Privacy Policy

Effective: 10 September 2026

This Privacy Policy explains what information we collect from you, why we collect it, who we share it with, and how we protect it. It also tells you how you can access, update, or request deletion of your information, and the choices you have regarding how your data is used. We encourage you to read this policy carefully, so you understand how we handle your personal information when you use our platform.

We may update or revise this Privacy Policy from time to time to reflect changes in our services, how we process personal information, or to comply with applicable laws and regulations. Any updates will be effective from the date they are published on the platform, unless stated otherwise.

When we make material changes to this Privacy Policy, we will take reasonable steps to inform you in advance or at the time of the change, such as by posting a notice on our platform, sending an email, or using other appropriate communication methods.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Where required by applicable law, we will obtain any necessary consent before introducing a new purpose for processing your personal data.

1About nookstor

Nookstor (“we”, “us”, “our”, or “Platform”) is a private order-management platform, operated by Vizlux, a sole proprietorship registered in Pune, Maharashtra, that facilitates the connection and order between the vendor and customer invited by the vendor.

Vendors are independently responsible for the safety, hygiene, ingredients, and legality of what they sell. The platform facilitates the sharing and verification of payment information between the customer and vendor but does not itself receive or process the customer's payment. These payments are made over UPI.

Vendor-to-platform fee payments are processed through Razorpay. The platform earns revenue from vendors through:

• Vendor subscription plans: A one-time annual starter plan of ₹99 with 50 customer invitations; a three-month seasonal boost plan of ₹199 with unlimited invitations; or a permanent plan of ₹999 with unlimited invitations.
• Monthly platform fees: 3% of the value of verified prepaid orders under the starter plan, or 2% of the value of verified prepaid orders under the seasonal boost and annual plan.

2What data do we collect?

• Account: Mobile number (mandatory), first name, role (customer/vendor/both).
• Customer profile: Delivery address(es), notes for vendors, credit wallet balance.
• Vendor profile: Business name, type, city, description, FSSAI number (optional), photos, UPI ID for receiving payments, GST (optional), billing address (not visible to customers), shipping charges (default values).
• Menu content: Items, prices, options, availability, photos.
• Order data: Line items, options, prices, delivery date, delivery address, order status timeline.
• Payment screenshots: Image files uploaded by customer showing their UPI success screen; extracted fields (UTR, amount, timestamp). We also extract the receiver UPI ID to check if payment was made to the right vendor.
• AI verification result: Confidence score, extracted fields, verified/uncertain/rejected outcome.
• Referral graph: Information about who referred a customer or vendor to another customer or vendor.
• Credit ledger: Details of credits given to you and how those credits are used.
• Fee billing records: Details of platform fees, GST, credits applied and payment records.
• Reviews and ratings: Star rating (1–5), optional text review, timestamps.
• In-app messages: Text messages between a customer and a vendor scoped to their orders.
• Device / push tokens: Firebase cloud messaging device token, app version, operating system.
• Authentication session tokens: OTP-verified JSON web tokens.
• Diagnostic logs: Non-personally identifiable information — app and server logs, error traces.
• Technical and usage information: IP address, device identifiers, device type, operating system, app version, network information, approximate location information, usage information, log data, and other technical information generated when you use the platform.

3Who do we share your data with?

Note: We do not sell your personal data. We do not share your personal data with advertising networks for advertising purposes.

4Why do we collect your data?

We use your personal information to:

• Create and manage your account;
• Connect customers with vendors;
• Receive, manage and fulfil orders;
• Share necessary order information with the relevant vendor or customer;
• Verify payments and maintain payment records;
• Process vendor payments and platform fees;
• Provide customer and vendor support;
• Manage credits and referrals;
• Prevent fraud and misuse;
• Maintain and improve the platform;
• Send important account and order-related notifications;
• Resolve disputes and maintain appropriate records;
• Comply with applicable legal requirements; and
• Protect the security of the platform, detect and prevent fraud, unauthorised access, cyberattacks and other security threats, investigate suspicious activity, and maintain the reliability and integrity of our systems.

5How does AI verify your payment?

