Customer privacy · Customer terms · Refunds · Partner privacy · Partner terms · Partner KYC
CraNau Partner App — Privacy Policy
Last updated: 27 August 2026
Version: 2026-08-27
Operator / Data Fiduciary: CraNau India Private Limited (brand: CraNau)
Registered office: M.M. Choubey Ward, Behind Chaturvedi Complex, Katni, Madhya Pradesh 483501, India
Support / Privacy contact: support@cranau.com · Website: https://cranau.com
1. Introduction
1.1. This Privacy Policy ("Policy") explains how CraNau India Private Limited ("CraNau", "we", "us", or "our") collects, uses, stores, shares, and protects personal data when you use the CraNau Partner mobile application, partner dashboards, APIs, and related services (collectively, the "Partner Platform").
1.2. This Policy applies to restaurant and food partners, online store partners (grocery, pharmacy, electronics, fashion, stationery), home services partners, ride partners, delivery partners, and any other partner categories available on CraNau.
1.3. CraNau processes personal data in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and other applicable Indian laws.
1.4. By registering for or using the Partner Platform, you acknowledge that you have read this Policy. Where consent is required under applicable law, we obtain your consent through in-app flows, checkboxes, or the separate KYC & Verification Consent document.
1.5. This Policy should be read together with our Terms of Service and KYC & Verification Consent.
2. Roles and Definitions
2.1. For partner account data and KYC information, CraNau acts as a Data Fiduciary under the DPDP Act.
2.2. "Personal Data" means any data about an individual who is identifiable by or in relation to such data.
2.3. "Sensitive Personal Data" includes financial information such as bank account details, payment instrument details, and government-issued identity information processed for verification, to the extent classified as sensitive under applicable law.
2.4. "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
2.5. Where CraNau processes customer data on behalf of partners (for example, order fulfilment details), partners may act as independent data fiduciaries or processors for their own compliance obligations. Partners must handle customer data lawfully and only for order fulfilment purposes.
3. Personal Data We Collect
3.1. Depending on your partner category and onboarding stage, we may collect the following categories of personal data:
3.1.1. Identity and Contact Information
- Full legal name, business name, trade name;
- Mobile number, email address, WhatsApp / alternate phone if you provide it;
- Date of birth (where required);
- Photograph or profile image;
- Business address, service area, and store location;
- Authorized signatory and proprietor/partner details.
3.1.2. Government-Issued and Business Verification Data
- Aadhaar number (or masked/tokenized form), Aadhaar OTP verification results, and reference transaction IDs (via licensed partners only);
- PAN number and verification status;
- GSTIN, GST registration certificate, and validation results;
- FSSAI licence number and validation status (food partners);
- Drug licence numbers — Form 20, Form 21, and related pharmacy authorizations;
- Trade licence, shop establishment registration, or other local permits;
- Driving licence, vehicle registration certificate ("RC"), insurance, and permit details (ride and delivery partners);
- Professional or trade certifications and trade declarations (home services partners).
3.1.3. Financial and Payout Information
- Bank account holder name, account number, IFSC code, branch metadata;
- UPI ID;
- Payout history, settlement statements, tax deduction records;
- Onboarding fee payment records (₹99 + GST where applicable);
- Refundable security deposit records (delivery partners, ₹1,000–₹10,000 as chosen);
- Razorpay or other payment gateway transaction references, including monthly subscription auto-renewals and the 3% online payment pass-through.
The Partner Platform does not operate a CraNau Cash customer wallet. “Wallet” screens in the Partner App refer to payout, earnings, and deposit ledgers.
3.1.4. Business and Catalogue Data
- Menu items, product listings, prices, inventory, images, and descriptions;
- Prescription images or e-prescription references submitted by customers for pharmacy orders (processed for order fulfilment and compliance);
- Service catalogue, pricing, visit charges, and availability schedules;
- Ratings, reviews, and performance metrics.
3.1.5. Location Data
- Real-time GPS location while you are online or actively fulfilling ride, delivery, or home service orders;
- Pickup and drop-off locations for completed trips and deliveries;
- Store or kitchen location for merchant partners.
3.1.6. Device, Technical, and Usage Data
- Device model, operating system, app version, unique device identifiers;
- IP address, network information, and timestamps;
- App usage events, crash logs, and diagnostic data (Firebase Crashlytics);
- Push notification tokens (Firebase Cloud Messaging);
- In-app actions, session duration, and feature interactions.
3.1.7. Communications Data
- Messages sent and received through Gishti (in-app customer chat), which may be encrypted in the app;
- Support tickets, emails, and call records with CraNau support;
- Notifications and alerts sent to you.
3.1.8. Compliance and Security Data
- KYC audit logs, verification outcomes, and risk scores;
- Fraud signals, dispute records, and investigation notes;
- Consent records and policy acceptance timestamps (terms and privacy versions).
4. How We Collect Personal Data
4.1. Directly from you when you register, complete onboarding, submit KYC documents, update your profile, list products or services, communicate via Gishti, or contact support.
4.2. Automatically when you use the Partner Platform, including location data from your device sensors (with your permission), device information, and usage analytics.
