Privacy Policy
This Privacy Policy explains how Valley Rush Private Limited ("Valley Rush", "we", "us") collects, uses, shares and protects personal data when you use the Valley Rush customer, seller and delivery partner apps and related services (the "Platform").
We process personal data in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. For the purposes of the DPDP Act, Valley Rush Private Limited is the Data Fiduciary for the personal data described here.
1. Data we collect
Information you give us
- Account details: name, mobile number, email address, password (stored only as a one-way hash) and profile photo.
- Delivery addresses, including the map pin you place, landmarks and the phone number for delivery.
- Orders, cancellations, returns, reviews and messages you send to Help & Support.
- Sellers: business and owner details, PAN, GSTIN, FSSAI licence number, shop address and location, bank account and IFSC or UPI ID, and copies of KYC documents (identity proof, PAN card, GST certificate, cancelled cheque or bank statement, shop photographs and licences).
- Delivery partners: identity details (Aadhaar and PAN numbers and images), driving licence, vehicle registration, bank or UPI details, profile photo and delivery proof photographs.
Information collected automatically
- Device and app information: device model, operating system, app version, language, IP address and crash diagnostics.
- Location: the precise location of the device when you allow it — for customers, to set a delivery pin and show nearby availability; for delivery partners, continuously while a delivery is in progress (including in the background) so customers can track the order and we can calculate routes and pay you.
- Usage information: products viewed, searches, items added to cart, and notification interactions.
- Push notification token, so we can send order updates.
Information from others
- Payment status, transaction reference and the payment method type from our payment partner. We never receive or store your full card number, CVV, net-banking password or UPI PIN.
- Delivery status and location updates from delivery partners for your order.
2. Why we use your data
| Purpose | Data used |
|---|---|
| Create and secure your account, verify you with OTP | Account details, device data |
| Take, process, deliver and support your orders | Account, address, location, order data |
| Process payments, refunds and seller payouts | Order data, payment references, seller bank details |
| Verify sellers and delivery partners (KYC) as required by law and our payment partner | Seller and partner KYC data |
| Live order tracking, routes and delivery fees | Location of the delivery partner, shop and delivery pin |
| Send order updates and, if you opt in, offers | Contact details, notification token |
| Prevent fraud, abuse and security incidents | Account, device, order and usage data |
| Improve the Platform and fix problems | Usage and diagnostic data |
| Comply with tax, accounting, consumer protection and other laws | Order, invoice and KYC records |
We process your data on the basis of your consent, to perform our contract with you, or for legitimate uses permitted under Section 7 of the DPDP Act (for example, where the law requires us to keep records). We do not sell your personal data.
3. Who we share data with
- Sellers: your name, the items you ordered and order notes, so they can prepare your order. Sellers do not receive your full payment details.
- Delivery partners: your name, delivery address, map pin and a contact number for the duration of the delivery.
- Customers: if you are a delivery partner, your first name, vehicle details, live location and a contact number during an active delivery; if you are a seller, your shop name, address and contact details.
- Service providers who process data on our behalf under contract, including Cashfree Payments (payments, refunds and payouts), Amazon Web Services (hosting and file storage in India/Asia-Pacific), Mapbox (maps, address lookup and routes), Google Firebase (push notifications) and our email and SMS providers.
- Authorities where required by law, a court order or to protect rights, property and safety.
- A successor entity in case of a merger, acquisition or sale of assets, which will be bound by this policy.
4. How long we keep data
We keep personal data only as long as needed for the purposes above. Order, invoice and payment records are retained for up to 8 years to meet tax and accounting laws. KYC records of sellers and delivery partners are kept for the duration of the relationship and up to 5 years after it ends, or longer where the law requires. Location history of deliveries is kept for up to 180 days. When you delete your account, we erase or anonymise your personal data except where we must retain it by law.
5. Security
We protect personal data with reasonable security practices, including encryption in transit (HTTPS/TLS), hashed passwords, access controls limited to staff who need the data, private storage for KYC documents accessible only through short-lived links, and logging of administrative actions. No system is perfectly secure; if a personal data breach occurs, we will notify affected users and the Data Protection Board of India as required by law.
6. Your rights
Under the DPDP Act you have the right to:
- access a summary of the personal data we hold about you and how it is processed;
- correct, complete or update inaccurate data (you can edit most details in the app);
- erase your data, including by deleting your account in the app (Settings → Delete account);
- withdraw consent at any time — for example by turning off location or offer notifications — though some features may stop working;
- nominate another person to exercise your rights in the event of your death or incapacity;
- have your grievances addressed by our Grievance Officer, and if unresolved, complain to the Data Protection Board of India.
To exercise these rights, write to grievance@valleyrush.shop from your registered email or contact Help & Support in the app. We may need to verify your identity before acting.
7. Children
The Platform is not directed at children under 18. We do not knowingly process the personal data of children without verifiable parental consent. If you believe a child has provided us data, contact us and we will delete it.
8. Permissions on your phone
- Location: customer app — to set your delivery pin (only while you use the app); delivery partner app — while on a delivery, including in the background, shown by a persistent notification.
- Camera and photos: to upload KYC documents, profile photos and delivery proof.
- Notifications: for order and account updates.
- Phone: to call a customer, seller or delivery partner from the app.
You can change permissions anytime in your phone's settings.
9. Changes to this policy
We may update this policy. The latest version is always available in the app with its effective date; we will notify you of material changes.
10. Grievance Officer and contact
In accordance with the IT Act, 2000, the IT Rules, 2021 and the DPDP Act, 2023:
—, Grievance Officer
Valley Rush Private Limited, Srinagar, Jammu and Kashmir, India
Email: grievance@valleyrush.shop · Phone: —
We acknowledge complaints within 48 hours and resolve them within one month of receipt.