Privacy Policy

Last updated: 30 July 2026

This Privacy Policy explains what personal data MIGZO (sole proprietorship of Sarita Rani Miglani), a sole proprietorship of Sarita Rani Miglani, trading as "MIGZO" (GSTIN 03DXEPM3001B1ZE, Punjab, India) ("Migzo", "we", "us"), collects when you use the Migzo mobile application, the website bookmigzo.com, and the restaurant partner dashboard (together, the "Service"), how we use it, and the rights you have over it.

We process personal data on the basis of your consent, in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"). You give this consent by ticking the consent box when you sign in; the version of this notice you agreed to, and when, is recorded against your account. When this notice changes materially, we ask you to consent again at your next sign-in.

1. Data we collect from customers

• Phone number — required; it is your account identity and is used to deliver the one-time password (OTP) you sign in with.
• Name and email — optional profile fields you may add; used to personalise the app and on your order invoices.
• Selected city — the city you choose in the app, used to show you restaurants that are actually near you.
• Device location (optional) — if you grant the location permission, the app reads your device's location in the foreground only, to suggest your city and show nearby outlets. Coordinates are resolved to a place name on the device. You can always pick your city manually instead, and you can withdraw the permission at any time in your device settings. The app does not track your location in the background.
• Push notification token (optional) — if you allow notifications, a device push token is stored so we can tell you when your order is confirmed, ready, or refunded.
• Order history — the items you ordered, the restaurant, amounts, timestamps, order status, and the GST invoice for each order.
• Payment status — the confirmation and transaction reference our payment gateway reports for your payment or refund. Migzo never receives or stores your card number, CVV, UPI PIN, or banking credentials; those are handled entirely by Razorpay (see section 4).
• Ratings and support messages — ratings or reviews you submit for orders, and the content of support or grievance requests you raise.

The app contains no third-party advertising and no third-party analytics or tracking SDKs.

2. Data we collect from restaurant partners

To onboard a restaurant we collect the business's KYC and compliance documents: FSSAI licence, PAN, GSTIN, bank account or UPI details for settlements, and the signed partner agreement, along with the outlet's contact details, address, and menu. KYC documents are stored encrypted. Because these records exist to satisfy legal and tax obligations, they are retained for the statutory periods even after a partner leaves the platform.

3. How we use personal data

• Running the Service — creating your account, signing you in by OTP, showing restaurants in your city, and processing your orders through to pickup.
• Payments and invoices — confirming payment through the gateway, issuing GST-compliant invoices, and processing refunds.
• Notifications — order-status updates by push notification. Anything promotional is sent only with your consent, and you can opt out without affecting order updates.
• Support and grievances — responding to your requests and resolving complaints.
• Safety and fraud prevention — protecting the Service, restaurants, and customers against fraud and abuse.
• Legal compliance — GST and tax record-keeping, and responding to lawful requests from authorities.

4. Who we share data with

We share personal data only with the service providers needed to run Migzo, each bound to use it solely for the stated purpose:

• Razorpay — our payment gateway. It processes your payment and refund and handles your payment instrument under its own privacy policy. We pass it the order amount and reference needed to collect the payment.
• MSG91 — our OTP delivery provider. Your phone number is shared with it to deliver the sign-in code by SMS or WhatsApp.
• Expo push service — relays order-status push notifications to your device using the push token described above.
• The restaurant you order from — sees your order contents, your first name (if provided), and the order's pickup code, so it can prepare and hand over your order. It does not see your phone number's full profile or payment details.
• Cloud infrastructure — our servers and databases are hosted on Amazon Web Services in the Mumbai (India) region, so your data is stored in India.

We may disclose data where required by law or to enforce our Terms of Service.

5. How long we keep data

• While your account is active — we keep the data above so the Service works for you.
• Account deletion — when you delete your account there is a 30-day grace period (sign back in to cancel). After it expires, your phone number, name, email, and push token are permanently deleted or replaced with random anonymous identifiers, and your notifications are erased. See the account deletion page for the exact breakdown.
• Tax records — GST invoices and transaction records must be retained under Indian tax law for a minimum of 6 years; after deletion they are kept in a form no longer linked to you personally.
• Partner compliance records — restaurant KYC and agreement records are retained for their statutory periods even after the partner account closes.
• Server logs and error reports — kept briefly for security and debugging, with personal data redacted.

6. Your rights under the DPDP Act, 2023

As the Data Principal you have the right to:

• Access — request a summary of the personal data we hold about you and how it is processed.
• Correction — update your name and email yourself in the app (Profile), or ask us to correct inaccurate data.
• Erasure — delete your account from Profile → Delete account, subject to the grace period and the legal retention described above.
• Withdraw consent — withdraw at any time by deleting your account, or withdraw a specific permission (location, notifications) in your device settings. Withdrawal does not affect processing already done.
• Grievance redressal — complain to our Grievance Officer (section 8) and, if unsatisfied, to the Data Protection Board of India.
• Nominate — nominate a person to exercise these rights on your behalf in the event of death or incapacity.

To exercise any right, use the in-app options or write to support@bookmigzo.com from your registered contact details. We verify identity before acting on a request.

7. Security

• All traffic between your device and our servers is encrypted with HTTPS/TLS.
• Sign-in uses one-time passwords; sessions use short-lived signed tokens that we can revoke, and deleting your account signs you out of all devices immediately.
• Restaurant KYC documents are stored encrypted, with access restricted to what onboarding and compliance require.
• Payments are handled by a PCI-DSS-compliant gateway; card data never touches Migzo's servers.

No system is perfectly secure, but we review and harden the Service continuously and will notify you and the authorities of a personal data breach as the DPDP Act requires.

8. Grievance Officer

In accordance with the DPDP Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, complaints about how your data is handled can be raised with our Grievance Officer:

9. Children

The Service is for users aged 18 and over. We do not knowingly collect personal data from children. If you believe a minor has created an account, write to support@bookmigzo.com and we will delete it.

10. Changes to this policy

When we change this policy materially, we update the "Last updated" date above and ask you to consent to the new version at your next sign-in. Continued use of the Service is never treated as silent consent to a materially changed policy.

11. Contact