Privacy Policy

Disclaimer: This Privacy Policy is for informational purposes and does not constitute legal advice. You should have a qualified attorney review this policy before publication.

Tiru Delivery ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including our mobile application and web dashboard (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this policy, please do not use the Service.

Account Information

When you create an account, we collect your name, email address, and password (stored securely as a salted hash). You may optionally provide a profile photo.

Location Data

We collect your delivery address and, with your permission, your device's precise location to determine service area eligibility and estimate delivery fees. Cafe locations (latitude/longitude) are also stored to calculate delivery distances.

Order Information

We collect details about orders you place, including items ordered, quantities, prices, special instructions, delivery address, and order status history.

Contact Information

We collect phone numbers for users, drivers, and cafes to facilitate delivery coordination and customer support.

Device & Usage Information

We automatically collect your IP address, browser type, device type, operating system, and app version. We track how you interact with our service (pages viewed, features used, session duration) to improve the user experience.

Push Notification Tokens

With your consent, we collect device tokens to send order status updates and promotional notifications.

Direct Collection

You provide information directly when you create an account, place an order, update your profile, contact support, or use our features.

Automatic Collection

We automatically collect device and usage data through cookies, analytics tools, and device sensors (GPS for location).

Third-Party Sources

We do not purchase data from data brokers. We may receive updated contact or demographic information from payment processors or authentication providers to help maintain the accuracy of our records.

We use your information for the following purposes:

Service Delivery

To process orders, calculate delivery fees, assign drivers, send order updates, and provide customer support.

Service Improvement

To analyze usage patterns, identify popular items and cafes, diagnose technical issues, and optimize delivery routes.

Communications

To send order confirmations, status updates, and responses to your inquiries. With your consent, we may send promotional messages about new cafes or special offers.

Security & Fraud Prevention

To detect and prevent unauthorized access, fraudulent orders, and other prohibited activities.

Legal Compliance

To comply with applicable laws, regulations, legal processes, or enforceable government requests.

Contract Performance

Processing your account and order data is necessary to perform our contract with you when you use our service.

Consent

We rely on your consent for location data, push notifications, marketing communications, and non-essential cookies. You may withdraw consent at any time.

Legitimate Interests

We process usage analytics and security monitoring based on our legitimate interest in improving our service and protecting our platform.

Legal Obligation

We may process data as necessary to comply with legal obligations, such as tax reporting or law enforcement requests.

Service Providers

We share data with trusted third-party service providers who help us operate our platform, including cloud hosting (Cloudflare), database services (D1/SQLite), email services, and analytics providers. These providers are contractually bound to protect your data.

Drivers & Cafes

To fulfill orders, we share your name, delivery address, and phone number with the assigned driver and the cafe preparing your order.

Legal Authorities

We may disclose your information if required by law, legal process, or government request, or to protect our rights, property, or safety.

Business Transfers

If Tiru Delivery is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you of any such change.

No Sale of Data

We do not sell your personal information to third parties for their own marketing purposes.

Account Data

We retain your account information for as long as your account is active. After account deletion, we retain minimal data for up to 90 days for legal and audit purposes.

Order Records

Order history is retained for 7 years to comply with tax and accounting obligations.

Usage Logs

Usage analytics and device information are retained for 12 months.

Communications

Customer support correspondence is retained for 3 years after the issue is resolved.

Right to Access

Request a copy of the personal data we hold about you.

Right to Rectification

Request correction of inaccurate or incomplete data.

Right to Deletion

Request deletion of your personal data, subject to legal retention requirements.

Right to Restrict Processing

Request that we limit how we use your data.

Right to Data Portability

Request a copy of your data in a structured, machine-readable format.

Right to Object

Object to our processing of your data for direct marketing or legitimate interests.

Right to Withdraw Consent

Withdraw your consent at any time where we rely on it for processing.

Right to Lodge a Complaint

File a complaint with your local data protection authority.

Essential Cookies

Required for the platform to function, including session cookies and authentication tokens. These cannot be disabled.

Analytics Cookies

We use analytics tools to understand how users interact with our platform. You may opt out of analytics cookies in your browser settings.

Managing Cookies

Most browsers allow you to control cookie settings. Please refer to your browser's help documentation for instructions.

We implement appropriate technical and organizational measures to protect your personal data, including:

Encryption

Data in transit is encrypted using TLS/SSL. Data at rest is encrypted using industry-standard encryption.

Access Controls

Access to personal data is restricted to authorized personnel only, on a need-to-know basis.

Password Security

Passwords are hashed using PBKDF2-SHA256 with salt and stored securely. We never store plain-text passwords.

No Guarantee

While we follow industry best practices, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

Our service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child under 18 has provided us with personal data, we will take steps to delete it. If you believe a child has provided us with their data, please contact us immediately.

Your data may be transferred to and processed in countries other than the one you reside in. Our infrastructure is hosted on Cloudflare's global network, which includes data centers worldwide. When we transfer data across borders, we implement appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email

privacy@tiru.com

Response Time

We will respond to your request within 30 days.

We may update this Privacy Policy from time to time. We will notify you of material changes by email, in-app notification, or a prominent notice on our website. We encourage you to review this policy periodically. Changes become effective 30 days after posting, unless otherwise stated.