Privacy Policy

This Privacy Policy explains how Womro Solutions Private Limited(“Womro”, “we”, “us”, or “our”), a company incorporated under the Companies Act, 2013, having Corporate Identity Number (CIN) U62011PB2025PTC063585 and its registered office at Plot No. D-199, 2nd Floor, Phase 8-B, Industrial Area, Mohali, SAS Nagar, Punjab – 160055, India, collects, uses, stores, shares, and protects personal data when you interact with our websites, mobile applications, platforms, and services (collectively, the “Services”), including any communication you have with us over WhatsApp.

Womro operates a portfolio of consumer brands. Our first brand, Mother Bhojan, is a verified home-cook marketplace. This Policy applies to Womro Solutions Private Limited as the data fiduciary across its Services and brands.

We are committed to handling your personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and rules made thereunder, and other applicable Indian laws. Where you contact us or transact through WhatsApp, we also handle your data in line with the requirements of the WhatsApp Business Platform and Meta Platforms.

By using our Services or communicating with us, you acknowledge that you have read and understood this Privacy Policy. Please read it together with our Terms of Service and our separate Cookie Policy.

• “Personal Data” means any data about an individual who is identifiable by or in relation to such data.
• “Data Principal” means the individual to whom the personal data relates — this includes you as a customer, a Kitchen Partner (home cook), a delivery partner, or a website visitor.
• “Data Fiduciary” means the entity that determines the purpose and means of processing personal data. For the purposes of this Policy, Womro Solutions Private Limited is the Data Fiduciary.
• “Data Processor” means any third party that processes personal data on our behalf, such as our cloud hosting, payment, messaging, and customer-support providers.
• “Processing” means any operation performed on personal data, including collection, storage, use, sharing, and erasure.

We collect personal data that you provide directly, data generated through your use of the Services, and data received from third parties. The categories include:

3.1 Information you provide to us

• Identity and contact details: name, mobile number, email address, delivery and billing address.
• Account credentials and profile information.
• For Kitchen Partners: business and kitchen details, FSSAI registration details, bank account and KYC information for settlements and payouts.
• Order details, food preferences, dietary information, and content you submit such as reviews, photographs, and ratings.
• Communications you send to us, including messages, complaints, and support requests.

3.2 Information collected automatically

• Device and technical information: device identifiers, IP address, browser type, operating system, and app version.
• Usage data: pages viewed, features used, and interactions with the Services.
• Approximate location data, used to determine delivery eligibility and serviceable areas, where you grant permission.
• Cookies and similar technologies on our website, as described in our separate Cookie Policy.

3.3 Information from WhatsApp and other messaging channels

When you contact us, place enquiries, or receive notifications through WhatsApp, we collect your WhatsApp phone number, profile name, and the content of the messages you exchange with us, including any attachments. We use the WhatsApp Business Platform, operated by Meta Platforms, to send transactional, service, and support messages and to respond to your queries.

We do not sell your WhatsApp data, and we do not share your message content with Meta for the purpose of targeted advertising. Meta processes message metadata to deliver messages as described in its own terms and policies.

3.4 Payment information

Payments are processed through our payment service providers (such as Razorpay for customer payments and RazorpayX for partner payouts). Card numbers, UPI credentials, and other sensitive payment details are collected and processed directly by these PCI-DSS-compliant providers. We do not store full card details on our own systems.

We process your personal data for the following purposes, each on a lawful basis under the DPDP Act — primarily your consent, and where applicable the performance of our contract with you, compliance with law, or other legitimate uses permitted by law:

• To create and manage your account and verify your identity.
• To enable and fulfil orders, connect customers with Kitchen Partners, and arrange delivery.
• To process payments, calculate commissions and settlements, and make payouts to partners.
• To send transactional and service communications, including order confirmations, OTPs, delivery updates, and account notices — including over WhatsApp, SMS, and email.
• To provide customer support and resolve grievances and disputes.
• To comply with legal, tax, regulatory, and food-safety obligations, including obligations under the FSSAI framework, GST, and TDS/TCS requirements.
• To detect, prevent, and address fraud, abuse, security incidents, and prohibited activity.
• To improve, personalise, and develop our Services, and to conduct internal analytics.
• To send promotional or marketing communications, only where you have given consent, with an option to withdraw at any time.

We do not sell your personal data. We share personal data only as necessary and with appropriate safeguards, with the following categories of recipients:

• Kitchen Partners and delivery partners, to the extent needed to prepare and deliver your order. Your exact contact details are shared only where required to fulfil the service.
• Payment service providers (such as Razorpay and RazorpayX) to process payments and payouts.
• Messaging and communication providers, including the WhatsApp Business Platform (Meta Platforms) and SMS/email vendors, to deliver communications to you.
• Customer-support technology providers (such as our helpdesk platform) to manage and respond to your requests.
• Cloud hosting and infrastructure providers, who store and process data on our behalf under data-processing agreements.
• Professional advisors and auditors, such as legal counsel, accountants, and auditors, on a need-to-know basis.
• Government, regulatory, and law-enforcement authorities, where required by law or to protect rights, safety, and property.
• Acquirers or successors, in connection with a merger, acquisition, financing, or reorganisation, subject to this Policy.

All our Data Processors are bound by contractual obligations to process personal data only on our instructions and to maintain appropriate security safeguards.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, tax, and regulatory requirements. When data is no longer required, we will erase it or anonymise it in accordance with applicable law, unless retention is required by law (for example, financial and tax records).

We implement reasonable technical and organisational security safeguards designed to protect personal data against unauthorised access, alteration, disclosure, or destruction. These include access controls, encryption in transit, secure infrastructure, and internal information-security policies. While we strive to protect your data, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your personal data is primarily stored and processed in India. Some of our service providers (including messaging and cloud providers) may process data outside India. Where personal data is transferred outside India, we do so in accordance with the DPDP Act and only to jurisdictions and recipients that provide appropriate safeguards.

Subject to applicable law, you have the following rights in respect of your personal data:

• Right to access — to obtain a summary of the personal data we process about you.
• Right to correction and erasure — to have inaccurate or incomplete data corrected, updated, or erased.
• Right to withdraw consent — to withdraw consent at any time, as easily as it was given. Withdrawal does not affect processing done before withdrawal.
• Right to grievance redressal — to have your concerns addressed by us, as described below.
• Right to nominate — to nominate another individual to exercise your rights in the event of death or incapacity.

To exercise any of these rights, contact us using the details in Section 12. We may need to verify your identity before acting on a request. You may also opt out of marketing messages at any time by using the unsubscribe option provided, or by replying “STOP” to WhatsApp or SMS marketing messages.

Our Services are not directed at children under the age of 18. We do not knowingly process the personal data of children except in accordance with the DPDP Act, which requires verifiable consent of a parent or lawful guardian. If you believe a child has provided us personal data without appropriate consent, please contact us so we can take appropriate action.

Our website uses cookies and similar technologies. The details of the cookies we use and your choices regarding them are set out in our separate Cookie Policy.

If you have any questions, concerns, or complaints about this Privacy Policy or how we handle your personal data, or if you wish to exercise your rights, you may contact our Grievance Officer, appointed in accordance with the DPDP Act and the Information Technology Act:

We will acknowledge your complaint promptly and aim to resolve it within the timelines prescribed under applicable law (typically within 15 days). If you are not satisfied with our response, you may have the right to make a complaint to the Data Protection Board of India established under the DPDP Act.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you through the Services where appropriate. We encourage you to review this Policy periodically.