Customer privacy · Customer terms · Refunds · Partner privacy · Partner terms · Partner KYC

CraNau Customer Privacy Policy

Last updated: 27 August 2026

Version: 2026-08-27

Applies to: CraNau Customer App (Android and iOS), customer account features, and related support channels

Data fiduciary: CraNau India Private Limited (brand: CraNau)

Registered office: M.M. Choubey Ward, Behind Chaturvedi Complex, Katni, Madhya Pradesh 483501, India

Support: support@cranau.com

Website: https://cranau.com

1. Introduction

1.1. CraNau India Private Limited ("CraNau", "we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy ("Policy") explains how we collect, use, disclose, store, and protect personal data when you use the CraNau Customer App and related services (collectively, the "Platform").

1.2. This Policy is issued in compliance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and rules thereunder (including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, where applicable), the Consumer Protection Act, 2019, and applicable guidelines for mobile app marketplaces (Google Play and Apple App Store).

1.3. By using the Platform, you acknowledge this Policy. If you do not agree, please do not use the Platform. This Policy should be read together with our Terms of Service and Refund Policy.

1.4. CraNau acts primarily as a data fiduciary for personal data processed to operate the Platform. Certain Partners may act as independent data fiduciaries or processors for fulfilment data they receive; see Section 7.

1.5. The public website https://cranau.com collects partner and brand advertising quotations and district-franchise interview requests (name, mobile, state and district, outlet or brand name, and an optional note) and partner-enquiry data (name, mobile, state and district, role) so we can respond. Customer app installs use the Google Play and App Store links on the site. We do not sell that data. Email support@cranau.com to request deletion of a website lead.

2. Scope and roles

2.1. Who this Policy covers. This Policy applies to customers who register for or use the CraNau Customer App, website account or enquiry features, customer support, and marketing communications directed at customers.

2.2. Platform role. CraNau operates a multi-utility marketplace connecting you with restaurants, stores, pharmacies, transporters, and home-service Partners. We process data necessary to facilitate orders, payments, communications, and safety.

2.3. Children. The Platform is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. See Section 14.

2.4. Definitions. "Personal data" means any data about an individual who is identifiable by or in relation to such data, as defined under the DPDP Act. "Processing" includes collection, storage, use, disclosure, and deletion.

3. Personal data we collect

We collect personal data you provide, data generated through your use of the Platform, and data from third parties as described below.

3.1. Identity and account data

• Full name, display name
• Mobile phone number and email address
• Password hash (if you set a password) and authentication tokens
• One-time passwords (processed via CraNau’s OTP service and, where enabled, Firebase Phone Authentication)
• Gishti Circle anonymous username and trust / order-credit status

We do not currently offer social-network login (Google / Apple Sign-In).

3.2. Order and transaction data

• Order and booking history across utilities (food, shopping, rides, home services)
• Items, quantities, preferences, special instructions, and delivery notes
• Payment method type, Razorpay transaction IDs, amounts, refunds, COD flags, invoices, and tax details
• Coupons applied at checkout
• Support cases, dispute records, and chat transcripts related to orders
• Delivery / pickup / ride-start / service-completion OTPs shown in the app

The Platform does not operate a CraNau Cash wallet or store a promotional cash balance.

3.3. Location and address data

• GPS coordinates (precise or approximate) when you grant permission
• Real-time location during active deliveries, rides, or tracking sessions where enabled
• Saved addresses (labels, flat/house, landmark, pin code, geocoded coordinates)
• Map pin selections and serviceability checks via Google Maps / Google Places

3.4. Pharmacy and health-related data

• Prescription (Rx) images or PDFs uploaded for pharmacy orders
• Medicine names, dosages, and pharmacist review outcomes
• Age or identity confirmations required for restricted products

Note: Prescription data may be considered sensitive personal data under Indian law. We process it only for lawful pharmacy fulfilment, compliance, and support.

3.5. Communications and Gishti data

• Gishti order chat encrypted payloads, timestamps, and attachments between you, Partners, delivery personnel, and support
• Gishti Circle community posts, replies, reactions, moderation flags, and anonymous username
• Push notification tokens, SMS delivery logs, and email engagement
• Call metadata if in-app or bridged calling is enabled

Gishti Circle messages are stored on CraNau servers and are not end-to-end encrypted. Order-chat message bodies are encrypted in the app before sending; do not share passwords, full payment card numbers, or unrelated sensitive documents in chat.

