How Craves handles your information.

• Account and identity information such as phone number, name, email when provided, roles, and secure session identifiers.
• Saved delivery addresses and the order-specific address snapshot needed to fulfil an order.
• Cart, checkout, order, meal-plan, chef, delivery, notification, and support information.
• Payment and refund references, amounts, currencies, provider statuses, and reconciliation records.
• Security, audit, diagnostic, and operational records needed to protect and operate the service.

Craves uses Razorpay for hosted payment processing. Craves stores payment and refund references and verified financial status needed for orders and reconciliation, but the Craves application does not require customers to provide card CVVs or UPI PINs to Craves.

Craves shares only the information needed for a service provider to perform its role. Current platform integrations include Firebase for phone authentication, Razorpay for payments and refunds, supported delivery providers for fulfilment, Microsoft Azure for application infrastructure, and communication services for transactional messages.

• Protected business APIs require Craves authentication and resource-ownership checks.
• Provider credentials and internal service secrets are not placed in public web or mobile code.
• Financial and operational events are retained with audit and reconciliation controls appropriate to their purpose.
• Craves masks secrets and sensitive personal data from application telemetry wherever it is not required.

For privacy or account questions, contact support@craves.in. Craves may need to retain certain transaction, refund, security, or audit records where required for legitimate operational, accounting, dispute, or legal purposes.