.
• Orders — the Surprise Bags you reserve, pickup times, cancellations, refunds, ratings and reviews.
• Payments — payment amounts, status and references. Card and UPI details are entered with our payment partners (Razorpay, Cashfree, PayU or Stripe) and are not stored by us; if you save a card, the partner stores it and we keep only a reference such as the last four digits.
• Wallet and invites — wallet points you earn or spend, your invite code, and who joined with it. To prevent invite abuse we keep an identifier of the device used to redeem an invite.
• Support — messages and photos you send in the support chat.
• Device and usage — device type, operating system, app version, notification token, and how the app is used and performs (screens viewed, crashes), collected through Firebase.
• Partner stores — for businesses: store and contact details, bank account details, identity and bank documents for verification, bags, orders and payouts.

• To create and secure your account and sign you in.
• To show Surprise Bags near you and let you reserve, pay for and collect them.
• To process payments, refunds, wallet points and invite rewards.
• To send order confirmations, pickup reminders and replies from support (you can turn off marketing notifications in the app).
• To help stores fulfil orders — the store sees your name and order, not your payment details.
• To verify partner stores and pay them.
• To keep the service safe, prevent fraud and abuse, fix bugs and improve the app.
• To meet legal, tax and accounting obligations.

We process your data on the basis of your consent (given when you create an account and when you allow permissions such as location or notifications) and for legitimate uses allowed by the DPDP Act, such as fulfilling an order you requested or complying with the law. You can withdraw consent at any time; this won't affect processing already done, but some features may stop working.

We don't sell your personal data. We share it only as needed to run the service:

• Partner stores — your name and order details, so they can hand over your bag.
• Payment partners — Razorpay, Cashfree, PayU and Stripe, to take payments and make refunds and payouts.
• Service providers — Google Firebase (sign-in, notifications, analytics, crash reports), Google Maps (location search and maps), Amazon Web Services (hosting, file storage and email), and an AI provider that helps answer support chats. They act on our instructions.
• Authorities — when required by law, court order or to protect rights and safety.
• A buyer or successor — if our business is reorganised, merged or sold, under the same protections.

Some providers may store or process data outside India. When they do, we use providers with appropriate safeguards and follow any restrictions the Government of India notifies under the DPDP Act.

• Account and profile data — while your account is open.
• Orders, payments and invoices — as long as tax and accounting laws require (generally up to 8 years).
• Support chats — up to 2 years after the conversation ends.
• Business verification documents — while the store is a partner and as required by law afterwards.

When data is no longer needed, we delete or anonymise it.

Under the DPDP Act you can:

• Get a summary of the personal data we hold about you and how it's used.
• Correct, complete or update your data — most of it directly in the app under Account details.
• Delete your account and personal data — in the app under Account details, or by contacting us. Records we must keep by law are retained only for that purpose.
• Withdraw consent you've given, for example by turning off location or notifications.
• Nominate another person to exercise your rights if you die or become unable to.
• Raise a grievance with us, and then with the Data Protection Board of India if you're not satisfied.

Good To Treat is meant for people aged 18 and over. We don't knowingly collect data from children; if you believe a child has created an account, contact us and we'll delete it.

We protect your data with reasonable security practices, including encrypted connections (HTTPS), encrypted storage for sensitive documents, access controls and regular reviews. No system is completely secure, so please keep your sign-in details private. If a personal data breach affects you, we'll notify you and the Data Protection Board as the law requires.

Our website uses only a few essential cookies. See our Cookie Policy.

We may update this policy as the service changes. We'll show the new date at the top and, for significant changes, tell you in the app before they apply.

Questions about your data: Good To Treat. Email: support@goodtotreat.com, or chat with us from Profile → Customer support in the app.

Grievance Officer: Grievance Officer, Good To Treat. Email: grievance@goodtotreat.com. We acknowledge complaints within 24 hours and aim to resolve them within 15 days.