Privacy Policy

Last updated: September 29, 2025

Who we are

“PappaRoti India”, “we”, “us” or “our” means Limitless Restaurants & Catering Private Limited operating the PappaRoti India website, apps and related services (the “Services”).

By using our Services you agree to this Policy and our Terms of Use.

Quick summary

We collect data you give us, data we get automatically when you browse, and data from partners like payment and delivery providers.
We use it to take and fulfil your orders, prevent fraud, support you, improve products, and with your choice send marketing.
We use cookies, analytics, and Meta tools (Pixel and Conversions API). You can change cookie choices anytime in Cookie Settings.
We don’t store full card numbers. Payments are processed by Razorpay in line with RBI tokenisation and PCI-DSS.
You can access, correct, delete, withdraw consent, raise a grievance, and nominate someone to act for you.
We keep data only as long as needed or required by law. We protect it with technical and organisational controls.
We may process data outside India with contractual safeguards and subject to any future Government transfer restrictions.

1) What we do with your information

Information you provide

Checkout & account: name, email, phone, delivery address, password.
Orders & delivery: items in cart, delivery notes, communication preferences.
Payments: Razorpay shares payment status and tokenised references with us. We don’t store full card numbers.
Support & feedback: messages, ratings, recorded calls/chats for quality and training.
Marketing choices: your newsletter and promo preferences.
Sensitive details you choose to share: e.g., allergies or dietary needs to help us serve you; we use these only for that purpose with your consent.

Information collected automatically

Device & usage: IP address, device identifiers, browser/app info, pages viewed, time on page, clicks, crash logs.
Approximate location: if you allow it, to show nearby outlets and estimate delivery times.
Cookies & similar tech: see “Cookies & tracking”.

Information from others

Payment partner: Razorpay provides payment status, token, and last 4 digits for refunds and fraud checks.
Delivery/communication partners: delivery status, SMS/WhatsApp delivery.
Analytics/ad partners: aggregated performance, attribution insights.
Social logins (if enabled): basic profile data from the provider after you authorise.

We use this information to provide and improve the Services, keep you safe, and comply with law.

2) Consent and your choices

We ask for consent where required, for example for marketing and non-essential cookies. You can withdraw consent at any time in Profile → Privacy, Cookie Settings, or by emailing support@papparoti.co.in. Withdrawing consent won’t affect service messages like order updates.

3) Disclosure and sharing

We share data only as needed and with safeguards:

Outlets/franchise partners to prepare and fulfil your order where applicable
Group/service providers for hosting, analytics, support, communications, delivery, and payment processing
Ad/measurement partners where you permit marketing cookies
Custom Audiences: if we upload hashed contact lists to platforms to show or exclude ads. You can opt out of list-based marketing at support@papparoti.co.in
Legal and safety: regulators, courts, law enforcement when required or to protect rights, safety or property
Business change: merger, acquisition or restructuring. Successors will honour this Policy

We do not sell your personal data.

4) Payments (Razorpay, RBI & PCI)

We use Razorpay to process payments.

We don’t store full card numbers. Razorpay processes card data under PCI-DSS and RBI card-tokenisation rules. We may store a token and the last 4 digits to process refunds and prevent fraud.
For UPI/wallet/net banking, we receive transaction references and status from the PSP or bank.
For details, read Razorpay’s terms and privacy on their website.

Questions about payments? Write to support@papparoti.co.in.

5) Third-party services & links

Our providers collect, use and disclose your information only to perform services for us, but they have their own privacy policies. Some may process data in other countries. Once you leave our site or use a third-party app, their terms and privacy policies apply. Please review them.

6) Security

We use encryption in transit, access controls, least-privilege access, logging, network isolation, staff training, and vendor due diligence. If a breach risks harm, we’ll notify affected users and the Data Protection Board of India where required.

7) Cookies & tracking (including Meta tools)

We use cookies and similar technologies to:

run the site and keep you signed in
measure visits and performance
reduce fraud
with your choice, personalise offers and ads

This includes Meta Pixel and Meta Conversions API, plus analytics tools. You can change or withdraw cookie choices anytime in Cookie Settings. Your ad preferences on Facebook or Instagram also influence what you see on those platforms.

We avoid dark patterns. No pre-ticked boxes. Unsubscribe and cookie changes are one-click where possible.

8) Age of users and minors

Our Services are not directed to children under 18. We don’t personalise ads to minors. We don’t knowingly collect data from children without verifiable consent of a parent or guardian. Parents or guardians can contact our Grievance Officer to review or delete a child’s information.

9) Your rights (India)

Under the Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025, you can:

Access the data we hold about you
Correct inaccurate or incomplete data
Delete data, subject to legal retains
Withdraw consent for optional processing
Opt out of marketing at any time
Nominate a person to act for you if you pass away or are incapacitated
Raise a grievance with our Grievance Officer. If unresolved, you may approach the Data Protection Board of India

How to use your rights:

In-app: Profile → Privacy and Cookie Settings
Email: support@papparoti.co.in
We aim to acknowledge requests quickly and resolve them within timelines prescribed by law.

10) Automated decisions & profiling

We use limited profiling to:

detect fraud and platform abuse
recommend products and offers
create or exclude ad audiences where you allowed marketing cookies

You can object to marketing-related profiling by changing Cookie Settings or emailing support@papparoti.co.in. Fraud checks are needed to protect you and the platform.

11) Data retention

We keep data only as long as needed for the purpose or as required by law:

Orders, invoices, tax records: 8–10 years
Customer support records: up to 3 years
Marketing preferences and contact lists: until you opt out or after 12–24 months of inactivity
Cookie identifiers: as listed in the Cookie Policy

When no longer needed we delete or de-identify data. If immediate deletion isn’t possible (for example backups), we isolate and secure it until deletion.

12) International transfers

We may process data outside India through trusted providers under contracts that require data protection and security. India permits cross-border transfers except to any countries the Government may restrict in future. You can contact us for details of transfer safeguards.

13) Email marketing

With your permission we may send emails about new products, offers, and updates. You can unsubscribe anytime via the link in our emails or by writing to support@papparoti.co.in. Unsubscribing from marketing won’t affect service emails like order confirmations.

14) Changes to this Policy

We may update this Policy to reflect legal, technical, or business changes. If changes are material we’ll notify you in-app or by email. Continued use of the Services means you accept the updated Policy.

15) Questions and contact

To access, correct, amend or delete your data, or to register a complaint, contact our Privacy/Grievance Officer:

Email: support@papparoti.co.in

Grievance Officer (India): Anirudh Agarwal, support@papparoti.co.in, C 16, Pamposh Enclave, Delhi, India – 110048

Company: Limitless Restaurants & Catering Private Limited