Privacy Policy

1. Who we are

Neem Karoli Sales Corporation Private Limited ("we", "us", "the company") is a wholesale distributor of packaged beverages, with its registered office at Plot No. 219, Parshvnath Enclave Vistar, Vatika, Bagru, Sanganer, Jaipur, Rajasthan 303905, India. We are the data fiduciary for the information described here.

This policy covers our ordering app for shops ("Neem Karoli Sales"), our internal depot app ("Neem Karoli Depot"), this website, and the phone calls and messages we exchange with you about your orders.

2. What we collect

We are a business-to-business supplier, so almost everything we hold is about a shop rather than a private individual. We collect only what an order needs.

Information you give us

Your mobile number: This is your account. There is no password anywhere in our system — you sign in with your number and a one-time code. It is also the number we call to confirm your order.
Your shop details: Shop name, and optionally the owner's name and your GSTIN if you want it on paperwork.
Your delivery address: The shop number and street, a landmark, an optional pincode, and the location you pin. See app permissions for how the pin is read.
The person taking delivery, if it is not you: When you send an order to someone else, the name and mobile number of that person, plus any note for the driver. It is stored on that order so the delivery staff know whose gate to stop at, and it is not used for anything else — we do not market to them, and it does not create an account for them. Either pick them from your contacts or type it in; both end up the same.
Your orders: What you ordered, the quantities, the rate you were actually charged at the time, the delivery address used, how it was paid, how many empty crates came back, and any note you added.

Information we generate

Distance and delivery ring: The straight-line distance from our depot to your pinned location, and which delivery ring that puts you in. Both are frozen onto the address when you save it, so that redrawing a ring later cannot change an address your past orders used.
Account summary: How many orders you have placed, their total value, and the date of your last one. We use this to sort our own customer list.
Our notes about your account: Our staff can record operational notes against a shop — delivery instructions, preferred call times, credit arrangements. These are internal, but you are entitled to ask for a copy of them at any time.
Coverage requests: If you try to save an address outside our delivery area, we record the location, the distance and your shop name and number. We use this to decide where to add a route. If you would rather we did not keep it, ask us and we will remove it.
Notification records: A record of each alert we sent you and whether it went out, so that "I was never told" can actually be checked.

Information collected automatically

A sign-in token: Stored on your own phone so you do not have to sign in every time. Removing the app removes it.
A notification token: If you allow notifications, the operating system issues an anonymous token for your device and we store it so we can send order updates to that phone. If you refuse notifications, no token exists and nothing is stored.
Server logs: Our servers record the usual technical detail for each request — IP address, time, which screen was asked for, and whether it succeeded. These exist to keep the service running and to investigate abuse.

Your cart never leaves your phone until you send the order. The basket you build is stored only on your own device, so you can put it together with no signal. Nothing reaches us until you tap to send it — and if you abandon it, we never see it at all.

3. Why we collect it

What	What it is for	Our basis
Mobile number	Signing you in, and calling to confirm your order	Performing our contract with you
Shop name and address	Delivering to the right shutter; paperwork	Performing our contract with you
Pinned location	Checking you are inside a delivery ring; setting the delivery charge	Your consent, given when you tap to share it
Order records	Fulfilment, accounts, GST and statutory record-keeping	Legal obligation and our legitimate business interest
Notification token	Telling you when your order is confirmed and on the way	Your consent, given at the notification prompt
GSTIN	Putting your GST number on paperwork, if you gave it	Your consent
Server logs	Keeping the service up; security and abuse investigation	Our legitimate interest in a working, secure service

4. App permissions

Location

The shop app asks for location so it can check that your shop falls inside one of our delivery rings. Three things are worth being clear about:

It is read only when you tap the button to set your shop location. There is no background or continuous location tracking of any kind.
We use it once, to compute a distance, and store the coordinates on that saved address. We do not build a movement history.
You can refuse. You will not be able to save a delivery address in the app, but you can still browse, and you can give us your address on the phone instead.

Notifications

Used for order updates and nothing else — confirmed, packed, on the way, delivered. We do not send marketing pushes. Refusing costs you nothing but those updates, and you can change it in your phone settings at any time.

Installing apps

While we distribute the app directly rather than through a store, it asks permission to install its own updates, because a sideloaded app has no store to update it. This permission is used for nothing else, and is not needed once the app is installed from Google Play.

Camera and photos

Only our depot app asks for these, so our own staff can photograph items for the catalogue. The shop app does not request camera or photo access at all.

