Privacy Policy

Customers. Anyone who browses, registers, subscribes or orders on FarmLokal.

Sellers. Four kinds, all covered here:

From customers

You give us:

• Name, mobile number, email address
• Delivery addresses, including landmarks and delivery instructions
• Order and subscription history
• Payment confirmation details (we do not store card numbers — see section 5)
• Messages you send us, and recordings of calls with our support line
• Reviews, ratings and product feedback

We collect automatically:

• Device, browser and operating system information
• IP address and approximate location derived from it
• Pages viewed, searches made, items added to cart
• Cookies and similar technologies (section 10)

We receive from others:

• Payment status from our payment gateway
• Delivery status from courier partners
• Order details from the ONDC network where you buy an ONDC-listed product

From sellers

• Business name, type, and contact details
• PAN, GSTIN and FSSAI licence number
• Bank account details for settlement
• Product catalogue, pricing and stock
• For Shopify merchants: your store domain, store owner name, contact email, store settings, and your product catalogue, received through Shopify's API with your authorisation
• Order, fulfilment and settlement records

We use personal data only for the purposes above.

Sellers — the minimum needed to deliver

When you order a product, we pass that seller only:

• The recipient's name
• The delivery address
• A contact phone number
• The items and quantities ordered

We do not pass on: your email address, your account details, your password, your payment details, your order history with other sellers, your browsing or search activity, your reviews, or your saved addresses other than the one you chose for that order.

Sellers may use this only to fulfil and deliver your order. Our seller agreements prohibit using it for marketing, adding you to a mailing list, sharing it, or keeping it longer than their legal obligations require.

How this differs by seller type:

Direct sellers receive the delivery details through our seller portal.

Shopify merchantsreceive the order in their own Shopify admin, created by our sales channel application, containing the recipient's name, delivery address and phone number. We do not pass your email address, and we do not create a customer record in the merchant's store. The delivery details sit on that single order and nothing more. This means a merchant can ship your order, but cannot add you to a mailing list, cannot see what else you have bought from FarmLokal, and cannot build a customer profile of you. If you ask a merchant to provide or delete your personal information, they are required to direct you to us. FarmLokal is responsible for responding.

ONDC sellers.ONDC is an open network operated under the Open Network for Digital Commerce protocol. FarmLokal participates as a buyer application. When you buy a product listed on ONDC, we transmit through the network the recipient's name, mobile number and delivery address, together with the items ordered, so the seller and their logistics provider can fulfil and deliver it. We do not transmit your email address, account details or order history. Once transmitted, that data is handled by the seller, their logistics provider and the network's other participants under their own privacy policies and the ONDC protocol's participant obligations. We have less direct control over data on the network than we do over data on our own platform, and we tell you this plainly rather than imply otherwise.

Others

• Logistics and delivery partners, to deliver your order
• Payment gateway, to process payment and settle with sellers
• Cloud and technology providers, who host our platform and store data on our behalf under contract
• Communication providers, who send our SMS, WhatsApp, email and voice messages
• Professional advisers, such as our auditors and lawyers, where necessary
• Authorities, where we are legally required to disclose

We do not sell your personal data, and we do not share it with advertisers for their own use.

We use technology to run the platform, and you should know where.

Product quality assessment. We operate an in-house computer vision system that assesses produce images for freshness, defects and ripeness. It analyses product photographs, not customers.

Voice support. Our support line uses an AI voice assistant to answer calls, help with orders and follow up after delivery. Calls are recorded and transcribed so we can improve service, train our systems and resolve disputes. You are told this at the start of the call. You can ask to speak with a person at any time, and you can ask us not to record.

Recommendations and offers. We use your order history to suggest products and personalise offers on the platform. No decision that significantly affects you is made by automated means alone. Seller verification, refunds and account suspensions are reviewed by a person.

Where we must retain a transaction record but no longer need to identify you, we anonymise it — removing your name, phone and address while keeping the financial record our law requires.

About backups. We keep database backups so we can recover from failure. When we delete or anonymise your data in our live systems, it may still exist in a backup until that backup is replaced or expires. We do not use backup data for any purpose other than restoring the service, and if a backup is ever restored we reapply any deletions that were made in the meantime.

This policy covers the FarmLokal apps on iOS and Android as well as the website.

Permissions the apps ask for

We ask only when a feature needs it, and you can refuse or withdraw any of them in your device settings. Refusing a permission disables that feature, not the whole app.

We do not read your contacts, messages, call logs, files or other apps on your device.

Information the apps collect

• Device model, operating system version and app version
• A device identifier used to deliver notifications
• An advertising identifier, where you allow it, used to measure our advertising
• Crash reports and performance data
• How you use the app, such as screens viewed and items added to cart

Push notifications. Order and delivery updates are sent by default so you know where your order is. Marketing notifications are sent only if you allow them. You can turn either off in the app or in your device settings.

Advertising and tracking. On iOS we ask for your permission before using your advertising identifier for measurement or advertising. If you decline, the app works exactly the same. On Android you can reset or delete your advertising ID in your device settings.

Deleting your account from the app. You can delete your FarmLokal account from inside the app, under Account, without contacting us. Deleting your account removes your profile, saved addresses and preferences. We keep order and invoice records where tax and company law requires it, with your personal details anonymised as described in section 8.

App stores. The App Store and Google Play collect their own data about downloads and purchases under their own privacy policies. We do not control that.

We use cookies and similar technologies to keep you signed in, remember your cart, understand how the site is used, and measure our marketing. Some are essential and the site will not work without them. Others help us understand usage and measure advertising.

We use third-party analytics and advertising tools, including Google Analytics and Meta's advertising tools. These may set their own cookies and are governed by their own privacy policies.

Controlling cookies. You can block or delete cookies through your browser settings. Blocking essential cookies will stop parts of the site working. You can also opt out of interest-based advertising through the settings offered by Google and Meta directly.

Under the Digital Personal Data Protection Act, 2023, you may:

• Ask what we hold about you and how we use it
• Correct anything inaccurate or incomplete
• Ask us to delete your data, subject to records we must keep by law
• Withdraw consent you previously gave, including for marketing
• Nominate someone to exercise these rights on your behalf if you are unable to
• Complain to us, and to the Data Protection Board of India if you are not satisfied

How to exercise them: contact our Grievance Officer:

We may need to verify your identity. We will respond within the time the law requires. If you bought from a seller and contact them instead, they should direct you to us. FarmLokal is responsible for your data as the marketplace, not the individual seller.

• Encryption in transit and at rest
• Access limited to staff whose role requires it, and access to personal data is logged
• Payment details tokenised, never stored by us
• Regular review of who has access
• A defined process for handling any security incident, including notifying you and the authorities where the law requires

No system is perfectly secure. If a breach affects you, we will tell you as the law requires.