1. Who We Are

Carroto is a food and grocery delivery platform connecting customers with participating restaurants, grocery stores, and other merchants in Hyderabad, Pakistan, and other service areas displayed in the Platform.

Carroto is operated by Carroto, trading as Carroto (“Carroto,” “we,” “us,” or “our”).

This Privacy Policy explains how we collect, use, share, retain, and protect personal information when you use our customer mobile applications, website, customer support, and related services (collectively, the “Platform”).

This Policy covers customer information. Any additional collection specific to rider, Vendor, or staff applications, including background location tracking, must be explained in the relevant application’s privacy notice.

2. Information We Collect

2.1 Information You Provide

Depending on the features you use, we collect information such as:

• Account information: Your name, phone number, email address, and account authentication details.
• Delivery information: Delivery addresses, map pins, recipient contact details, and delivery instructions.
• Order information: Selected products, quantities, preferences, order history, and special instructions.
• Support information: Messages, complaints, feedback, and photographs or documents you choose to submit.
• Communication preferences: Your choices about promotional messages and notifications.

If you provide another person’s information, such as a delivery recipient’s name or phone number, you must have permission to provide it for that purpose.

Please avoid including unnecessary sensitive information in delivery notes, reviews, or support messages.

2.2 Location Information

When you grant location permission, we may collect the location made available by your device, which may be approximate or precise depending on your settings.

We use location information to:

• Identify your delivery location.
• Show available Vendors and service areas.
• Calculate delivery distances and charges.
• Help arrange and complete deliveries.

You can manage location permission through your device settings. A delivery address or map pin is still necessary to fulfil an order.

Customer app location collection: [Specify whether location is collected only while using the app, whether manual address entry is available, and whether any background collection occurs. Describe its purpose if applicable.]

2.3 Device and Technical Information

When you use the Platform, we may collect technical information such as your IP address, device model, operating system, app version, access times, diagnostic logs, and interactions with Platform features.

Where push notifications are enabled, we may process a device notification token to deliver messages to your device.

The exact information collected depends on the Platform features, service providers, and device permissions in use.

2.4 Payment and Transaction Information

We process information about your selected payment method, payment status, transaction reference, order amount, and refunds.

Online payments may be handled by third-party payment providers. Information you enter directly into their payment interfaces is also subject to their privacy notices.

Never send your card PIN, payment password, or bank verification code through delivery notes or customer support messages.

3. Account Registration and Social Sign-In

3.1 Account Registration

We collect the details requested during registration to create your account, verify access, communicate with you, and fulfil orders. Required and optional fields are identified in the Platform.

3.2 Sign In with Google

If Google sign-in is available and you choose to use it, we receive the account identifier and profile information authorised through the sign-in process, such as your name and email address.

We do not receive your Google password. Using Google sign-in does not by itself give us access to your emails or other Google services.

3.3 Sign In with Apple

If Apple sign-in is available and you choose to use it, we receive an account identifier and any name or email address Apple makes available through that process.

If you use Apple’s Hide My Email feature, we may receive a private relay email address instead of your personal email address. We do not receive your Apple password.

4. How We Use Your Information

We use personal information to:

• Create, maintain, and secure your account.
• Verify account access and prevent unauthorised use.
• Display available Vendors, products, and delivery options.
• Process orders, payments, cancellations, and refunds.
• Arrange delivery and communicate order updates.
• Respond to questions, complaints, and support requests.
• Remember saved addresses and preferences.
• Identify technical problems and improve Platform performance.
• Detect fraud, payment abuse, and promotional misuse.
• Send promotional communications according to your choices and applicable requirements.
• Meet legal obligations, maintain necessary records, and resolve disputes.

Where applicable law requires a legal basis for processing, we rely on the basis appropriate to the activity, such as fulfilling your order, complying with a legal obligation, a permitted legitimate interest, or your consent.

Where processing depends on consent, you may withdraw that consent. Withdrawal does not affect processing lawfully carried out beforehand.

5. App Permissions

Depending on the features available, the Platform may request:

• Location: To identify your delivery location, check service availability, and calculate delivery charges.
• Notifications: To provide order updates and, according to your preferences, promotional messages.
• Camera or selected photos: Where supported, to let you attach images to a support request or other feature you choose to use.

Permissions are requested when relevant to the feature. You can manage them through your device settings. Disabling a permission may limit the associated feature.

Permission details: [Remove permissions the app does not request and disclose any additional permissions, the information accessed, and their purposes.]

6. How We Share Information

6.1 Delivery Riders

We share the information reasonably necessary to complete your delivery, such as your delivery location, recipient name, contact number, order details, and relevant delivery instructions.

Riders are authorised to use this information for delivery and related support purposes, not for unrelated personal contact or marketing. Report any suspected misuse to Carroto support.