• There is no routing of payments by the platform. The customer makes the payment directly to the vendor through UPI.
• The customer is then asked to upload a screenshot of the successful payment in the app for verification.
• The screenshot may contain information such as the transaction reference number (UTR), payment amount, date and time, and the recipient's payment details.
• The AI only looks at the payment amount and UPI ID to check the payment against your order and to maintain records relating to the order.
• We do not permit the provider to use this information to train its general-purpose AI models, subject to the terms of our agreement with the provider.

6How are vendors mandated to use customers' data?

Vendors may receive certain customer information through nookstor, such as the customer's name, contact details, order details and delivery information.

Vendors must use this information only for purposes connected with the relevant order and in accordance with applicable law.

Vendors must take reasonable steps to keep this information secure and must not sell, misuse or use the information for unrelated marketing without the required consent or other lawful basis under applicable law.

7Where do we store your data?

• Primary database: AWS RDS PostgreSQL 15, hosted in the AWS ap-south-1 (Mumbai) region. Encrypted at rest via AWS KMS. Isolation between users is enforced at the application layer through a scoped-query helper.
• File storage (screenshots, vendor photos, product photos, QR codes): AWS S3, private buckets in ap-south-1 (Mumbai). Public bucket access is fully blocked at the AWS account level. Files are served through authenticated API endpoints that verify the caller's entitlement (the paying customer or the receiving vendor of the order) on every request. The underlying S3 URLs are never exposed to the client.
• Authentication: Custom OTP-based authentication. One-time codes are delivered via SMS through MSG91 (India-based, DLT-registered templates). We hold sessions using short-lived access tokens plus a rotating refresh token.
• Push notifications: Web Push (VAPID protocol, W3C standard). Delivered via the user's browser vendor (Google, Apple, Mozilla) or, for installed PWAs, the operating system's push service. Only opaque device push endpoints and message payloads leave our platform. Native Android and iOS push (FCM/APNs) is planned but not yet enabled.
• Payment processor (vendor platform fees): Vendor KYC, transaction records and settlement history live on Razorpay's systems. Customer-to-vendor order payments happen directly over UPI between the customer's bank and the vendor's bank; nookstor does not intermediate, hold, or have visibility into these funds.
• AI verification service: Groq uses the qwen/qwen3.6-27b vision model, hosted in the United States, to verify payments. For each verification request, we send only the payment screenshot and a structured extraction prompt. We do not send the customer's name, phone number, account history, or other account-wide data. Under our agreement with Groq, our data is not used to train its models.
• Analytics: None at MVP. No Google Analytics, no Meta pixel, no advertising SDKs, no third-party session-recording tools. All operational metrics are computed in-house from our platform data.
• Diagnostic logs: Application logs (request paths, error stack traces, structured event context) are retained for 30 days on AWS CloudWatch and then automatically deleted.

Note: Most user data stays in India (AWS Mumbai region). When data leaves India, two categories of processing may occur:

• First, payment-screenshot images are sent to Groq's AI verification service (United States) for verification. The image is the only payload; no account-wide data accompanies it.
• Second, content delivery via AWS CloudFront's global edge network may route requests through non-India edges. No user data is stored at these edges; they only accelerate delivery of already-encrypted content.

Where a cross-border transfer of personal data occurs, we comply with applicable law, including the Digital Personal Data Protection Act (DPDP), 2023, and any contractual data-protection requirements with the relevant service provider.

8What are your rights?

As per the Digital Personal Data Protection Act, 2023, you may have the right to:

• Request information about your personal data;
• Request correction of inaccurate or incomplete personal data;
• Request deletion of your personal data where applicable;
• Withdraw consent where processing is based on consent;
• Raise a grievance regarding our processing of your personal data; or
• Nominate another person to exercise your rights in accordance with applicable law.

Note: To exercise these rights, you can contact our Grievance Officer at support@nookapp.store. We may ask for information necessary to verify your identity and locate your account before processing your request.

9How do we protect your data?

