This policy explains what we do with your personal information when you use indoram.in, place an order, or contact us. We have tried to write it in plain language rather than in legal shorthand. If anything here is unclear, ask us and we will explain it.
We handle personal data in line with applicable Indian law, including the Digital Personal Data Protection Act, 2023.
Who you are dealing with
Indoram is the trading name of a monthly home-style tiffin service operating in Indore, Madhya Pradesh, India. This website, indoram.in, is operated by Indoram, and Indoram is the seller of every monthly plan, trial meal and tiffin box deposit sold through it.
Indoram does not currently publish a registered company name, registered office address, GSTIN or FSSAI licence number on this website. Where any of those becomes applicable it will be published here, rather than claimed in advance.
What we collect
Information you give us
- Your name, mobile number and email address, when you create an account, place an order, or send us a message.
- Your delivery address — house or flat, street, landmark, area and pincode — and any delivery note you add, such as which bell to ring.
- Your password, which we store only as a one-way hash. We cannot read it, and nobody at Indoram can tell you what it is.
- Your location coordinates, but only if you tap Use my current location and your browser asks you to allow it. You can always type the address instead; the site works fully without sharing your location.
- What you tell us in an enquiry or a support ticket, including a bulk or office enquiry and anything you choose to put in it.
Information created by using the service
- Your orders, subscriptions and delivery calendar.
- Your meal skips, your meal credit balance and the history behind it.
- Your tiffin box deposit, which box was issued to you, and its return.
- Deliveries recorded as delivered or not delivered.
- Support conversations and the notes our team adds to them.
Payment information
We record the amount, currency, status and the payment provider reference for each payment, and the same for any refund. We never receive or store your card number, CVV, UPI PIN, netbanking credentials or bank account number. Those are handled by the payment provider on its own systems, not ours.
Technical information
- A session cookie (named indoram_session), which keeps you signed in and protects forms against cross-site request forgery. It is strictly necessary for the site to work and it carries no advertising identifier.
- Server logs kept by our host, which include your IP address, for security, abuse prevention and fault diagnosis.
- Our own first-party activity counts, such as how many people looked at a plan or ran an availability check. When you check whether we deliver to an area, we store the area searched without your IP address and without any identifier that follows you between visits, so we can see which parts of Indore want us without building a profile of you.
Why we need it
| Purpose | What it uses |
|---|---|
| Confirming whether we can deliver to you at all | Address, pincode, optional coordinates |
| Cooking and delivering your meals on the right day, to the right door | Name, mobile number, address, delivery note, meal calendar |
| Running your subscription: skips, credits, pauses, the end date | Subscription and credit records |
| Taking payment, verifying it and issuing refunds | Order amount, payment status and provider reference |
| Holding and returning your tiffin box deposit | Deposit and box records |
| Answering your questions and resolving complaints | Contact details and your messages |
| Keeping accounts and meeting tax and legal obligations | Order and payment records |
| Keeping the site secure and preventing abuse | Server logs, rate-limit records, our internal audit log |
We do not sell your personal information, we do not rent it out, and we do not use it for third-party advertising or profiling.
Marketing messages
We contact you about things you have asked for: order and subscription updates, delivery problems, deposit and refund matters, and replies to your enquiries. If we ever want to send you marketing, we will ask you first and you will be able to stop it at any time by telling us.
Who else sees your information
We share the minimum needed, with the following categories of recipient. Nothing is shared with anyone else.
The kitchen and the delivery person serving your order
They receive your name, mobile number, delivery address, delivery note and the meals due — what is needed to cook and hand over your food. They do not receive your payment details, your password or your account history.
Our hosting provider
This website and its database are hosted by Hostinger, which processes the data on our instructions in order to run the servers. Our content is served to you through Hostinger’s content delivery network, which has an edge location in Mumbai.
