# Privacy Policy **Last Updated: October 2026** At **Tumyto**, we respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how **MS Brahmas Solutions**, operating under the brand name **Tumyto** ("Tumyto", "we", "us", or "our"), collects, uses, stores, shares, and protects information when you use the Tumyto mobile application, website, meal subscription services, customer support channels, and related services (collectively, the **"Platform"**). By using Tumyto, you acknowledge the practices described in this Privacy Policy. --- # 1. Information We Collect The information we collect depends on how you interact with Tumyto and which services you use. ## 1.1 Account and Personal Information When you create an account, place an order, create a subscription, contact support, or otherwise use Tumyto, we may collect information such as: - name; - username; - phone number; - email address, where provided; - account identifiers; - delivery addresses; - delivery instructions; - profile information; and - other information you voluntarily provide. --- ## 1.2 Delivery and Address Information To provide meal delivery services, we may collect and process information relating to your delivery location, including: - saved addresses; - building, apartment, PG, hostel, or office information; - locality and postal code; - delivery instructions; - map coordinates associated with an address; and - other information necessary to identify or service a delivery location. This information may be shared with the relevant tiffin provider, restaurant, kitchen, or delivery personnel where necessary to complete a delivery. --- ## 1.3 Location Information With your permission, Tumyto may access your device's location to help you: - identify your current delivery location; - discover providers serving your area; - select or confirm an address; - determine serviceability; and - improve location-related features. Depending on your device permissions, this may include approximate or precise location information. You can control location access through your device settings. Certain location-based features may not function correctly if location permission is disabled. --- ## 1.4 Subscription and Meal Information When you use Tumyto's meal subscription services, we may collect information including: - selected tiffin provider; - selected meals and menu items; - subscription start and end dates; - scheduled meal dates; - lunch or dinner preferences; - delivery schedules; - skipped meals; - paused meals; - meal changes; - subscription status; - renewal information; - credits and adjustments; and - previous subscription and ordering activity. We use this information to operate and manage your meal subscription. --- ## 1.5 Payment and Transaction Information When you make a payment through Tumyto, we may collect information relating to the transaction, including: - transaction amount; - payment status; - transaction or payment reference; - refund information; - credits or adjustments; - payment method category; and - billing or transaction history. Payments may be processed by third-party payment gateways or financial institutions. Sensitive payment credentials such as complete card details, CVV, UPI PINs, banking passwords, or similar authentication credentials are generally processed directly by authorized payment service providers and are not intended to be stored by Tumyto. --- ## 1.6 Device and Technical Information When you access Tumyto, we may automatically receive certain technical information, including: - device type; - operating system; - application version; - browser type; - IP address; - device or application identifiers; - language settings; - network information; - crash information; - diagnostic information; and - technical logs. This information helps us maintain, secure, troubleshoot, and improve the Platform. --- ## 1.7 Usage Information We may collect information about how you interact with Tumyto, such as: - pages or screens viewed; - features used; - providers viewed; - subscription activity; - interactions with menus; - searches; - buttons or links selected; - session activity; and - timestamps associated with Platform activity. We use this information to understand how Tumyto is used and improve the customer experience. --- ## 1.8 Customer Support and Communications If you contact Tumyto through phone, WhatsApp, email, in-app support, or another communication channel, we may collect and retain information associated with that interaction. This may include: - your contact details; - messages; - support requests; - complaints; - feedback; - order or subscription references; and - information voluntarily provided during the conversation. This information may be used to provide support, investigate issues, improve our services, and maintain appropriate records of customer interactions. --- # 2. How We Use Your Information We use personal information for legitimate business and service purposes associated with operating Tumyto. ## 2.1 Providing Tumyto Services We may use your information to: - create and maintain your account; - determine serviceability; - display available tiffin providers; - create and manage meal subscriptions; - schedule meals; - process meal changes, skips, and pauses; - process payments; - manage credits and refunds; - coordinate deliveries; - provide customer support; and - communicate important service information. --- ## 2.2 Personalising Your Experience We may use your activity and previous interactions to make Tumyto more relevant to you. For example, we may use this information to: - show providers serving your location; - remember saved addresses; - display relevant menu options; - remember certain preferences; - improve recommendations; and - simplify future subscription creation. --- ## 2.3 Service Communications We may contact you regarding important operational matters such as: - subscription confirmations; - upcoming or scheduled meals; - delivery updates; - payment confirmations or failures; - subscription changes; - renewal reminders; - credits or refunds; - abandoned or incomplete subscription activity; - customer support requests; and - important changes affecting your account or service. These communications may be delivered through channels including: - push notifications; - SMS; - WhatsApp; - email; - telephone calls; or - in-app messages. Some service-related communications may be necessary for us to provide the service you requested. --- ## 2.4 Marketing and Promotional Communications Where permitted by applicable law, we may use your contact information to communicate: - offers; - discounts; - new providers; - new service locations; - new Tumyto features; - referral programs; and - other promotional information. Where consent is required, we will seek the appropriate consent. You