Privacy Policy

Last updated: May 2025

1. Who we are

Dabbr is a tiffin service management app designed for home cooks and small tiffin providers in India. It helps providers manage customers, track daily deliveries, and record payments. This privacy policy explains what data we collect, how we use it, and how we protect it.

2. Data we collect

Provider accounts: When you sign in with Google, we receive your name, email address, and profile picture from Google. We store your name, email, and any business details you add in Settings (business name, phone number, UPI ID, logo).

Customer data: Providers enter customer information including names, WhatsApp numbers, addresses, meal preferences, and payment records. This data belongs to the provider and is stored securely.

Delivery logs: We store daily delivery statuses (delivered / skipped) to help providers track their service.

Payments: Payment amounts and dates recorded by providers. We do not store any credit card or banking information.

Phone numbers: If you use phone OTP login, we store your phone number to identify your account.

3. How we use your data

To provide the Dabbr service — managing customers, deliveries, and payments
To authenticate you securely via Google OAuth or phone OTP
To send OTP verification codes via SMS when you log in
To display your provider branding (name, logo, accent colour) on customer portals
We do not sell your data to any third party
We do not use your data for advertising

4. Data storage and security

All data is stored in Supabase (hosted on AWS in the US) with row-level security policies ensuring each provider can only access their own data. Connections are encrypted with TLS. OTP codes are hashed using SHA-256 and expire after 10 minutes.

5. Third-party services

Google OAuth — used for provider sign-in. Subject to Google's Privacy Policy.

Supabase — database and authentication infrastructure. Subject to Supabase's Privacy Policy.

2Factor.in — used to send OTP SMS messages. Only your phone number and a one-time code are shared.

Vercel — hosting provider. Request logs may be retained for up to 30 days.

6. Customer portal data

Customers who access their portal via a personal link can view their subscription details and daily menu. If they sign up for a customer account using their phone number, we store that number to link their subscriptions. Customers can request deletion of their account by contacting their provider or emailing us.

7. Your rights

You can delete your Dabbr account and all associated data by contacting us
You can disconnect Google sign-in from your Google account settings at any time
Providers can export or delete their customer data at any time

8. Children's privacy

Dabbr is not directed at children under 13. We do not knowingly collect data from children.

9. Changes to this policy

We may update this policy from time to time. We will notify providers via email for any significant changes. Continued use of Dabbr after changes constitutes acceptance of the updated policy.

10. Contact

For any privacy-related questions or data deletion requests, email us at rutvik.pansare@gmail.com