Privacy Policy

OnGoCart ("OnGoCart," "we," "us," or "our") operates the OnGoCart mobile application and website at ongocart.com (together, the "Platform" or "Service"), which connects street cart vendors ("Vendors" or "Thela Vendors") with customers looking to discover them ("Customers"). This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have over it, whether you use the Platform as a Customer or as a Vendor.

This Policy is framed in accordance with India's Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, as applicable.

By using the Platform, you agree to the collection and use of information as described in this Privacy Policy.

1. Who This Policy Applies To

This Policy applies to:

• Customers who use the Platform to browse the live map and discover nearby Vendors, with or without creating an account.
• Vendors who register, create a profile, subscribe, and list a "thela" on the Platform.

Where a practice applies to only one group, this Policy says so explicitly.

2. Information We Collect

2.1 Information Customers Provide or Generate

• Location data: With your permission, we access your device's real-time location to show you nearby, currently-open Vendor listings on the map. Customers can use core discovery features without creating an account or providing a name, phone number, or email address.
• Device and usage information: Device type, operating system, app version, general usage analytics (e.g., which categories you browse, which screens you open), and crash/diagnostic data, collected to keep the app working reliably.
• Optional information: If you choose to contact support, leave feedback, or (in future) create an account for saved preferences, we collect what you provide (e.g., name, email, or phone number).

2.2 Information Vendors Provide

• Profile information: Full name, mobile number, and any other identity or contact details requested during registration.
• Business/listing information: Category and sub-category of goods sold (e.g., vegetables, fruits, chaat, juice), specific items listed as available, thela location (live/manually set), operating hours/time window, and Stock Clearance status when enabled.
• Subscription and payment information: Subscription plan selected, billing cycle, and transaction status. Full payment card or UPI credentials are processed directly by our third-party payment gateway, and are not stored on OnGoCart's own servers.
• Location data: Vendors' set or live location while a listing is active, so it can be shown to Customers on the map.

2.3 Information Collected Automatically (Both Customers and Vendors)

Device identifiers, IP address (approximate), app interaction logs, and diagnostic/crash reports.

We do not currently use third-party advertising trackers or sell data to ad networks.

3. How We Use Your Information

We use the information collected to:

• Show Customers accurate, real-time Vendor listings on the map, filtered by category and open status.
• Allow Vendors to create, edit, activate, and deactivate thela listings, including Stock Clearance status.
• Process Vendor subscription payments and manage subscription status.
• Send Vendors time-bound reminders (e.g., before a listing's set time expires).
• Provide customer support and respond to inquiries.
• Maintain, secure, debug, and improve the Platform.
• Comply with legal obligations, including under the DPDP Act, 2023 and applicable Indian law.

We do not use Vendor or Customer location data for any purpose beyond operating the live discovery map and related notifications described above.

4. Legal Basis and Consent

Under the DPDP Act, 2023, we process your personal data on the basis of your consent, given at the point location access is requested, at account/profile creation, or at subscription sign-up. You may withdraw consent at any time (see Section 8), though withdrawing consent for location access will limit or disable core features (e.g., Customers will not see the live map; Vendors will not be able to maintain an active listing).

5. How We Share Information

We do not sell personal data. We share information only in these circumstances:

• With other users, as intended by the Service: A Vendor's listing (category, items, location, open hours) is, by design, visible to Customers on the live map. Vendor account credentials, phone number, and payment details are not shown to Customers.
• With service providers: Third parties who help us operate the Platform. These providers are contractually restricted to using data only to provide services to us.
• For legal reasons: If required to comply with a valid legal process, government request, or to protect the rights, property, or safety of OnGoCart, our users, or the public.
• Business transfers: If OnGoCart is involved in a merger, acquisition, or sale of assets, user information may be transferred as part of that transaction, subject to this Policy or a policy at least as protective.

6. Data Storage and Security

Data is stored on servers.

We apply reasonable technical and organizational security measures to protect data against unauthorized access, alteration, disclosure, or destruction. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

In the event of a personal data breach affecting your information, we will notify affected users and the Data Protection Board of India as required under the DPDP Rules, 2025.

7. Data Retention

• Vendor account and listing data is retained for as long as the account remains active, and for a reasonable period afterward to comply with legal, tax, or dispute-resolution obligations, after which it is deleted or anonymized.
• Customer location data used for live map discovery is processed in real time and is not stored beyond the session required to show nearby listings, except where retained briefly for app performance/diagnostic purposes.
• Subscription/payment records are retained as required under applicable Indian tax and financial recordkeeping law.

8. Your Rights (Data Principal Rights under the DPDP Act, 2023)

As a "Data Principal" under Indian law, you have the right to:

• Access a summary of the personal data we hold about you and how it is processed.
• Correct inaccurate or incomplete personal data.
• Erase personal data that is no longer necessary for the purpose it was collected, subject to legal retention requirements.
• Withdraw consent at any time, with the same ease with which it was given.
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
• Grievance redressal through our Grievance Officer (see Section 12) before approaching the Data Protection Board of India.

To exercise any of these rights, contact us at info@ongocart.com with the subject line "Data Rights Request." We will respond within the timeline required under applicable law.

9. Location Permission — Specific Notes

• Customers can deny location access and still browse the app, but will not see personalized "nearby" results without it.
• Vendors must provide location data (live or manually set) for a listing to appear on the map — this is a core, non-optional part of the Vendor feature, since an "invisible" listing would defeat the Platform's purpose. Vendors control this by activating or deactivating their listing.
• Location access can be revoked at any time through your device's app permission settings.

10. Children's Privacy

The Platform is not intended for use by individuals under the age of 18. Vendor registration and subscription specifically require the account holder to be at least 18 years old and legally capable of entering into a contract under Indian law. We do not knowingly collect personal data from children. If we become aware that a child's data has been collected, we will delete it promptly. Parents or guardians who believe a child has provided data to us should contact info@ongocart.com.

11. Cookies and Tracking (Website)

The ongocart.com website may use essential cookies necessary for the site to function, and, where enabled, analytics cookies to understand aggregate site usage. We do not currently use third-party advertising cookies.

12. Grievance Officer

In accordance with the Information Technology Act, 2000 and rules made thereunder, and the DPDP Act, 2023, the details of our Grievance Officer are:

The Grievance Officer will acknowledge complaints and work to resolve them within the timelines prescribed under applicable Indian law.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified through the app or website, and the "Last Updated" date above will be revised. Continued use of the Platform after changes take effect constitutes acceptance of the revised Policy.

14. Governing Law

This Privacy Policy is governed by the laws of India. Any disputes arising from it are subject to the exclusive jurisdiction of the courts at Jaipur, Rajasthan.

15. Contact Us

For any questions about this Privacy Policy or how your data is handled:

• Email: info@ongocart.com
• Registered Address: G1, Aanchal Apartment, Sahakar Marg, Lalkothi, Jaipur, Rajasthan 302005