Privacy Policy

Zenzio acts as a Data Fiduciary for personal data processed for its own purposes. Our collection notice is intended to be read independently and to identify the data and purpose needed for each feature.

Where consent is the basis for processing, we request consent through a clear affirmative action. You may withdraw optional consent through the same or a comparably easy route. Withdrawal does not affect processing already completed lawfully and does not stop essential service messages or processing required by law.

The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 have a phased commencement. This policy describes the controls we are implementing for readiness and will be updated as each provision becomes applicable.

Depending on how you use Zenzio, we may collect only the data reasonably needed for the stated service:

We process personal data for specific purposes such as:

We do not sell personal data. We do not use precise location or order history for a new purpose that is incompatible with the purpose disclosed at collection without an appropriate notice and legal basis.

We may share personal data with the limited categories of recipients required to operate Zenzio:

We require service providers to use appropriate security and confidentiality controls. Their own processing may also be governed by their privacy notices.

Location access is used to show relevant restaurants, map delivery addresses, calculate routes and ETAs, enable live order tracking, and provide safety support. For a delivery partner, active-delivery location is used for dispatch, customer visibility and safety monitoring.

Location permission is optional where the feature is optional, and you can change device permissions at any time. If you disable it, some ordering, tracking or delivery features may not work. We do not require continuous background location when it is not necessary for the stated service.

We retain personal data only for as long as it is needed for the disclosed purpose, account and service operations, safety and dispute handling, fraud prevention, audits, and applicable tax, accounting, consumer, labour, food-safety or other legal requirements. Retention periods therefore vary by data category and are not guaranteed to be a fixed number of days or years.

When the purpose ends, we delete or anonymise the data unless retention is required by law or needed to establish, exercise or defend legal claims. You may ask us to correct inaccurate data or erase data that we are not required to retain. We take reasonable steps to keep data accurate for the purpose for which it is processed.

Zenzio is not directed to children. Under the DPDP Act, a child is an individual under 18 years of age. We do not knowingly process a child's personal data without verifiable parental or guardian consent where required by applicable law, and we do not knowingly undertake behavioural monitoring or targeted advertising directed at children.

A parent or lawful guardian may contact contact@zenzio.in if they believe a child's data has been provided to us.

Subject to applicable law and verification of your identity, you may contact us to:

Email contact@zenzio.in with the subject "Privacy Request" or use in-app support. We may request information needed to authenticate the request and will respond within the period prescribed by applicable law or our published process.

We maintain reasonable technical and organisational safeguards proportionate to the risk, including access controls, least-privilege access, secure transmission where supported, logging and monitoring, backups, vendor controls, and incident response procedures. Payment credentials are handled by the relevant payment provider rather than stored by Zenzio where applicable.

If we become aware of a personal data breach, we will take steps to contain and remedy it and provide notices to affected Data Principals and the Data Protection Board as required by the DPDP Act, DPDP Rules and other applicable law. We will use clear language and include available safety guidance and a contact channel.

Some service providers may process data outside India. We will undertake such transfers only in accordance with the DPDP Act, the DPDP Rules, applicable government restrictions and other applicable law, and will apply appropriate contractual and security safeguards.

We may update this policy to reflect changes in our services, vendors or applicable law. We will publish the revised version with a new "Last Updated" date and provide additional notice or obtain consent where legally required. The current version is always available at zenzio.in/privacy-policy.

For privacy questions, requests or complaints, contact:

Please do not send passwords, payment credentials or unnecessary identity documents by email.