Privacy Policy

1. Who we are

Aaladipattiyan Private Limited, trading as Aaladis by Aaladipattiyan, runs the website and the app. We decide how your personal data is used, so we are the data fiduciary under India's Digital Personal Data Protection Act, 2023.

Registered office: 29, Chennaival Paramankuruchi Nadar Uravin Murai Sangam, Grand Southern Trunk Road, opposite Kilambakkam Bus Terminal, Urapakkam, Chennai, Chengalpattu, Tamil Nadu 600048. Our grievance officer is named in section 16.

2. What we collect, and why

We collect only what we need to take your order, deliver it, help you and keep the service safe.

2.1 Your account

• Mobile number. You sign in with your mobile number and a one-time code sent by SMS. Your account is created the first time a code is accepted. The number is your account; we cannot run an account without it.
• Name. For your orders and parcels.
• Email address. Optional. You can add it in your profile. If you type an email into the Razorpay payment screen and your profile has none, we save that email and send a welcome email to it. An email you set yourself is never replaced.

2.2 Delivery addresses

• The addresses you save: receiver name and phone, house, street, area, landmark, city, state and pincode.
• When you place the pin on the map, the pin's coordinates are saved with that address.
• Each order keeps a copy of the address it was delivered to.

2.3 Your location

We ask your phone or browser for your precise location only when you tap Use current location, set the delivery pin on the map, or look for 30-Min stores near you. We use it once, to fill in your address and to find stores that can deliver to you. We never follow your location in the background. You can always type an address instead.

• Coordinates you send to find nearby stores are used for that answer and are not stored.
• A pin you confirm is saved with your address. A 30-Min order keeps the delivery point so the store and the delivery partner can reach you.
• To turn location off later, use your phone's or browser's settings for Aaladis. Everything still works with a typed address.

2.4 Orders and payments

• What you ordered, the amounts, taxes and shipping, the order status and its history, any note you add, and the delivery address copy.
• Payments are taken by Razorpay on its own screen. We keep only Razorpay's order and payment reference numbers, the amount, the payment method name and any error text. We never see or store your card, UPI or bank details.

2.5 Reviews

Product and delivery reviews you write, with your rating. A review is shown publicly only after we approve it, with your name as it appears on your account.

2.6 Help messages

When you write to us from the Help chat or the contact form, we keep your name, mobile number, email if given, the order you ask about, your messages and our replies.

2.7 Sign-in sessions

Each time you sign in, we record the session's IP address, the browser or device description (the "user agent"), and in the app its platform, version and build. We use this to spot misuse and to keep your account safe. A session lasts 30 days from its last use; expired sessions are deleted every day.

2.8 Searches

When you search in the shop, we log the words you searched (cleaned of anything that looks like a phone number or email), whether it was the courier shop or 30-Min delivery, whether it came from the website or the app, how many products were found, and the time. The log holds no account, IP address, device or location, so it cannot be tied to you. It is kept for 180 days and helps us improve search and popular terms.

3. Order updates and messages

• SMS. We send SMS only for the sign-in code, through MSG91.
• WhatsApp. Order confirmation, dispatch and delivery updates go to your mobile number on WhatsApp through Interakt. This is on when you sign in. Turn it off any time: in your profile on the website, or in the app under Account > Notifications ("Order updates on WhatsApp").
• Email. Order emails (confirmation, dispatch, delivery) go to your email address if we have one, through Resend or our email server. Offer, reminder and recommendation emails are separate; see section 3.1.

We keep a record of each message we queued (the recipient, the type and the content) so we can see what was sent and retry failures, for up to 90 days.

3.1 Offers, reminders and recommendations

Besides order updates, we may send you promotional and reminder messages by app push and by email:

• Offers: deals and offers from our shop.
• Reminders: items left in your cart, an item that is back in stock, a request to review your order after it is delivered, a reminder to buy again what you bought before, and a message if you have not ordered for a while.
• Recommendations: products we suggest based on what you have bought and what you have looked at in the shop.

• Push: off until you turn it on. In the app, Account > Notifications has a separate switch for Offers & deals, Reminders and Recommendations. Each is off by default. On Android, offers and reminders also arrive in their own notification channels, "Offers" and "Reminders", so you can mute either one in your phone's settings.
• Email: on unless you turn it off. Every such email has a one-click unsubscribe link. You can also turn these emails off in the app under Account > Notifications ("Offer and reminder emails").
• Order messages are separate. Your choices here do not change the order updates described above.
• Language. Messages are in Tamil or English, following the language you use in the app.
• No outside advertising. Our notifications never carry advertisements from other companies.
• Your choices are recorded. When you turn any of these on or off, we record the change with its time and where you made it, as the Digital Personal Data Protection Act, 2023 expects.

3.2 How often, and when

• We do not send offers, reminders or recommendations between 9 PM and 9 AM (India time).
• You get at most 2 such messages a day and 8 in any 7 days, counting push and email together across all your phones. Order messages do not count.