• Encryption in transit: We use TLS to protect all communications between clients, servers, and third-party processors, including the payment gateway, SMS provider, and AI verification service.
• Encryption at rest: Our primary database (AWS RDS PostgreSQL) is encrypted at rest using AWS Key Management Service. Uploaded files, including payment screenshots, menu photos, and QR images, are stored in AWS S3 with server-side encryption enabled by default.
• Access control: Users sign in with a phone number and one-time code. Because the platform does not use passwords, there are no passwords to leak or reuse.
• Data isolation: Every database read and write passes through an application-layer scoped-query helper that applies the owner filter from the authenticated session, not from a client-supplied identifier. Customers cannot access other customers' orders, and vendors cannot access other vendors' data. This control is enforced in code across every data class.
• Admin access: Admin access is protected by a secret known only to the platform operator. Sensitive admin actions involving orders and credits are recorded in an append-only audit log, with additional audit-log coverage being rolled out.
• Payment screenshots: Payment screenshots and other personal information are stored in a private object store. They are streamed to a viewer only after the server verifies that the viewer is part of the underlying order, either as the paying customer or receiving vendor.
• Testing: Before launch, an automated cross-user isolation test runs against a real database to confirm that user A cannot access user B's data through any exposed data class. The test is repeated after every code change.
• Incident response: If we become aware of a personal data breach, we will take reasonable steps to contain, investigate, and resolve it, and will notify affected individuals and authorities where required by applicable law.

10How long do we keep your data?

We retain personal data only for as long as needed for the purposes described in this policy, or for any longer period required by applicable law, including tax and accounting record-keeping obligations. Some retention periods below reflect our current operational commitments, while others describe intended policies that depend on deletion tools still being built. Until those tools are fully implemented, we will follow these commitments as the functionality is rolled out.

• Account: We intend to erase or anonymise account data within 30 days of account deletion, subject to legal holds (for example, tax records tied to your past orders). Automated account deletion is being built; until it ships, users who wish to close their account may contact support@nookapp.store and we will action the request manually.
• Customer profile: Retained while the account is active.
• Vendor profile: Retained while the account is active. UPI ID is only displayed to customers linked to that vendor's private circle; it never appears on any public page or search result.
• Menu content: Retained while the account is active.
• Order data: Retained for 8 years from order completion, in line with tax and accounting record-keeping requirements under applicable Indian law.
• Payment screenshots: We intend to retain payment screenshots for no longer than 12 months after order completion. Automated purge of older screenshots is being built; until it ships, screenshots may be retained beyond this window in our private object storage, accessible only to the paying customer, the receiving vendor, and (where necessary for support or dispute resolution) authorised admins.
• AI verification result: Retained alongside the associated order, up to 8 years, matching order data.
• Referral graph: Retained for 8 years for credit-earning reconciliation and dispute resolution.
• Credit ledger: Retained for 8 years. Credit balances and transaction history are append-only to preserve auditability.
• Fee billing records: Retained for 8 years, in line with tax and accounting record-keeping requirements.
• Reviews and ratings: We intend to retain reviews for as long as the vendor account is active and remove them when the vendor account is closed. Automated review removal on vendor closure is being built; until it ships, reviews may persist beyond vendor account closure.
• In-app messages (customer to vendor notes on orders): We intend to retain in-app messages for no longer than 24 months. Automated deletion of older messages is being built; until it ships, messages may be retained beyond this window in the order thread and are visible only to the two parties on that order.
• Device / push tokens: Refreshed on each session. Tokens explicitly invalidated on user logout are deleted immediately. Tokens for uninstalled apps eventually expire at the browser or OS push-service level; we treat any push endpoint that returns a permanent-failure response as invalidated and remove it from our records.
• Authentication session tokens: Access tokens are short-lived (rotating refresh). All session tokens are invalidated on user logout.
• Diagnostic logs: Automatically deleted after 30 days (rolling window). This is enforced at the log-storage layer, not by application code.

Note: Where a longer retention period is required for legal, regulatory, tax, dispute-resolution or fraud-prevention purposes, we may retain the affected data for that longer period notwithstanding the above.

11Can a person under the age of 18 create a nookstor account?

Nookstor is not intended for use by children under 18 years of age. We do not knowingly allow children under 18 to create accounts or provide personal data through the platform.

12Who is your point of contact?

• Name: Reshma Kulkarni
• Designation: Grievance Officer
• Contact e-mail: support@nookapp.store
• Location: Pune
• Response time: We aim to acknowledge complaints within 48 hours and resolve them within 30 days, or within such a longer period as may be permitted under applicable law.