3.6. User-generated content

• Reviews, ratings, photos of orders or products
• Survey responses and feedback
• Content you post in Gishti Circle

3.7. Device and technical data

• Device model, operating system, app version, language, and time zone
• IP address, network type, and crash or diagnostic logs
• Advertising or device identifiers where permitted (for analytics, fraud prevention, attribution, and in-app ads)
• Permissions status (location, camera, notifications, photo library)
• Firebase Crashlytics crash reports and Firebase Performance traces
• Firebase Cloud Messaging device tokens for push notifications

3.8. Ride and trip data

• Pickup and drop locations, route information, fare breakdown
• Driver or vehicle identifiers shown in the app
• Trip share text you generate (may be sent by you through WhatsApp, SMS, or other apps you choose; CraNau does not operate a WhatsApp marketing channel unless separately disclosed)
• Ride-start OTP

3.9. Marketing and preferences

• In-app ad and campaign placements
• Coupon redemptions and campaign interactions
• Marketing preference settings where the app provides them
• Opt-in status for promotional push, SMS, or email where collected

3.10. Data from third parties

• Payment status and risk signals from Razorpay and other payment partners
• Partner-provided updates (order ready, out for delivery, Rx rejection)
• Map and places data from Google

4. How we use personal data (purposes)

We process personal data for the following purposes:

4.1. Provide and operate the Platform

• Create and manage your account
• Display restaurants, stores, products, services, and fares in your area
• Process orders, bookings, deliveries, rides, and home-service requests
• Facilitate COD, Razorpay prepaid checkout, pay-at-store, door UPI / partner-direct payments, and home-service visit charges
• Upload, validate, and transmit prescriptions to licensed pharmacy Partners
• Enable Gishti order chat and Gishti Circle
• Send transactional notifications, OTPs, and service updates

4.2. Location-dependent services

• Determine whether Services are available at your address
• Assign delivery partners, couriers, or drivers
• Show maps, ETAs, and navigation assistance
• Improve address accuracy and geofencing

4.3. Customer support and dispute resolution

• Respond to inquiries at support@cranau.com and in-app Help Center
• Investigate order issues, refunds (per Refund Policy), and safety reports
• Enforce Terms of Service and community rules

4.4. Safety, security, and legal compliance

• Detect and prevent fraud, abuse, and account takeover
• Comply with pharmacy, food safety, transport, tax, and law-enforcement requests
• Maintain audit logs and records required by law

4.5. Improve and develop Services

• Analytics on app performance, feature usage, and service quality
• Crash diagnostics (Firebase Crashlytics) and performance traces
• Train and test algorithms for search ranking, recommendations, and ETA estimation (using aggregated or de-identified data where feasible)

4.6. Marketing and promotions

• Show in-app offers, coupons, and product updates if you have opted in or where permitted by law
• Personalise promotions based on order history and preferences
• You may opt out as described in Section 16

4.7. Gishti Circle identity

• Display your chosen anonymous username and trust/order-credit signals to other Circle users
• Show reviews attributed to you where the app uses that format

5. Legal bases for processing (DPDP Act)

Under the DPDP Act and applicable law, we rely on one or more of the following grounds:

5.1. Consent. Where required, we obtain your freely given, specific, informed, and unambiguous consent—for example, for optional marketing, precise location, camera for Rx or reviews, or certain analytics. You may withdraw consent through app settings or by contacting us, without affecting lawfulness of processing before withdrawal.

5.2. Legitimate uses permitted by law. Including processing necessary to fulfil your request for goods or services, perform a contract with you, comply with legal obligations, or respond to medical or health emergencies involving you (as permitted under the DPDP Act).

5.3. Fraud prevention, network security, and improvement of Services, balanced against your rights and implemented with appropriate safeguards.

Where the DPDP Act requires notice and consent for specific processing, we will provide clear in-app notices at the point of collection.

6. How we share personal data

We do not sell your personal data. We share personal data only as necessary for the purposes in Section 4:

6.1. Partners (restaurants, stores, pharmacies, drivers, couriers, home-service providers)

• Order details, delivery addresses, contact phone (often masked), special instructions
• Prescription images and related pharmacy data for fulfilment and regulatory compliance
• Ratings and feedback attributed to your order

Partners are expected to use data only for fulfilment and applicable legal obligations.

6.2. Payment processors

• Razorpay (and other designated gateways) receive payment amounts, billing metadata, and device information to process transactions, refunds, and fraud checks. Their privacy policies govern payment data they control.

