Privacy policy

1. Information collected

• Account: account identifier, name, email, phone where supplied, sign-in information, profile details, and settings. Firebase Authentication handles email/password and Google sign-in; Google sign-in provides the profile information needed for authentication.
• Location: location provided with permission, manually entered or saved addresses, selected service area, and pickup or drop-off coordinates.
• Orders and bookings: chosen items or services, quantities, prices, offers, contact and fulfilment details, assigned partner, status, and timestamps.
• Payments: checkout details, amount, currency, gateway order and payment identifiers, payment status, and refund information. Payment credentials are handled by Razorpay or your selected payment method. Multimart 24 does not store full card numbers, CVVs, UPI PINs, or banking passwords.
• Communications and applications: support information you send and partner, rider, delivery, vendor, or franchise application details, including contact, area, experience, vehicle, or business information where supplied.
• Technical information: notification tokens, authentication and session identifiers, request metadata such as IP address, and operational or security information processed by our hosting and service providers.
• Optional AI assistance: messages entered into Burfi, recent conversation context, selected section, cart item names and quantities, and relevant public catalogue information.

Phone verification

When you choose mobile OTP login, your mobile number is sent to Firebase Authentication to send a one-time SMS code and verify account ownership. Phone numbers supplied for authentication are sent to and stored by Google to improve spam and abuse prevention across Google services, including Firebase. We save your verified number with your customer profile for account access and fulfilment. Standard message rates may apply. Never share an OTP with support or other people.

2. Use of information

We use information to authenticate accounts, show relevant availability, process and fulfil orders and bookings, arrange delivery or rides, apply eligible offers, process payments and refunds, send order updates, respond to support requests, review applications, and prevent misuse or fraud. Burfi uses the information above to provide assistance when you choose to use it. We do not sell personal information.

3. Permissions and tracking

The customer Android app requests approximate or precise location for location-dependent features while you use the app. It does not request Android background-location permission. You can decline or revoke permission and enter an address manually where supported; some location-dependent features may be unavailable.

After assignment, the relevant customer can view a partner's reported location and order or trip progress. Your fulfilment address or pickup and drop-off information is shared with the people completing your requested service.

Notification permission supports order and service updates and can be changed in device settings. The customer app does not request access to contacts or SMS messages.

4. Sharing and service providers

Relevant franchise administrators, vendors, service professionals, riders, delivery partners, and event providers receive information needed to fulfil or support your request. Information may also be disclosed to meet legal obligations, resolve disputes, protect users, or prevent fraud.

• Google Firebase: authentication, cloud database services, notifications, and optional Google AI assistance.
• Supabase: storage and delivery of catalogue and service media.
• Vercel and hosting infrastructure: backend hosting and API request processing.
• Razorpay: online payments, payment-security functions, and refunds. Its own privacy policy also applies to data it processes.
• Map services: OpenStreetMap map tiles, Photon address searches, and OSRM routing. Requests can disclose requested map areas, searched addresses, route coordinates, and technical request information.
• External communications: email, WhatsApp, or other support providers you choose process messages under their own policies.

Providers may process information on infrastructure outside your country. Their processing and retention are also subject to applicable service terms and legal obligations.

5. Optional AI assistant

Burfi sends your messages, recent conversation, cart items, selected section, and public catalogue context to Google's AI service to generate replies. The app does not automatically include your account email, phone number, or precise location in the assistant prompt, but your entered text may contain personal information. Do not enter passwords, payment credentials, identification documents, or other sensitive information.

AI answers may be inaccurate. Burfi cannot place orders, make payments, or change your address itself. You can shop without using it.

6. Storage and safeguards

Information is stored in cloud services and, where needed, on your device for sign-in, settings, and checkout continuity. We use encrypted network connections, authentication, and access restrictions. Administrative functions are restricted by role and service area. No storage or transmission system can guarantee complete security.

7. Retention and account deletion

Profile and saved-address information is retained while needed to operate your account or provide requested services. You can request account and associated-data deletion through our account-deletion page, without signing in or reinstalling the app.

After verified deletion, account and profile information is deleted, and associated personal data is deleted or anonymised except where limited retention is necessary for tax and accounting requirements, payment reconciliation, refunds, disputes, legal obligations, or fraud prevention. Retained records are restricted to the relevant purpose and deleted or anonymised when that obligation or purpose ends.

The retention period depends on the applicable requirement or unresolved issue. Support will explain any retention reason and period and the expected completion date when confirming your verified request. Deleting your Multimart 24 account does not delete your Google or payment-provider account.

8. Your choices

You can change supported profile details and addresses in the app, manage location and notification permissions in device or browser settings, and choose whether to use AI assistance or submit an application. Contact the privacy email for access, correction, deletion, or data-handling questions. We may verify ownership before acting on a request.

Signing out or uninstalling does not delete cloud account data. Use the account-deletion page to request deletion.

9. Children and updates

Multimart 24 is not directed at children. If you believe a child has supplied personal information without appropriate authorisation, contact us so we can investigate and address it.

We may update this policy as features and data practices change. The current version and update date will appear here.