6.2 Restaurants and Other Vendors

We share order details and relevant preparation instructions with the Vendor fulfilling your order. Customer or recipient information is shared where necessary for fulfilment or resolving an order issue.

6.3 Service Providers

We use service providers to support functions such as hosting, authentication, maps, notifications, payments, customer support, diagnostics, and analytics.

Providers may process the information needed to perform their functions. We require appropriate safeguards and restrictions for providers processing personal information on our behalf.

Some providers, such as payment or sign-in providers, may also process information under their own privacy notices.

6.4 Legal and Safety Purposes

We may disclose information where reasonably necessary to comply with applicable law or valid legal requests, investigate fraud, resolve disputes, or protect the rights and safety of customers, riders, Vendors, Carroto, or others.

6.5 Business Transfers

6.6 Advertising and Other Data Sharing

Advertising and data-sharing practices: [State whether personal information is sold, shared for targeted advertising, or used for cross-app tracking. Identify relevant partners, information types, purposes, and available controls. If none of these activities occur, state that accurately.]

7. Cookies, Analytics, and Similar Technologies

Our website and integrated services may use cookies, local storage, or similar technologies to maintain sessions, remember preferences, support security, and understand service performance.

Mobile applications may use software development kits (“SDKs”) for similar functions.

You can manage cookies through your browser settings. Blocking essential cookies may affect sign-in or other website features. Where required, we request consent before enabling non-essential technologies.

8. Marketing and Service Communications

We may send offers, discounts, and service announcements through available channels, subject to your preferences and applicable law.

9. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including providing services, maintaining required records, resolving disputes, and preventing fraud.

Retention depends on the type of information, the reason it was collected, and applicable legal or operational requirements.

When information is no longer needed, we delete it or anonymise it so it can no longer reasonably identify you.

10. Account Deletion

You can request account deletion through email:mghaziaziz@gmail.com

We may reasonably verify your identity before processing a deletion request to protect your account against unauthorised deletion. We will not ask for your password or bank verification code.

Deleting your account removes your access to it and initiates deletion of associated personal information that we do not need to retain for a lawful and disclosed purpose.

Some transaction, refund, dispute, security, or legally required records may be retained for the periods described in Section 9. Retained information will be restricted to the relevant purpose.

Uninstalling the app does not delete your account. Account deletion does not remove any entitlement to a valid refund or prevent resolution of an outstanding complaint.

11. Your Choices and Privacy Requests

You can:

• Review and update available profile information and saved addresses.
• Manage device permissions and notification settings.
• Opt out of promotional communications.
• Request account deletion.
• Contact us about inaccurate information or a privacy concern.

Depending on applicable law, you may also have rights to access, obtain a copy of, correct, delete, restrict, or object to certain processing of your personal information.

Contact us to make a request. We may need to verify your identity and will explain any applicable limitations or lawful reasons for retaining information.

12. Information Security

We use reasonable technical and organisational safeguards designed to protect personal information against unauthorised access, loss, misuse, alteration, or disclosure.

Access to personal information is limited according to operational responsibilities. No internet transmission or storage system is completely secure.

You can help protect your account by securing your device, keeping authentication details private, and reporting suspicious activity.

If a personal information incident occurs, we will investigate and provide notifications where required by applicable law.

13. International Processing

Where we use providers operating outside Pakistan, your information may be stored or processed in other countries whose privacy laws may differ from those in Pakistan.

Where required, we implement appropriate safeguards for those transfers and require relevant providers to protect the information they process.

14. Children’s Privacy

The Platform is intended for people aged 18 or older. A parent or legal guardian should place orders on behalf of anyone under 18.

We do not knowingly allow children under 18 to create customer accounts. If you believe a child has provided personal information through an account without appropriate authorisation, contact us.

We will investigate and take appropriate steps to remove the account and associated information, subject to any lawful retention requirements.

15. Third-Party Links and Services

The Platform may link to third-party websites or integrate services such as payment gateways, maps, or social sign-in.

Their independent processing is governed by their own privacy notices. Please review those notices when using their services. Carroto remains responsible for its own collection and disclosure of personal information.

16. Changes to This Policy

We may update this Policy to reflect changes in our services, data practices, or applicable requirements.

The updated version will be published with a revised “Last Updated” date. We will communicate material changes through the Platform or another appropriate channel.

Where a change requires your consent, we will request it before carrying out the relevant new processing.

17. Contact Us

For privacy questions, account-deletion assistance, or concerns about your personal information, contact:

Carroto
Privacy Email: mghaziaziz@gmail.com
Customer Support Phone: 03473079432

Please include enough information for us to identify your account and understand your request. Do not include passwords, full card details, or bank verification codes.