3.3 How we measure these messages

• We record whether a message was opened or clicked and whether an order followed it, linked by the message's ID, to learn which messages help and to improve them.
• A small group of customers may not receive automated messages, so that we can compare and see whether the messages are useful.
• Message records are kept for up to 90 days (section 11).

4. Push notifications in the app

The app can tell you when your order is confirmed, out for delivery and delivered, and when we reply in Help. If you turn them on, it can also send offers, reminders and recommendations (section 3.1). Pushes are delivered through Expo's push service and Firebase Cloud Messaging (Google).

• What we store. A push token for each phone you are signed in on, the phone's platform and OS version, and whether notifications are allowed. The token lets us reach that phone; it is not your phone number. It is removed when you sign out, when the session expires, or when you delete your account.
• When we ask. The app asks for permission once, after your first paid order or your first Help message, whichever comes first. It never asks at launch or at sign-in. If you say "Not now", it does not ask again; you can turn notifications on later in your phone's settings.
• What an order or Help push carries. The order number and its new status, or a note that we replied in Help. Never your name, address or payment details.
• How to turn it off. In the app, Account > Notifications > Order updates on your phones. This one switch covers every phone signed in to your account. Offers, reminders and recommendations have their own switches (section 3.1). You can also turn off notifications for Aaladis in your phone's settings. You will still get updates by SMS, WhatsApp or email as described above.
• Expo's push service runs on Google Cloud in the United States and holds the message only while it is being delivered.

5. App usage statistics (analytics)

The app uses Google Analytics for Firebase to show us which screens and features work. Google records the events under a random identifier for this install of the app (an "app instance ID"), not under your account.

• What is sent: screens viewed, products viewed, items added to the cart, the checkout steps, purchases (the order number and amounts, but not your name or address), search words after cleaning, which delivery mode and store you chose, and whether you allowed location. Google also records the app version, the phone model and an approximate location (a city) that it guesses from your IP address.
• What is never sent: your account ID, phone number, email, address or exact location. The app checks every event for these before it is sent and drops anything that looks like one.
• Your switch. Account > Policies > Share app usage statistics. It is on by default. Turn it off and nothing more is sent from that moment, and the analytics data kept on your phone is reset. Turn it on again and events are sent from then on.
• Retention. Google keeps these events for 14 months.

The website uses Google Analytics and Google Tag Manager, and the Meta Pixel (Facebook), to measure visits, carts and purchases. These use cookies; see section 10. The Meta Pixel is used on the website only, never in the app.

Purchases measured for Meta (Facebook) advertising. When you pay for an order on the website, our server also tells Meta about the purchase (Meta's "Conversions API"), so that we can see which of our Facebook and Instagram ads lead to sales, even when the browser could not send it.

• What is sent: the order's number, value and products, and your email, phone number, name, city, state, PIN code, country and our customer ID, each turned into a one-way code (a SHA-256 hash) on our server before it leaves, so the details themselves are never sent. With them go Meta's own browser cookies (_fbp, _fbc), your browser's user agent and the IP address the order came from, which Meta needs to match the purchase.
• Why: to measure and improve our advertising. Meta compares the codes with its own users' to count the sale; we do not receive anything about you from Meta.
• How long: we keep the cookies, user agent and IP address only until Meta has the purchase, and never more than 7 days. Meta keeps what it receives under its own policy.
• Only the website: orders placed in the app, and orders our team enters for you, are not sent.
• Your choice: see section 12.

6. Campaign attribution

If you reach us from a campaign link (a link carrying "utm" tags, for example from an advertisement or a message), we note the campaign's source, medium, name and ID, and the page you landed on. On Android, the app also reads the campaign that led to its installation once, from the Google Play install referrer.

• This note is kept on your phone or in your browser. The latest campaign counts for 30 days; the first one is kept as the first touch.
• When you place an order, the note is sent with the order and stored with it on our server. We use it to learn which campaigns bring orders.
• The "Share app usage statistics" switch does not cover this: the campaign note is part of your order record, not of analytics. It is removed from your orders when you delete your account.
• The note never includes your phone number, address or account; anything that looks like one is dropped before it is stored.

7. Crash reports

The app sends crash reports and performance timings to Sentry, stored in the European Union (Frankfurt). They help us fix errors.

• A report holds the error, the screen it happened on, the app version, the phone model and operating system, and timings of the app's start and screens. Web addresses in a report have their query parts removed.
• No account ID, phone number, email or address is attached. The app sends no screenshots and no screen recordings.
• Sentry does not store your IP address, and the city it would derive from it is removed.
• Native crash and app-session data carry Sentry's own random identifier for this install, so that crashes from one phone can be counted together. It is not linked to your account.
• Retention: 90 days.

8. Who receives your data

These companies process data for us, under our instructions, to run the service. We do not sell your personal data, and we do not share it with anyone for their own advertising.

Our website, servers, database, cache and images run on cloud hosting providers. Some of these companies store data outside India (for example Sentry in Germany, Expo in the United States, Google and Meta worldwide).

9. What stays on your phone or in your browser

The app keeps a little data on your phone so it works quickly and offline. Signing out removes what belongs to your account.