may opt out of promotional communications through available unsubscribe mechanisms, communication preferences, or by contacting us. Opting out of promotional communications does not necessarily prevent you from receiving important transactional or service-related communications. --- ## 2.5 Improving Tumyto We may analyze usage, transaction, subscription, and operational information to: - understand customer behaviour; - improve Platform functionality; - identify popular meals and providers; - improve delivery operations; - understand demand across service areas; - improve subscription features; - identify technical problems; - develop new features; and - improve overall customer experience. Where appropriate, information may be aggregated or anonymized for analytics and business planning. --- ## 2.6 Security and Fraud Prevention We may process information to: - protect customer accounts; - identify suspicious activity; - prevent payment fraud; - prevent misuse of promotional offers or credits; - investigate security incidents; - detect abuse of the Platform; and - protect Tumyto, our customers, providers, employees, and partners. --- ## 2.7 Legal and Regulatory Requirements We may use or retain information where reasonably necessary to: - comply with applicable laws; - meet accounting or taxation requirements; - respond to lawful government or regulatory requests; - establish or defend legal claims; - investigate disputes; - enforce our Terms and Conditions; or - protect our legal rights. --- # 3. How We Share Information We do not sell your personal information as a business model. However, information may be shared where necessary to operate Tumyto and provide the services you request. ## 3.1 Tiffin Providers, Restaurants and Kitchens When you create a subscription or order from a provider, we may share information reasonably necessary for that provider to prepare and fulfil your meals. This may include: - customer name; - phone number where operationally necessary; - delivery address; - delivery instructions; - selected meals; - meal dates and timings; - order or subscription information; and - information necessary to resolve service issues. Providers are expected to use customer information only for legitimate purposes associated with providing the applicable service and in accordance with applicable law. --- ## 3.2 Delivery Partners Information necessary to complete a delivery may be provided to the person or organization responsible for delivering your meal. This may include: - name; - phone number; - delivery location; - address; - delivery instructions; and - relevant order information. Delivery personnel should use this information only for delivery-related purposes. --- ## 3.3 Payment Service Providers Transaction-related information may be shared with payment gateways, banks, UPI providers, card networks, and other financial service providers where necessary to: - process payments; - verify transactions; - process refunds; - prevent fraud; and - resolve payment disputes. Payment service providers process certain information under their own terms and privacy policies. --- ## 3.4 Technology and Service Providers We may use trusted third-party providers to support the operation of Tumyto. These may include providers of: - cloud hosting and infrastructure; - databases and data storage; - analytics; - mapping and location services; - payment processing; - SMS and OTP delivery; - WhatsApp communication; - push notifications; - email services; - customer support tools; - security and fraud prevention; and - other technical infrastructure. These providers may process information only to the extent reasonably necessary to provide their services to Tumyto, subject to applicable contractual and legal requirements. --- ## 3.5 Legal Requirements We may disclose information where we reasonably believe disclosure is necessary to: - comply with applicable law; - respond to a valid legal process; - comply with a court or government order; - cooperate with lawful regulatory requests; - investigate fraud or illegal activity; - protect the safety of customers or others; or - establish, exercise, or defend legal rights. --- ## 3.6 Business Transfers If Tumyto or MS Brahmas Solutions undergoes a merger, acquisition, restructuring, financing transaction, transfer of business, or sale of all or part of its assets, relevant information may be transferred as part of that transaction. Any such processing remains subject to applicable legal requirements. --- # 4. Data Security We take reasonable technical and organizational measures designed to protect personal information against: - unauthorized access; - unauthorized disclosure; - alteration; - misuse; - loss; and - destruction. These measures may include access controls, authentication mechanisms, secure infrastructure, restricted administrative access, monitoring, and other appropriate security practices. However, no internet-based platform, transmission method, or electronic storage system can be guaranteed to be completely secure. Users should also take reasonable precautions to protect their accounts and devices. --- # 5. Data Retention We retain personal information only for as long as reasonably necessary for the purposes for which it was collected or as required or permitted by applicable law. Different categories of information may have different retention periods. For example, certain transaction, payment, invoice, taxation, fraud-prevention, dispute, or regulatory records may need to be retained even after an account is no longer actively used. When information is no longer reasonably required, we may delete, anonymize, or securely dispose of it in accordance with applicable requirements. --- # 6. Your Choices and Rights Subject to applicable law, you may have rights relating to your personal information. These may include the ability to: - access certain personal information; - correct inaccurate or incomplete information; - update your account information; - request deletion of eligible personal information; - withdraw consent where processing is based on consent; - manage certain communication preferences; and - raise questions or grievances regarding the processing of your information. Certain information may not be immediately deleted where retention is required for legitimate legal, regulatory, accounting, fraud-prevention, dispute-resolution, or security purposes. To submit a privacy-related request, please contact us using the details provided below. We may need to verify your identity before processing certain requests. --- # 7. Location Permissions Tumyto may request permission to access your device's location. You can enable or disable location access through your device settings. Disabling location permissions does not necessarily prevent