These are the operating policies for the service as described on this site. They apply to Pickit Farm Fresh Private Limited (“Pickit”, “we”, “us”) and to every person who uses the Pickit app or website.
Scope
This policy covers personal data we handle as a data fiduciary: information you give us when you create an account, place an order or contact support, and information generated as you use the service. It does not cover third-party sites we link to, which run their own policies.
What we collect
- Account details — your name, mobile number, email address and password hash. We never store your password in readable form.
- Delivery addresses — the addresses you save, along with any access notes you add (gate codes, floor, landmark) so a driver can find you.
- Location — if you grant permission, your device location is used once, at the moment you add an address, to place the pin accurately. We do not track your location in the background.
- Order history — your plan, crate contents, edits, skips, delivery timestamps and any issues you reported.
- Payment information — handled by our payment gateway. Pickit receives a reusable token and the last four digits of the instrument. We never see or store full card numbers, CVVs or UPI PINs.
- Device and usage data — device model, operating system version, app version, IP address, crash reports and which screens you used. This is what tells us a release broke something.
- Support correspondence — the messages, photos and order references you send when reporting a problem.
Why we collect it
To take and fulfil your order; to route a driver to your door inside the delivery window; to charge you correctly and issue refunds; to answer support requests and investigate a reported issue; to keep the traceability record that links a crate back to a farm and a harvest batch; to detect fraud and abuse; to fix crashes and improve the product; and to meet our tax, food safety and record-keeping obligations.
We do not sell your personal data. We do not share it with advertisers or data brokers.
Lawful basis
Most processing rests on the contract between us: you cannot receive a crate without an address, and we cannot charge you without a payment token. Some processing rests on our legitimate interest in running a safe, non-fraudulent service, and some on legal obligations such as tax and food safety records. Where we rely on your consent — marketing messages, precise location, optional analytics — you may withdraw it at any time, and withdrawing it is as easy as giving it.
Cookies and analytics
The website uses strictly necessary cookies to keep you signed in and to remember your preferences. If you consent, we also use privacy-preserving analytics to understand which pages are useful and where people get stuck. Analytics data is aggregated and is not used to build an advertising profile of you. You can decline analytics without losing any functionality, and you can clear cookies from your browser at any time.
Who processes your data
We use a small number of service providers who process data on our instructions and only for the purposes we set:
- a payment gateway, to take payments and issue refunds;
- an SMS and email provider, to send order confirmations and delivery alerts;
- a mapping and geocoding provider, to convert an address into a delivery pin and plan routes;
- a cloud hosting and infrastructure provider, where the service runs;
- a customer support platform, which holds your correspondence with us.
Each is bound by contract to protect your data, to use it only as instructed, and to delete it when our arrangement ends. Where a provider processes data outside India, we ensure the transfer meets the safeguards required under applicable law.
How long we keep it
- Account and address data — while your account is active, then 90 days after you close it.
- Order and invoice records — eight years, as required for tax and statutory audit.
- Food safety and traceability batch records — three years from the date of harvest.
- Support correspondence — 24 months from the date the ticket closed.
- Device, crash and analytics data — 14 months, then aggregated or deleted.
When a retention period ends we delete the data or irreversibly anonymise it so it can no longer be linked back to you.
Your rights
Under the Digital Personal Data Protection Act, 2023 you may:
- ask what personal data we hold about you and how it has been used;
- have inaccurate or incomplete data corrected;
- have data erased where we no longer need it for a stated purpose or a legal obligation;
- receive a copy of the data you gave us in a portable, machine-readable format;
- withdraw a consent you previously gave;
- nominate another person to exercise these rights on your behalf if you are unable to; and
- complain to the Data Protection Board if you are not satisfied with our response.
Most of this is self-service in the app under Account → Privacy. For anything else, write to hello@pickit.farm and we will respond within 30 days.
Children’s data
The service is for adults. We do not knowingly create accounts for anyone under 18 or process a child’s personal data for tracking or targeted advertising. If you believe a child has given us data, tell us and we will delete it.
How we protect it
Data is encrypted in transit with TLS and at rest in our databases. Access is role-restricted and logged, so only staff who need a record to do their job can open it. Payment credentials never touch our servers. We run access reviews, keep our dependencies patched, and will notify you and the Data Protection Board without undue delay if a breach is likely to affect you.
Grievance officer
If you have a privacy concern that support has not resolved, write to our grievance officer:
Grievance Officer, Pickit Farm Fresh Private Limited
No. 24, Krishna Reddy Layout, Domlur, Bengaluru 560071, Karnataka, India
hello@pickit.farm · +91 80 4718 2200
We acknowledge every grievance within 48 hours and aim to resolve it within 30 days.
Changes to this policy
When we change this policy we update the date at the top of the page. If a change materially affects how we handle your data, we will tell you in the app and by email at least 14 days before it takes effect, so you can object or close your account first.