6.3. Cloud and infrastructure

• Application hosting, databases, backups, and content delivery on Microsoft Azure (or equivalent cloud regions)
• Logging, monitoring, and disaster recovery providers

6.4. Authentication and communications

• Firebase (Google) for push notifications, crash reporting, performance monitoring, and Phone Authentication where enabled
• SMS and email providers for transactional messages

6.5. Maps and location

• Google Maps / Google Places for geocoding, map display, and place autocomplete subject to Google's Privacy Policy

6.6. Analytics and support tools

• Product analytics, customer support ticketing, and moderation tools bound by confidentiality and data-processing terms

6.7. Legal and safety disclosures

• Courts, regulators, law enforcement, or government authorities when required by law or to protect rights, safety, and property
• Other parties in connection with merger, acquisition, or asset sale, with notice where required

6.8. Trip sharing

• If you use Share for safety, the message is handed to an app you choose. Recipients see whatever you send. Share only with trusted contacts.

7. International transfers

7.1. CraNau is established in India. Primary storage and processing occur on cloud infrastructure with data centres in India and, where necessary for redundancy or specific subprocessors, in other countries.

7.2. When personal data is transferred outside India, we implement appropriate safeguards as required under the DPDP Act and applicable rules, including contractual clauses and transfer assessments.

7.3. By using the Platform, you understand that certain third-party providers (for example, Google / Firebase, Razorpay, Azure global services) may process data in multiple jurisdictions subject to their compliance programmes.

8. Data retention

8.1. We retain personal data only as long as necessary for the purposes in Section 4 and to comply with legal, tax, and regulatory obligations.

8.2. We may anonymise or aggregate data for analytics and retain it indefinitely in de-identified form.

8.3. Upon verified account deletion request, we delete or anonymise personal data except where retention is required by law or legitimate ongoing disputes.

9. Security measures

9.1. We implement reasonable technical and organisational measures aligned with industry practice, including:

• Encryption in transit (TLS) and encryption at rest for sensitive categories where applicable
• In-app encryption of Gishti order-chat payloads
• Access controls, role-based permissions, and authentication for personnel
• Network firewalls, intrusion monitoring, and regular security updates
• Vendor security assessments for payment, cloud, and OTP providers

9.2. No method of transmission or storage is completely secure. You are responsible for securing your device and account credentials.

9.3. If we become aware of a personal data breach likely to affect your rights, we will notify you and the Data Protection Board of India or other authorities as required by law.

10. Your rights under the DPDP Act

As a data principal, you have the following rights, subject to applicable exceptions:

10.1. Right to access information about personal data we process about you and the identities of other data fiduciaries and processors with whom data has been shared.

10.2. Right to correction of inaccurate or incomplete personal data.

10.3. Right to erasure when retention is no longer necessary for the stated purpose or upon withdrawal of consent where consent was the basis, subject to legal retention requirements.

10.4. Right to grievance redressal through our Grievance Officer (Section 18).

10.5. Right to nominate another individual to exercise your rights in the event of death or incapacity, as provided under the DPDP Act.

10.6. Right to withdraw consent for processing that relies on consent, through app settings or by contacting us.

How to exercise rights: Email support@cranau.com with subject line "DPDP Rights Request" and sufficient information to verify your identity. We will respond within fifteen (15) days unless a longer period is permitted by law, in which case we will inform you of the extension and reasons.

We may decline requests that are manifestly unfounded, excessive, or prohibited by law (for example, where retention is mandatory for pharmacy records).

11. Utility-specific privacy notices

11.1. Food delivery and pickup

We share your name, phone, delivery address, and order contents with restaurants and delivery partners. Live order tracking may show courier location on a map. Completion OTPs are shown to you to confirm handover.

11.2. Online shopping (grocery, pharmacy, electronics, fashion, stationery)

Store Partners receive fulfilment data. Return processes, where the store accepts returns, may require additional contact. Product reviews you publish may be publicly visible.

11.3. Pharmacy

Rx images are shared only with licensed pharmacy Partners and authorised personnel for verification, dispensing, and regulatory audit. Do not include unrelated medical history in prescription uploads. Pharmacist decisions (accept/reject) are recorded.

11.4. Rides and cabs

We process location throughout active trips for safety, routing, and matching. Share for safety hands a status message to an app you choose. Ride-start OTP may be required.