4.3. From licensed third-party verification providers when we validate Aadhaar, PAN, GSTIN, FSSAI, drug licences, bank accounts, driving licence, or vehicle RC.
4.4. From payment partners such as Razorpay and banking partners when processing onboarding fees, deposits, subscriptions, and payouts.
4.5. From customers when they place orders, submit prescriptions (pharmacy), rate your service, or message you through Gishti.
4.6. From public or authorized regulatory databases for licence and registration validation.
5. Purposes of Processing and Legal Basis
5.1. We process personal data only for lawful purposes connected with the Partner Platform. Under the DPDP Act, we rely on your consent and/or legitimate uses permitted by law, including:
| Purpose | Examples |
|---|---|
| Partner onboarding and account management | Creating your account, category assignment, profile management |
| KYC, AML, and regulatory compliance | Identity verification, licence checks, audit trails |
| Order fulfilment and marketplace operations | Assigning orders, delivery bidding, service scheduling |
| Payouts and financial settlement | Bank/UPI transfers via Razorpay and partner banks |
| Subscription and fees | Auto-renew billing, GST invoices |
| Customer communication | Gishti chat, order updates, support |
| Safety and fraud prevention | Location tracking for active trips, abuse detection |
| Quality and performance monitoring | Ratings, SLA tracking, partner analytics |
| Legal and dispute resolution | Responding to authorities, chargeback investigations |
| Product improvement | App analytics, crash reporting, feature development |
| Marketing (with consent where required) | Partner programmes, promotions, surveys |
5.2. We do not process personal data for purposes incompatible with those described above without notifying you and obtaining additional consent where required.
5.3. Certain processing is necessary to perform our contract with you (Terms of Service) and to comply with legal obligations under Indian tax, food safety, pharmacy, transport, and financial regulations.
6. Location Data — Specific Notice
6.1. Ride partners and delivery partners must enable location access while online or fulfilling orders. This data is used to:
- Match you with nearby orders;
- Provide live tracking to customers;
- Calculate distances and estimated times;
- Verify trip completion and prevent fraud;
- Support safety incident investigation.
6.2. Home services partners may share location during active service visits when the feature is enabled.
6.3. We do not use background location for ride or delivery partners when you are marked offline, except where your device OS settings permit residual collection and applicable law allows it. You can control location permissions in your device settings; however, disabling required permissions may limit platform functionality.
6.4. Historical location data from completed trips and deliveries may be retained as described in Section 12 for dispute resolution and compliance.
7. Gishti Chat Data
7.1. Messages, attachments, and metadata exchanged through Gishti are stored on CraNau servers to enable communication, order support, and dispute resolution. Order-chat payloads may be encrypted in the app.
7.2. CraNau may review Gishti communications where required for safety, fraud prevention, quality assurance, or legal compliance, including when a customer uses Report a partner.
7.3. Do not share unnecessary personal data, payment credentials, or unlawful content in chat. Customers' personal data must be used only for fulfilling their orders.
7.4. Gishti data is not sold to third parties for advertising.
8. How We Share Personal Data
8.1. We share personal data only as necessary and with appropriate safeguards:
8.1.1. Licensed Verification Partners
Aadhaar OTP verification, PAN/GSTIN/FSSAI/drug licence validation, driving licence / RC checks, and bank account verification are performed through regulated third-party service providers authorized to conduct such checks.
8.1.2. Payment and Banking Partners
Razorpay, banks, and UPI infrastructure providers receive financial data necessary to process onboarding fees, deposits, subscriptions, payouts, and refunds.
8.1.3. Cloud and Technology Providers
Hosting on Microsoft Azure, Firebase (Crashlytics, Cloud Messaging), analytics, and customer support tools process data under contractual data protection obligations.
8.1.4. Customers
Limited partner information (business name, location, ratings, assigned delivery partner name/photo where applicable, live trip tracking) is shown to customers to facilitate orders.
8.1.5. Legal and Regulatory Authorities
We may disclose data when required by law, court order, government request, or to protect rights, safety, and property.
8.1.6. Business Transfers
In the event of merger, acquisition, or asset sale, personal data may be transferred subject to confidentiality and continued protection consistent with this Policy.
8.2. We do not sell your personal data to data brokers or advertisers.
8.3. International transfers, if any, will comply with DPDP Act requirements and applicable cross-border transfer rules notified by the Government of India.
9. Children's Data
9.1. The Partner Platform is not intended for individuals under eighteen (18) years of age.
9.2. We do not knowingly collect personal data from children. If we learn that data from a minor has been collected, we will delete it promptly.
10. Data Security
10.1. CraNau implements reasonable security safeguards, including:
- Encryption in transit using TLS/HTTPS;
- Encryption at rest for sensitive fields such as bank account details;
- Role-based access controls and authentication;
- Audit logging for KYC and payout operations;
- Periodic security reviews and key management practices;
- Employee and vendor confidentiality obligations.
10.2. No method of transmission or storage is completely secure. You are responsible for safeguarding your account credentials and device access.