5. What we never do

We do not sell your data. Not to anyone, for any price.
We do not share it for advertising or allow anyone to use it to target ads at you.
There is no advertising, analytics or tracking software in our apps. No advertising identifier is read, and no third-party analytics or crash-reporting service is embedded.
We do not track your location in the background.
We do not read your contact list. If you choose to send an order to someone else, your phone's own contact picker opens and only the one contact you pick is passed to the app — a name and one number. We never read, copy or upload your address book, and you can always type the name and number instead.
We do not read your messages, call logs or files.
We never store card, UPI PIN or bank credentials. See payments.
We do not send marketing notifications through the app.

We share what is necessary with the following, and with nobody else. None of them is permitted to use your information for their own purposes.

Who	What they handle
MongoDB Atlas	Hosts the database holding accounts, addresses and orders.
DigitalOcean	Hosts our servers and stores catalogue images and app files, in their Bangalore, India region.
Expo & Google Firebase Cloud Messaging	Deliver notifications to your phone. They receive the device token and the text of the alert — which for an order update includes your order number and total.
Our delivery staff	See the shop name, address, phone number and order contents for the deliveries they are making — and, where an order is being sent to someone else, that person's name and number.
Payment gateway	Once online payment is enabled, a PCI-DSS compliant gateway will process the payment. See payments.

We may also disclose information where a law, court order or lawful government request requires it, or to establish or defend a legal claim. If our business is transferred, your information may pass to the buyer under this same policy.

7. Payments

Today, orders are settled on delivery — cash, UPI or bank transfer — or on agreed credit terms. We record only that an order was settled and by which method.

We are adding online payment inside the app. When it is live, the payment will be handled entirely by a PCI-DSS compliant payment gateway. Your card number, CVV, UPI PIN and net-banking credentials are entered on the gateway's own secure screen and are never sent to us or stored on our servers. We receive only the result — paid or failed — plus a reference number and the amount, which is what we need to release your order and answer questions about it later.

8. Where it is stored

Our servers and image storage are in India. Our database is hosted by MongoDB Atlas, and notification delivery uses Expo and Google's messaging service, which may process data on servers outside India. Where information does leave the country, it is only what those services need to do their job, and it stays subject to this policy.

9. How long we keep it

What	Kept for
One-time sign-in codes	Five minutes, then deleted automatically. Stored hashed, never in plain text.
Notification records	60 days, then deleted automatically.
Account, shop and address details	While your account is open, and until you ask us to delete it.
Orders and invoices	Up to eight years, because company and tax law require us to keep books of account and GST records. These survive account deletion — see below.
Server logs	Routinely rotated and overwritten; not retained long-term.

10. Security

We take the following concrete measures, and we would rather describe them than claim "bank-grade security":

All traffic between the apps, this website and our servers is encrypted with HTTPS.
There are no passwords in our system to be stolen. Sign-in is a one-time code, which is stored only as a hash, expires in five minutes, and is locked out after five wrong attempts.
Sign-in attempts are rate limited per mobile number, so nobody can work through codes for your account.
Access to the depot app is an allowlist. Only numbers the owner has added can reach any depot screen, and access can be withdrawn immediately.
Rate and stock changes are recorded with who made them and what the values were before and after.
Our staff see only what their role requires.

No system is perfectly secure. If we discover a breach affecting your information, we will inform you and the relevant authority as the law requires.

11. Your rights

Under India's Digital Personal Data Protection Act, 2023 and other applicable law, you can ask us to:

Show you what we hold about you, and who we have shared it with.
Correct anything wrong, incomplete or out of date.
Delete your account and personal data — see the data deletion page for how, and what we must keep by law.
Withdraw consent you previously gave, such as for location or notifications.
Nominate someone to exercise these rights if you are unable to.
Complain — to us first, and then to the Data Protection Board of India.

Ask by calling +91 76108 11113 or writing to neemkaralisales@gmail.com. We respond within 30 days. We may need to confirm you are the account holder before acting, which normally means a call to your registered number.

12. Children

This is a wholesale service for businesses. It is not intended for anyone under 18 and we do not knowingly collect information about children. If you believe a child has given us information, tell us and we will delete it.

13. This website

This website sets no cookies, uses no analytics service, and contains no advertising or tracking pixels. Nothing you do here is profiled.

There is no third party involved at all. The typefaces are served from this site's own server rather than from a font service, so loading a page here contacts nobody but us. Our web server keeps ordinary access logs as described above.

14. Changes to this policy

If we change this policy we will update the date at the top and, where the change is significant, tell you in the app or by phone. Continuing to use the service after a change means you accept the updated policy.

15. Grievance officer

As required by Indian law, the following person is responsible for privacy questions and complaints:

Name	Daulat Singh, Director
Company	Neem Karoli Sales Corporation Private Limited
Address	Plot No. 219, Parshvnath Enclave Vistar, Vatika, Bagru, Sanganer, Jaipur, Rajasthan 303905, India
Phone	+91 76108 11113
Email	neemkaralisales@gmail.com
Hours	Monday to Saturday, 9 AM to 7 PM IST