Privacy Policy

To coordinate deliveries within campus hostel blocks and academic buildings, we collect strictly essential information:

• Student Phone Number: Used exclusively for secure SMS/WhatsApp order updates, delivery OTP dispatch, and direct contact by your peer-runner during drop-off.
• Hostel Room & Drop-off Location:Your designated hostel block, wing, room number, or campus building point (e.g., “Girls Hostel 1, Room 204”) necessary for precise physical handover.
• Name & College Email: For account verification, order receipts, and customer support communications.
• Transaction Identifiers: Razorpay order and payment IDs, items purchased, timestamp, and amounts. We do not collect or store credit/debit card numbers, CVV codes, or UPI MPINs on our servers.

Your data is processed strictly for the following operational purposes:

• Transmitting order tickets to canteens for timely preparation.
• Routing deliveries to student couriers and generating 4-digit verification OTPs.
• Issuing electronic receipts, invoices, and settling accounts with canteen vendors.
• Investigating customer support claims, food quality reports, or refund disputes.
• Preventing platform abuse, fraudulent accounts, or safety violations on campus.

When you track an active delivery, the courier's real-time campus coordinates are streamed ephemerally to your tracking map to show estimated time of arrival.

No Permanent Location History: Detailed GPS tracking points are retained only for the duration of the active delivery run. Once an order is marked delivered with OTP verification, live GPS streams are immediately terminated and purged from active routing buffers.

We enforce bank-grade security protocols across all infrastructure layers:

• TLS 1.3 Transport Encryption: All browser-to-backend communications are enforced over HTTPS with strict HSTS preload and Content Security Policies.
• Database Encryption: Stored customer profiles, orders, and settlements are encrypted at rest using industry-standard AES-256 protocols.
• Token Integrity & Strict HS256 JWTs: Session tokens are cryptographically signed with strict signature verification, preventing algorithm tampering.
• Automated Rate Limiting: SlowAPI edge rate limiters prevent brute-force credential stuffing and unauthorized automated API scraping.

We never sell, rent, monetize, or trade student personal information or phone numbers to external third parties, marketing agencies, or data brokers.

Information is disclosed only to authorized payment aggregators (Razorpay Software Pvt. Ltd.) to complete financial transactions as required by the Reserve Bank of India (RBI), or when mandated by Indian law enforcement.

In compliance with the Digital Personal Data Protection Act, you have the right to request access to your data, correct inaccuracies, or permanently delete your CampusBite account.

Upon receiving an account deletion request via our support desk, your personal identifiers (phone, email, saved hostel room addresses) will be purged within 30 days, retaining only anonymized accounting records required for statutory tax and audit compliance.

For questions regarding this policy, data removal requests, or to report a privacy concern, contact our designated Data Protection Officer: