Privacy policy
Last updated 02 October 2026
This policy explains what personal data GatEat ("GatEat", "we", "us") collects when you use the GatEat website and apps, why we collect it, who we share it with and the choices you have. It is published under the Information Technology Act, 2000 and its rules, and the Digital Personal Data Protection Act, 2023. By using GatEat you agree to the use of your data as described here.
1. Data we collect
| What | Details |
|---|---|
| Account | Mobile number (verified by OTP), name, email address if you give one, preferred language. |
| Addresses and location | Delivery addresses you save, the delivery location you choose and, if you allow it, your device's current location to find restaurants near you. |
| Orders | Items ordered, restaurant, bill, instructions, order status, delivery confirmation, ratings and reviews. |
| Payments | Payment method, amount, status and the gateway's transaction reference. Wallet balance and transactions. We do not receive or store your card number, CVV, UPI PIN or banking password; these go directly to the payment gateway. |
| Support | Messages, photos and files you send to our support team, and refund requests. |
| Device and usage | IP address, browser and device type, a device identifier used to prevent fraud, sign-in history and notification tokens if you turn on push notifications. |
Restaurants, delivery partners and franchise applicants also give us business and identity details (such as address, FSSAI, GST, PAN, bank account, driving licence and vehicle details) so that we can verify them and pay them. Bank, PAN and identity numbers are stored encrypted.
2. How we use it
- To create and secure your account and sign you in.
- To show restaurants that deliver to you, take your order, collect payment and deliver the food.
- To send order updates, OTPs and service messages by SMS, email, WhatsApp or push notification.
- To answer support requests and process cancellations and refunds.
- To prevent fraud and misuse of offers, refunds and cash on delivery.
- To improve the service, measure performance and keep accounts and tax records required by law.
- To tell you about offers. You can turn off push notifications at any time; essential messages about your orders, such as OTPs, will continue.
3. Who we share it with
- Restaurants receive your name and order details so they can prepare the order.
- Delivery partners receive your name, delivery address, location and phone number to deliver the order.
- Franchise teams who run GatEat in your city can see orders in their territory to manage operations and support.
- Payment gateways process your online payments and refunds.
- Service providers for SMS, email, WhatsApp, push notifications, maps and hosting handle data on our behalf, only as needed to provide those services.
- Authorities when the law requires it, or to protect the rights and safety of our users, partners or GatEat.
We do not sell your personal data.
4. Cookies and local storage
We use a small number of cookies that the service needs to work: one keeps you signed in, one remembers your language, and your browser stores your theme and delivery location. If you install the app, it keeps a cache of static files so pages load quickly. We do not use third-party advertising cookies.
5. How long we keep it
We keep your data for as long as your account is active. Order, payment and invoice records are kept for the period required by tax and accounting law. Server logs are deleted on a rolling basis. When data is no longer needed it is deleted or anonymised.
6. Security
Connections to GatEat are encrypted. OTPs and passwords are stored hashed, and sensitive partner information is encrypted. Access to personal data is limited by role and territory, and administrative actions are recorded in an audit log. No system is perfectly secure; if we learn of a breach affecting your data we will inform you and the authorities as the law requires.
7. Your choices and rights
- Access and correction: see and edit your name, email and addresses in your account.
- Location: you can deny location permission and enter your delivery address by hand.
- Notifications: turn push notifications on or off in your account or your device settings.
- Deletion and withdrawal of consent: ask us to delete your account and personal data through Contact us. We will do so except for records we must keep by law.
- Grievance and nomination: you may raise a grievance with us and, as provided by law, nominate another person to exercise your rights.
8. Children
GatEat is meant for people aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will remove it.
9. Links and third parties
Payment pages, maps and other third-party services you reach through GatEat have their own privacy policies, which apply to the data you give them.
10. Changes to this policy
We may update this policy. The date at the top shows the latest revision. Please review it from time to time.
11. Contact
For privacy questions or requests, write to us through Contact us. We acknowledge requests within 48 hours and aim to resolve them within one month.