Our payment provider
When online payment is live on this site it will be processed by Razorpay Software Private Limited, which would receive your name, mobile number, email address and the amount in order to take the payment, and would handle your card or UPI credentials on its own systems under its own privacy policy. Online payment is not yet enabled on this site, so no customer data has been sent to a payment provider. See the Pricing and Payment Terms for how payment works today.
Email delivery
Notification and support emails are sent through the mail service attached to our domain at Hostinger. Your email address and the content of the message pass through it.
Google Maps Platform — only if enabled
The address box can offer suggestions, and Use my current location can turn coordinates into an address, using Google Maps Platform. These features only operate when we have configured a Google API key. No Google Maps key is configured at present, so no address or location data is being sent to Google. If we enable it, suggestions you type and coordinates you share would be sent to Google for that purpose, and manual address entry would remain available.
Analytics — only if enabled
We can run Google Analytics 4, with IP anonymisation on and advertising features and ad personalisation off, and never on account, checkout or admin pages. It loads only when a measurement id has been configured. No analytics measurement id is configured at present, so no third-party analytics script runs on this site. Our own first-party counts, described above, work either way.
Professional and legal recipients
We may disclose information to our accountant or legal adviser, or to a public authority or court, where we are required or permitted to by law. We would not hand over more than the request actually calls for.
Where your data is held
Your data is held on our hosting provider’s infrastructure. Several of the providers named above operate internationally, so your data may be processed outside India under their own terms. If you want to know the specific region your data is stored in, ask us and we will tell you.
How long we keep it
- Order, subscription, payment, deposit and refund records are kept for as long as we need them to run the service and to meet accounting, tax and legal obligations in India.
- Your account and saved addresses are kept while your account is open.
- Enquiries and support conversations are kept while the matter is open and for a reasonable period afterwards, so that a later question about the same issue can be answered.
- Server and security logs are kept for the short period our host retains them.
- Availability-check records hold only the area searched, with no identifier linking them to you.
We have not fixed a single retention period for every record type, because a financial record and a support message do not need the same treatment. When you ask us to delete your data we will tell you exactly what we can remove and what we are obliged to keep.
How we protect it
- The whole site is served over HTTPS and asks browsers to refuse an unencrypted connection.
- Passwords are stored as one-way hashes, never as readable text.
- Application code, configuration and secrets sit outside the public web folder and are not reachable from the internet.
- The database account the site uses has rights on the Indoram database only.
- Forms carry anti-forgery tokens, the browser is sent a strict content security policy, and sensitive endpoints are rate limited.
- Staff actions on customer records, payments, credits and refunds are written to an audit log with the person who did them.
- Staff access is role based: a support user cannot change prices, and only the owner can.
No system is perfectly secure, and we will not pretend otherwise. If a breach ever affects your personal data we will tell you and the relevant authority as the law requires.
Your rights
You can ask us to:
- Show you the personal data we hold about you.
- Correct anything wrong. Your name, mobile number, email and addresses you can edit yourself from your account at any time.
- Delete your data. We will remove what we are not required to keep, and tell you plainly what must stay and why.
- Withdraw a consent you gave, such as permission to contact you about an enquiry, or location access, which you can also revoke in your browser.
- Complain about how we have handled your data.
Write to info@indoram.in or call 7247603302. We may need to confirm who you are before acting on a request, so that nobody else can obtain or delete your records. We will respond within the time applicable law allows, and we will tell you what we have done.
If you are not satisfied with our response, you may complain to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.
Children
This service is for adults. You must be 18 or older to hold an account or place an order, and we do not knowingly collect personal data about children. If you believe a child has given us personal data, tell us and we will delete it.
Changes to this policy
If what we do with your data changes, this page changes with it, and the date at the foot of the page tells you when it last changed. Where a change is significant we will say so on the site rather than quietly edit the text.
How to reach us
- Phone: 7247603302
- Email: info@indoram.in
- The contact form, which reaches our team directly and always shows our current contact details
- If you already have an account: Support inside your account, which keeps the whole conversation attached to your subscription
A phone call or the contact form gets the quickest answer. We aim to acknowledge messages within one working day.