Who we are
Water2door ( Water2door legal entity — name to be confirmed , CIN CIN to be added , Registered office address to be added ) runs a marketplace for drinking-water delivery. Under the Digital Personal Data Protection Act 2023 (DPDP Act) we are the Data Fiduciary for the personal data of customers, partner members (supplier owners, staff and drivers) and our own staff.
What we collect
- Account: mobile number (sign-in is by one-time code), name, optional e-mail.
- Addresses: the delivery addresses and map pins you save, with landmarks and instructions.
- Orders and payments: what you order, from whom, when, and how you paid. Card and UPI details are handled by the payment gateway, not stored by us.
- Drivers’ location: collected only while a driver is on a delivery shift.
- Suppliers’ KYC: GSTIN, PAN, FSSAI and BIS details, bank account and documents, for verification and payouts.
- Support: tickets, chats and photos you send; call metadata for masked calls.
- Device and app: push token, app version, security and fraud signals.
- Analytics: only if you opt in (off by default), pseudonymous.
Why we use it
- To take, fulfil and track your orders, and to support you.
- To process payments, refunds, settlements and payouts, and to issue tax documents.
- To keep the platform safe: preventing fraud and abuse, securing accounts.
- With your consent: product analytics and marketing messages. You can withdraw consent as easily as you gave it.
The legal basis for each use (consent or a legitimate use under the DPDP Act) is set out in our data inventory. Final wording to be confirmed by counsel.
Who we share it with
- The supplier and driver of your order: your name, address, phone (through masked calling where available) and order.
- Customers see a driver’s position only while their own order is out for delivery, on a route to their address only.
- Service providers that process data for us: cloud hosting, payments, SMS, masked calling, push notifications, e-mail, maps and geocoding, error tracking and (with consent) analytics.
- Authorities where the law requires it (for example tax filings).
We do not sell personal data.
Where it is stored
Production is designed to keep personal data at rest in India (AWS Mumbai, with backups in Hyderabad). Some service providers process limited data outside India — for example push notification delivery — and each one is listed in our processor register.
How long we keep it
- Drivers’ location points: 90 days.
- Security logs and sign-in records: 180 days, as Indian rules require.
- Chats, call logs and notifications: 180 days.
- Tax and financial records: as long as tax law requires.
- After you delete your account: a 30-day grace period, then your data is anonymised, except what the law requires us to keep.
Every period is to be confirmed by counsel and the CA.
Your rights
- Access and export your data.
- Correct it — most of it you can edit in the app.
- Erase it — delete your account in the app.
- Withdraw consent for analytics and marketing at any time.
- Grievance redressal and nomination — write to us (below).
Security and breaches
Production is configured to encrypt data in transit and at rest, access is least-privilege and audited, and the platform has been reviewed against OWASP ASVS and MASVS. If a personal-data breach happens we follow a documented plan, including notifying CERT-In, the Data Protection Board and affected people as the law requires.
Children
The service is for adults (18 and over).
This website
This website sets no cookies and runs no analytics or third-party trackers. Our host may keep standard server logs (such as IP address and pages requested) for security.
Grievance officer and contact
Grievance officer: Grievance officer — to be appointed to confirm . For any privacy question or request, write to support@water2door.com.