Effective 15 July 2026
Draft — pending legal review
This page describes how the app actually works today, but has not yet been reviewed by a lawyer. Don't treat it as final until this notice is removed.
29 Grams — The Tandoor Co. ("we", "us") operates 29 Grams — Sector 141, Noida, located at Shop No. 12, Chauhan Market, Sector 141, Noida, Uttar Pradesh 201305, India. This policy explains what personal data we collect through this app, why, and what rights you have over it under India's Digital Personal Data Protection Act, 2023 ("DPDP Act").
Account data: your phone number (used to sign you in via a one-time code), and optionally your name, email, and saved addresses.
Order data: what you order, your delivery/pickup/dine-in details, order history, and any cooking notes you add.
Payment data: we never see or store your card, UPI, or bank details — payments are processed directly by Razorpay, and we only receive a payment reference and status.
Loyalty data: your Clay Coins balance and transaction history, and any vouchers you use.
Feedback: ratings and comments you submit after an order.
Technical data: device/browser information and app usage, collected only to keep the service working reliably — not sold or used for advertising.
We collect and use your data only to: verify your identity and prevent fraud (phone OTP), take and fulfil your orders, process payments and refunds, run the Clay Coins loyalty program, respond to feedback, and meet our legal obligations (GST invoicing, tax records).
By creating an account, you consent to this processing for these stated purposes. You can withdraw consent at any time by deleting your account (Account → Delete Account), which removes your profile and anonymizes your past orders — we retain anonymized order records for the period Indian tax law requires (see §6), but they can no longer be linked back to you.
We share the minimum necessary data with the third parties that help us run the service, and with no one else:
Razorpay (payment processing) — your order amount and contact details, to process payment; they never receive this from us for any other purpose.
PetPooja (kitchen order management) — your order details, so the kitchen can prepare it.
MSG91 (SMS delivery) — your phone number, solely to deliver one-time login codes.
Amazon Web Services (AWS) — our hosting provider; all data is stored encrypted, in India (ap-south-1 / Mumbai region).
We never sell your personal data.
Paid order records (including GST invoices) are retained for 72 months as required under Indian GST rules, even after account deletion — these are anonymized on deletion, not erased, since the law requires the transaction record itself to persist.
Account profile data (name, saved addresses, favorites) is retained until you delete your account, or after a long period of inactivity.
OTP verification codes are never stored in plain text and expire within minutes.
Under the DPDP Act, you have the right to access, correct, and request erasure of your personal data. You can view and edit most of your data directly in Account settings, and delete your account entirely at any time.
For anything you can't do yourself in the app, contact us using the details in §8 and we'll respond within a reasonable time.
Your data is encrypted in transit (TLS) and at rest. Access to production data is limited to what's needed to operate the service. We never log your full phone number, address, or payment details in plain text in our systems.
For any privacy question, complaint, or data request: +91 87969 58777, or write to us at Shop No. 12, Chauhan Market, Sector 141, Noida, Uttar Pradesh 201305, India.
If we materially change how we handle your data, we'll update this page and the effective date above.