11.5. Home services

Service professionals receive booking address, contact details, and job description. Visit-charge payment metadata is processed by Razorpay when you pay online. You should ensure someone authorised is present at the service location.

11.6. Payments (Razorpay, COD, direct partner)

Online payments are processed by Razorpay; we receive confirmation metadata, not full card numbers when tokenised. COD orders record fulfilment and collection status. Direct partner payments may involve less data flowing through CraNau; Partners' privacy practices apply to data they collect directly.

12. Gishti data practices

12.1. Gishti order chat messages are encrypted on device before send. We store ciphertext, metadata, and enough context to provide support history, resolve disputes, and monitor policy compliance when a report is made.

12.2. Gishti Circle community data includes posts, comments, and username elements. Community content is not end-to-end encrypted and may be accessed by authorised CraNau staff for moderation.

12.3. Other users may screenshot or copy content you post publicly. Exercise caution when sharing personal information in community features.

12.4. We may remove content or restrict accounts that violate our Terms or this Policy.

13. Cookies and web technologies

13.1. The CraNau Customer App primarily uses mobile SDKs rather than browser cookies. Our website https://cranau.com may use cookies and similar technologies for:

• Session management
• Analytics and performance measurement
• Preference storage

13.2. You can control cookies through browser settings. Disabling cookies may limit website functionality.

13.3. The app may use local storage on your device for tokens, cache, and offline data. Clearing app data removes local storage.

13.4. Third-party embeds (for example, payment pages or maps) may set their own cookies subject to their policies.

14. Children’s privacy

14.1. The Platform is intended for users aged 18 and above. We do not knowingly collect personal data from anyone under 18.

14.2. If you believe we have collected data from a minor, contact support@cranau.com and we will take steps to delete it promptly.

14.3. Parents or guardians should supervise minors' use of devices logged into CraNau accounts.

15. Automated decision-making and profiling

15.1. We may use automated systems to detect fraud, assign delivery partners, estimate ETAs, rank search results, and personalise offers.

15.2. These processes do not produce legal or similarly significant effects solely by automated means without human review where required by law.

15.3. You may contact us for explanation of significant automated decisions affecting your account where applicable under law.

16. Marketing and opt-out

16.1. Transactional messages (order updates, OTPs, security alerts) are necessary for the Service and are not marketing; they may not be fully opt-outable while you have active orders.

16.2. Promotional communications (offers, newsletters, campaign SMS/push) are sent only with your consent or as permitted by law.

16.3. Opt-out methods:

• Toggle marketing preferences where shown in the app
• Use the unsubscribe link in marketing emails
• Reply STOP to promotional SMS where supported
• Email support@cranau.com with subject "Marketing Opt-Out"

16.4. Opt-out may take up to seven (7) business days to propagate across systems. Suppression lists may be retained to honour your choice.

17. Third-party links and Partner apps

17.1. The Platform may link to Partner websites, payment pages, or government portals. Their privacy practices govern data you provide to them directly.

17.2. CraNau is not responsible for privacy practices of restaurants, stores, drivers, or other independent businesses except for data processed on our systems as described in this Policy.

18. Grievance officer and contact

In accordance with the Information Technology Act, 2000, the Consumer Protection (E-Commerce) Rules, 2020, and the Digital Personal Data Protection Act, 2023:

Response commitment: We will acknowledge your grievance or rights request within forty-eight (48) hours where practicable and aim to resolve it within fifteen (15) days from receipt, unless a longer period is required by law or the complexity of the matter. If extension is needed, we will inform you of the revised timeline and reasons.

For general privacy questions: support@cranau.com Website: https://cranau.com

19. Changes to this Policy

19.1. We may update this Policy to reflect changes in law, technology, or our Services. The "Last updated" date at the top will change when we publish revisions.

19.2. Material changes will be communicated through in-app notice, email, or other appropriate channel as required by the DPDP Act and app store policies.

19.3. Continued use after the effective date constitutes acknowledgement of the updated Policy. If you disagree, discontinue use and request account deletion.

20. Relationship with Terms of Service

20.1. This Policy supplements the CraNau Customer Terms of Service. In case of conflict regarding data processing, this Policy prevails for privacy matters; the Terms prevail for service use and liability.

20.2. Refunds and payment disputes are handled under the CraNau Customer Refund Policy and may involve processing of transaction data as described herein.

21. Summary data map (quick reference)

This table is illustrative and does not limit Sections 3–8.

Thank you for trusting CraNau. We are committed to handling your personal data responsibly while delivering local services across India.