you from using Tumyto, but certain features — such as automatic location detection, address selection, or provider serviceability checks — may become unavailable or less accurate. --- # 8. Notifications and Communication Permissions Tumyto may request permission to send push notifications. Notifications may include: - subscription updates; - delivery information; - payment updates; - reminders; - service announcements; and - promotional communications where permitted. Push notification permissions can generally be managed through your device settings. Communication through SMS, WhatsApp, email, or other channels may be managed separately depending on the type of communication and applicable requirements. --- # 9. Cookies and Similar Technologies Our website and related web services may use cookies or similar technologies to: - maintain sessions; - remember preferences; - understand Platform usage; - measure performance; - improve functionality; - prevent fraud; and - support analytics. Your browser may allow you to control or disable certain cookies. Disabling some cookies may affect the functionality of the Platform. --- # 10. Analytics We may use analytics technologies to understand how customers interact with Tumyto. Analytics information may include device information, application activity, session information, feature usage, and other technical data. We use this information to identify problems, measure performance, understand usage patterns, and improve Tumyto. Where possible and appropriate, analytics may use aggregated or pseudonymized information. --- # 11. Third-Party Links and Services Tumyto may contain links to or integrations with third-party websites, applications, payment providers, maps, or other services. Those third parties may process information according to their own privacy policies. Tumyto is not responsible for the privacy practices of independent third-party services that are outside our control. We encourage users to review the privacy policies of relevant third-party services where appropriate. --- # 12. Children's Privacy Tumyto is not designed or intended primarily for children. Where applicable law requires parental or guardian consent for the processing of a child's personal information, Tumyto may restrict certain services or require appropriate consent. If you believe that personal information relating to a child has been provided to Tumyto inappropriately, please contact us so that we can review the matter and take appropriate action. --- # 13. Changes to This Privacy Policy We may update this Privacy Policy periodically to reflect: - changes to Tumyto's services; - new Platform features; - changes in technology; - operational changes; or - changes in applicable legal requirements. When we update this Privacy Policy, we will revise the **"Last Updated"** date at the top of this document. Where required by applicable law or where changes materially affect how personal information is processed, we may provide additional notice through the Platform or another appropriate communication channel. We encourage users to review this Privacy Policy periodically. --- # 14. Contact and Privacy Requests If you have questions about this Privacy Policy, how your information is handled, or wish to submit a privacy-related request, you may contact: **MS Brahmas Solutions** **Tumyto** AE-256, Rabindrapally Keshtopur, Kolkata – 700101 West Bengal, India **Email:** [support@tumyto.com](mailto:support@tumyto.com) **Phone:** +91 85850 42266 When submitting a privacy request, please provide sufficient information for us to identify your account and understand your request. We may request additional information where reasonably necessary to verify your identity and protect your account. --- # 15. Consent and Acknowledgement By using Tumyto and providing information through the Platform, you acknowledge that your information may be collected, processed, stored, and shared as described in this Privacy Policy, subject to applicable law and any consent requirements that apply to particular processing activities. Your continued use of the Platform following an update to this Privacy Policy will be governed by the updated policy, subject to any additional consent requirements under applicable law. --- **Tumyto — Everyday meals, sorted.** - MS BRAHMAS SOLUTIONS ## Website accounts, saved meal plans, and optional marketing When you sign in using a phone verification code, we save your website draft separately from orders and subscriptions. The draft includes your verified phone number, selected city and kitchen, meal preferences, plan selections, and any name, email, locality or PIN code you provide. Precise location is saved only when you choose to share it through your browser. We retain up to 50 recent draft activity entries and 20 consent changes. Drafts expire 180 days after their last update; you can also delete your website draft from My account. Deleting a draft does not delete your Tumyto account or existing orders. Marketing offers by SMS, WhatsApp or email require the separate, optional offers checkbox. You can withdraw that choice in My account and save your changes. Signing in and saving plans do not require marketing or advertising consent. If you allow ad tracking through Privacy choices, we use Meta Pixel and server-side conversion events to measure page visits, city searches, kitchen views, plan customization, saved-plan interest and app download clicks. Meta receives event identifiers, coarse city and kitchen identifiers, plan counts, browser information, IP address and available Meta cookies. We do not include your phone, email, precise coordinates or URL query strings in these events. Campaign UTM information may be saved with your draft when ad tracking is allowed. An app download click does not confirm an installation or purchase. You can change your ad tracking choice at any time through Privacy choices. Withdrawing consent stops future advertising events; it does not recall events already sent. ### Categorized website traffic When you accept advertising cookies, we also store first-party traffic events for up to 90 days. These include a random session identifier, campaign and advertisement tags from the landing link, referring hostname, traffic category and actions such as city selection, kitchen views, plan customization and app-store clicks. We do not store the full referring URL or raw Facebook click identifier in this collection. Sessions expire after 30 minutes of inactivity and are scoped to a browser tab. Saving a draft with advertising consent links its session identifier to traffic history for campaign measurement. Changing Privacy choices stops future collection and clears the local traffic session; previously stored events expire under the retention period above.