• Your sign-in tokens, in the phone's secure storage. They never leave the phone except to our servers.
• While a sign-in code may still be valid: the mobile number you entered and when the code was sent, in secure storage, never the code itself. It is removed when you sign in, change the number or sign out; in any case it is removed the next time the app opens after the code has expired.
• If your account was deactivated: a note of when, so the app can tell you why you were signed out. It holds no number and is dropped after 30 days.
• Your cart, the address and store you chose, recent searches, the campaign note (section 6), your "Share app usage statistics" choice, whether we already asked about notifications, a hashed copy of what was last sent for push registration (never the token itself), and small caches such as the shop's settings and logos.

The website keeps in your browser: your cart, the address you chose, your last pincode, your recent order numbers, the campaign note (section 6), a draft of an unsent Help message, and small display preferences.

10. Cookies on the website

• Sign-in cookies. Two cookies keep you signed in. They are secure, cannot be read by scripts, and last 15 minutes and 30 days. They are removed when you sign out.
• Analytics and advertising cookies. Google Analytics, Google Tag Manager and the Meta Pixel set cookies to recognise your browser across visits and to measure visits, carts and purchases.
• Your choice. You can block or delete cookies in your browser settings. You can also opt out at Google (the Google Analytics opt-out browser add-on) and Meta (your Facebook ad settings). The shop works without analytics cookies.

The app does not use cookies. Its analytics switch is described in section 5.

11. How long we keep your data

12. Your choices and how to withdraw consent

• WhatsApp updates: your profile on the website, or in the app Account > Notifications.
• Offer, reminder and recommendation emails: the one-click unsubscribe link in any such email, or in the app Account > Notifications ("Offer and reminder emails").
• Offer, reminder and recommendation pushes: off by default; in the app Account > Notifications ("Offers & deals", "Reminders", "Recommendations"), or the "Offers" and "Reminders" channels in your Android phone's settings.
• Order push notifications: in the app Account > Notifications ("Order updates on your phones"), or your phone's settings.
• App usage statistics: in the app Account > Policies ("Share app usage statistics").
• Location: your phone's or browser's settings for Aaladis. Type your address instead.
• Cookies on the website: section 10.
• Purchases measured for Meta: block or delete cookies (section 10), and in Meta's Accounts Center (Ad preferences) turn off "Activity information from ad partners" so that Meta does not use it for the ads you see.
• Your details: change your name, email and addresses in your profile, on the website or in the app.
• Your account: section 13.

Under the Digital Personal Data Protection Act you may also ask us what personal data we hold about you, ask us to correct or erase it, and nominate a person to exercise these rights for you. Write to the grievance officer in section 16. We answer within 30 days.

13. Deleting your account

You can delete your account yourself, in the app under Account > Delete account, or on our Delete your account page at www.aaladis.com/delete-account, which also works if you no longer have the app.

• How. You confirm with a fresh code sent to your mobile number. The deletion runs 7 days later. Until then you can sign in and choose "Keep my account". An order that is still on its way, a pending payment or a running refund must finish first.
• What is deleted: your name, mobile number and email; your addresses, cart, wishlist and saved sign-ins; your push tokens; your reviews; your Help conversations; your sign-in codes; and from your past orders, the delivery address (down to the state), notes, the campaign note, order-history text and the delivery partners' messages. The same number can sign up again later as a new account.
• What we keep, and why. Tax law requires us to keep the record of each past order: its number, date, items, amounts and the state it was delivered to, without your name, phone number or email. For an order of ₹50,000 or more, the law also requires the buyer's name and address on the invoice record; only that record keeps them, and only a senior administrator can open it.
• Our service providers. Messages already delivered through Interakt, MSG91, Resend, the couriers and DittoMart, and events already sent to Google Analytics, stay in those companies' systems under their own retention rules.
• Confirmation. Once the deletion is done we email you, if your account had an email address.

14. How we protect your data

All traffic between your browser or the app and our servers is encrypted (HTTPS). Sign-in cookies are secure and cannot be read by scripts. Payment details never pass through our servers. Access to our database is limited to staff who need it, and staff actions on customer data are logged.

If a data breach is likely to affect you, we will tell you promptly, in plain language: what happened, the likely consequences, the steps we have taken, and whom to contact.

15. Children

The website and the app are for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, write to the grievance officer and we will delete it.

16. Grievance officer

For any question, request or complaint about your personal data, including the rights in section 12, contact our grievance officer:

• Name: Pradeepkumar R
• Email: ask@aaladis.com
• Postal address: No. 29, GST Road, Urapakkam, Chennai, Chengalpattu, Tamil Nadu 600048

We acknowledge your message and answer within 30 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

17. Changes to this policy

When we change this policy we update the date at the top. If a change affects how we use your data in a way you would not expect, we tell you in the app or by email before it takes effect.

18. Contact

For orders and general help, write to ask@aaladis.com or call +91 72003 18183 (8:00 AM – 10:00 PM IST (Mon–Sun)). For consumer complaints and personal-data matters, write to the grievance officer (section 16).