Privacy policy

Who this is about

Desi Meals, Shop No. 7, Lagoona Shop Line, Palava Phase 2, Dombivali East, MH,IN. GSTIN 27CEAPK5046L1ZC. FSSAI licence 11523021000434.

This policy covers www.desimeals.me — the website where you see the menu, place an order and pay for it. Ordering from us over WhatsApp instead is a conversation on Meta's app, and what Meta keeps of it is theirs to describe, not ours.

What we collect, and why

Your mobile number

How you sign in, and how the rider reaches you when a building gate is shut. Signing in sends a one-time code to that number on WhatsApp, which is also how we know the number is really yours.

Your name

So the bill and the delivery are addressed to somebody.

Your delivery address, and the area it is in

To deliver, and to work out the delivery charge. Saved to your account so you are not retyping it every evening; you can edit or remove a saved address in My account at any time.

Your order

The dishes, the quantities, the prices you were charged, any note you left for the kitchen, and the times it was placed, paid for and delivered. This is what becomes your bill.

A payment reference

Razorpay's reference for your payment and the amount they took, so that a bill can be matched to the money and a refund can be traced. Nothing else about how you paid reaches us — see below.

What we never see

Razorpay Software Private Limited is our payment gateway and handles the payment itself under their own privacy policy.

The one-time code

The code we send you to sign in is never stored as digits. We keep an irreversible fingerprint of it, so that we can check the code you type without holding anything that could be used to sign in as you. It stops working ten minutes after it is sent, the moment it is used, or the moment you ask for a new one — whichever happens first.

Cookies, and what your browser keeps

There are no advertising cookies and no analytics cookies on this site, because there is no advertising and no analytics. What is set is what signing in needs:

• dm_session — your signed-in session. It cannot be read by any script, only sent back to us, and it lasts up to 90 days unless you sign out.
• dm_csrf — its companion, which is readable by design. It is what proves a request came from this site and not from somebody else's page acting as you.
• Your basket — kept in your own browser's storage, on your device. It is not sent anywhere until you place the order.
• The shop's hours — the last opening times we heard, kept for the tab you are in, so the page does not flash the wrong sign while it asks again.

Clearing your browser's site data removes all four.

Who else ever sees it

Two companies, each for one job, and nobody else:

• Razorpay, to take the payment and to send a refund back.
• Meta, whose WhatsApp service carries the one-time code to your number. They are given the number to deliver the message to.

Inside our own business, your order reaches the kitchen counter, because somebody has to cook it and somebody has to raise the bill. That is the same shop, on our own server.

We do not sell, rent or trade your details, and we do not hand them to anybody for marketing — ours or anyone else's. We would disclose something if a law or a court in India required us to, and for no softer reason than that.

How long we keep it

• Bills and the orders behind them — for as long as tax law requires us to keep our books, which for GST is currently six years. These we cannot delete on request, because they are records the law says a business must hold.
• Your account — your number, name and saved addresses, for as long as you have an account with us.
• One-time codes — ten minutes.
• Sessions — up to 90 days, then you sign in again.

What you can ask for

You can see and correct your name and your saved addresses yourself, in My account, at any time. Beyond that, you can ask us to tell you what we hold about you, to correct it, or to delete your account and the details in it — and we will, apart from the bills the law makes us keep, which stay for their six years.

Ask on WhatsApp or by phone on +91 74004 01215. We will need to be sure it is you asking, which for an account identified by a phone number means asking from that number.

Keeping it safe

The site and everything it talks to are served only over an encrypted connection. Your session cookie cannot be read by scripts. Your one-time code is stored as a fingerprint and not as digits. No payment credential ever enters our systems. Our servers are our own rather than a shared host's.

None of which is a promise that nothing can ever go wrong — nobody can honestly make that one. It is what we do so that it is less likely to, and so that there is less to lose if it does.

Children

This site is not meant for children under 18, and we do not knowingly keep details belonging to one. If you believe a child has given us something, tell us and we will remove it.

Changes to this policy

If we change what we collect or who sees it, we change this page and move the date at the top of it. The date is the date the words changed, not the date the site was last published.

Asking us about any of this

Money, and when it comes back, is on the refunds and cancellations page.