Privacy Policy

1. Introduction and Scope

1.1 Locleo is operated by Kharkar Brothers Private Limited, a private limited company incorporated in India and recognised as a startup by the Department for Promotion of Industry and Internal Trade (DPIIT) ("Locleo", "we", "us", "our"), which is the Data Fiduciary for the personal data described in this Policy. This Privacy Policy explains how Locleo collects, uses, shares, and protects personal information of Customers, Merchants, and Riders who use the Platform. It should be read together with the Terms and Conditions in Part A.

1.2 This Policy is framed with reference to the Digital Personal Data Protection Act, 2023 ("DPDPA"), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

2. Information We Collect

2.1 Collected from all users

• Mobile number (used for OTP-based sign-in and verification via our SMS provider, MSG91).
• Name and profile details provided at sign-up.
• Device and app-usage data (device model, OS version, app version, crash logs) for reliability and security.
• Communications with support.

2.2 Customer-specific

• Delivery addresses and saved locations.
• Order history, cart contents, and wishlist.
• Precise or approximate location, used to rank nearby Shops and estimate delivery — see Clause 4.
• Payment transaction identifiers from our payment gateway (Razorpay). Locleo does not store full card, UPI, or bank account numbers; these are handled directly by the gateway.
• Ratings and reviews submitted.

2.3 Merchant-specific

• Business and owner identity details: shop name, owner name, business address, category.
• Compliance documents: GSTIN, PAN, FSSAI licence, shopfront photographs, and other verification material submitted during onboarding.
• Bank account details (account holder name, IFSC, account number) for Payouts.
• Product catalogue data, pricing, and stock levels.
• Order fulfilment and dispute history.

2.4 Rider-specific

• Identity and licence documents, vehicle registration details.
• Real-time or last-known location while a Delivery Task is active, used for task assignment, live tracking, and delivery-time estimation.
• Bank account details for Payouts.
• Delivery completion history, ratings, and cash-reconciliation records.

3. How We Use Your Information

We use the information above to: create and secure Accounts; verify identity via OTP; process and fulfil Orders and Delivery Tasks; rank Shops and Products by proximity and relevance; process payments and Payouts; provide customer and merchant support; detect and prevent fraud; comply with legal and tax obligations; and improve the Platform's performance and features. We do not use Merchant or Rider financial data for any purpose beyond Payout processing and legally required reporting.

4. Location Data

4.1 Customer location (precise, if permission is granted, or a manually set address otherwise) is used to show nearby Shops, calculate delivery eligibility and fees, and route Orders.

4.2 Rider location is collected while a Delivery Task is active or the Rider is marked available, to assign nearby tasks and provide live tracking to the Customer and Merchant for that Order. Location is not collected when a Rider is offline.

4.3 Location permission can be withdrawn at any time through device settings; doing so may limit proximity-based features such as nearby-Shop discovery or live delivery tracking.

5. Sharing and Disclosure of Information

5.1 Between roles, as necessary to fulfil an Order. A Customer's delivery address and contact number are shared with the assigned Merchant and Rider only for the duration needed to fulfil that specific Order. A Rider's name and live location are shared with the Customer and Merchant only while a Delivery Task for that Order is active.

5.2 Service providers. We share data with the vendors who help operate the Platform, strictly for the purpose of the service they provide:

• MSG91 — mobile number, for OTP delivery and verification.
• Razorpay — payment details necessary to process a transaction.
• Our database and hosting provider (Supabase) — for secure storage of Platform data.
• Maps/geocoding providers — location coordinates, for address resolution and distance calculation.

5.3 Legal and safety. We may disclose information where required by law, court order, or government request, or where necessary to protect the safety of a user or the public.

5.4 Business transfers. If Locleo is involved in a merger, acquisition, or asset sale, user information may be transferred as part of that transaction, subject to the same protections described here.

5.5 We do not sell personal information to third parties, and we do not share Merchant compliance documents or Rider identity documents with any party other than those strictly necessary for verification and legal compliance.

6. Data Storage, Security, and Retention

6.1 Data is stored on secure, access-controlled infrastructure. Passwords are not used for authentication (Accounts are OTP-verified); access tokens are stored securely and rotated per session.

6.2 We apply reasonable technical and organizational measures — encryption in transit, restricted database access, and audit logging — to protect personal information from unauthorized access, alteration, or loss. No system is completely secure, and we cannot guarantee absolute security.

6.3 We retain Account and transaction data for as long as the Account is active and for a further period after closure as required for tax, audit, and dispute-resolution purposes under Indian law (typically up to 8 years for financial records). Location history tied to a specific Delivery Task is retained only as long as needed for that Order's support and dispute window, after which it is deleted or anonymized.

7. Your Rights and Choices

Subject to applicable law, you may: access and correct your Account information through the app; request a copy of your personal data; request deletion of your Account and associated data, subject to the retention obligations in Clause 6.3; and withdraw consent to location or notification permissions via device settings. Deletion requests can be made in-app or by contacting [email protected]; we will act on verified requests within the timeline required by the DPDPA.

8. Cookies and Tracking Technologies

The Locleo website and app may use cookies, local storage, and similar technologies to remember preferences (such as language and last-used location), keep a session signed in, and understand aggregate usage patterns. These do not include third-party advertising trackers. You can control cookies through your browser settings; disabling them may affect some website functionality.

9. Children's Privacy

The Platform is not directed at children under 18. We do not knowingly collect personal information from anyone under 18. If we learn that a user is under 18, the Account will be closed and associated data deleted, except where retention is required by law.

10. Third-Party Services

The Platform integrates the following third-party services, each governed by its own privacy policy in addition to this one: MSG91 (SMS/OTP delivery), Razorpay (payment processing), Supabase (data hosting), and mapping/geocoding providers (location resolution). We select vendors that meet applicable data-protection standards but are not responsible for their independent privacy practices.

11. Payment Data

Card, UPI, and net-banking details entered at checkout or during Payout setup are transmitted directly to our PCI-DSS-compliant payment gateway (Razorpay) and are not stored on Locleo's own servers in full. Locleo retains only transaction identifiers, amounts, and status needed for Order and Payout records.

12. Grievance / Data Protection Contact

Questions, complaints, or data-access requests relating to this Privacy Policy may be directed to the Grievance Officer at [email protected] or +91 94040 22850. We will acknowledge and address requests within the timeline required under applicable Indian data-protection law.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be notified in-app or via the registered contact number/email before they take effect. The "last updated" date on the published policy will reflect the most recent revision.

14. Contact Us

Kharkar Brothers Private Limited (operating Locleo)
Email: [email protected]
Phone: +91 94040 22850
Address: Amravati, Maharashtra, India