10.3. Report suspected security incidents to support@cranau.com promptly.
11. Data Accuracy
11.1. Under the DPDP Act, you have the right to request correction of inaccurate or incomplete personal data.
11.2. You must keep your profile, licences, bank details, and catalogue information accurate and up to date. Inaccurate data may affect payouts, order assignment, and account standing as described in our Terms of Service.
11.3. To update your information, use in-app profile settings or contact support@cranau.com.
12. Data Retention
12.1. We retain personal data only as long as necessary for the purposes described in this Policy and as required by applicable law.
12.2. Illustrative retention periods:
| Data category | Retention approach |
|---|---|
| KYC and verification records | Minimum period required under AML, payment, and tax laws (often five to eight years or longer if mandated) |
| Transaction and payout records | As required under Income Tax, GST, and payment regulations |
| Gishti and support communications | Duration of account activity plus dispute/limitation period |
| Location and trip logs | Operational period plus fraud/dispute window |
| Consent and audit logs | As required for regulatory demonstration |
12.3. Upon account closure, we may retain certain records in anonymized or aggregated form, or as required by law, before secure deletion.
12.4. You may request erasure of personal data where permitted by the DPDP Act. Erasure may be limited where retention is required for legal compliance, pending disputes, or legitimate business needs.
13. Your Rights Under the DPDP Act
13.1. Subject to applicable law, Data Principals (individuals whose data we process) have the following rights:
- Right to access information about personal data processed and sharing activities;
- Right to correction of inaccurate or incomplete data;
- Right to erasure where processing is no longer necessary or consent is withdrawn, subject to legal exceptions;
- Right to grievance redressal through our Grievance Officer;
- Right to nominate another individual to exercise rights in the event of death or incapacity.
13.2. To exercise your rights, email support@cranau.com with your registered mobile number, partner ID, and a clear description of your request. We may verify your identity before responding.
13.3. We will respond within fifteen (15) days unless a longer period is permitted by law.
13.4. If you are dissatisfied with our response, you may escalate to the Data Protection Board of India once operational under the DPDP Act framework.
14. Consent Management
14.1. For processing based on consent (including KYC verification, location tracking while online, and optional marketing), you may withdraw consent at any time through in-app settings or by contacting support@cranau.com.
14.2. Withdrawal of consent may limit or terminate your ability to use features that require such processing (for example, KYC consent withdrawal may prevent payouts).
14.3. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
14.4. Detailed consent terms for verification checks are set out in the CraNau Partner KYC & Verification Consent.
15. Cookies and Similar Technologies
15.1. Partner web dashboards may use cookies, local storage, and similar technologies for authentication, session management, and analytics.
15.2. The mobile app may use device identifiers and SDKs for crash reporting, push notifications, and performance monitoring.
15.3. You can manage cookie preferences through your browser settings. Disabling cookies may affect web dashboard functionality.
16. Third-Party Links and SDKs
16.1. The Partner Platform may contain links to third-party websites or integrate third-party SDKs (payment, maps, analytics, Firebase).
16.2. Third-party services have their own privacy policies. CraNau is not responsible for their practices. Review Razorpay, map providers, Google Firebase, and verification partner policies where applicable.
17. Automated Decision-Making
17.1. CraNau may use automated systems for fraud scoring, order assignment, partner ranking, delivery bidding bounds, and risk-based payout holds.
17.2. These systems are designed to improve platform safety and efficiency. Significant adverse decisions may be reviewed upon request through support@cranau.com.
18. Google Play and Apple App Store Disclosures
18.1. This Policy is published to meet Google Play User Data and Apple App Store privacy disclosure requirements.
18.2. Data collected through the Partner App is used as described herein. Location, financial, contact, photos, and device ID data types are collected for the purposes stated above.
18.3. The Partner App requests permissions (location, camera, notifications, storage) only for features described in this Policy and in-app permission prompts.
18.4. For Apple App Store "Privacy Nutrition Labels" and Google Play "Data Safety" forms, map data categories to Sections 3, 6, and 8 of this Policy.
19. Grievance Officer
19.1. In accordance with the DPDP Act and IT Rules, the Grievance Officer for CraNau is:
| Field | Details |
|---|---|
| Name | Akshay Chaturvedi |
| Designation | Grievance Officer |
| support@cranau.com | |
| Address | CraNau India Private Limited, M.M. Choubey Ward, Behind Chaturvedi Complex, Katni, Madhya Pradesh 483501, India |
19.2. The Grievance Officer will acknowledge complaints within forty-eight (48) hours and endeavour to resolve them within fifteen (15) days, or within timelines prescribed under applicable law.
20. Changes to This Policy
20.1. We may update this Policy to reflect legal, technical, or business changes.
20.2. Material changes will be notified through the Partner App, email, or other reasonable means before or upon the effective date.
20.3. The "Last updated" date at the top indicates the latest revision. Continued use after changes constitutes acceptance where permitted by law.
21. Contact Us
For privacy questions, rights requests, or data protection concerns:
CraNau India Private Limited Email: support@cranau.com Registered office: M.M. Choubey Ward, Behind Chaturvedi Complex, Katni, Madhya Pradesh 483501, India Website: https://cranau.com
By using the CraNau Partner App, you acknowledge that you have read and understood this Privacy Policy.