Privacy policy
Last updated: 2026-10-09 · Governed by the Digital Personal Data Protection Act, 2023 (India)
Who we are
CitySetu ("we") is a brand of Onescai Solutions Pvt. Ltd., the company accountable for your data under the DPDP Act. We connect customers with independent local shops. We are a marketplace: shops sell to you directly, deliver themselves, and are paid by you directly.
Data we collect, and why
| Data | Why (purpose) |
|---|---|
| Phone number | Login (OTP), order updates, account security; contacting you about your account, setting up your shop, and feedback (see "When we may contact you") |
| Name (optional) | So the shop knows who the order is for |
| Delivery addresses & location | Showing shops that deliver to you; delivering your order |
| Order history, ratings, tickets | Running the service, resolving disputes, shop records |
| Payment references you enter (UPI UTR) | The refund/payment handshake between you and the shop — we never process or hold money |
| Payment screenshots you attach (one to three images) | So the shop can confirm your UPI payment. They are private: opened only by that shop's people who manage its payments and by CitySetu support, through a link that stops working after a few minutes. Location and device details are removed from the image when we store it, and the images are deleted after 180 days |
| Shopkeepers: your UPI ID, UPI QR and the name on the UPI account | Shown to your customers when they pay, so they can check whom they are paying. The QR is cropped to the code itself |
| Device push token | Order status notifications |
| App diagnostics (crashes, handled errors) | Fixing problems — tied to a reference id, not sold or shared |
Location
- We use your phone's precise location only while the app is open — to find the shops near you and to deliver to your door. Never in the background.
- A shop sees your exact map pin only for an order it has accepted, and only until 24 hours after that order is delivered. Before that, and after, it sees your area and the distance only.
- Your location is never sold, and never shared for advertising.
What we don't do
- No sale of personal data. No third-party advertising SDKs. No third-party trackers on this website.
- No payment processing — money moves directly between you and the shop over UPI/cash.
Sharing
The shop fulfilling your order sees your name, address and order contents — that's the service. Infrastructure providers (cloud hosting in India region, SMS delivery, push notifications) process data on our instructions. Legal requests are honored as required by Indian law.
When we may contact you
We may call or message you (by phone, WhatsApp, SMS or in the app) about your account, about setting up your shop on CitySetu, and to ask for your feedback. These are service messages, not promotions. If you would rather not be contacted this way, tell us on the support line or by e-mail (the details are on this page) and we will mark your account "Do not contact"; you will still get the messages an order or your account's security needs.
Consent & choices
- Promotional notifications are opt-out anytime (Profile → Offers & promotions). Order updates are part of the service.
- Location is used only when you set an address; you can type an address without granting location permission.
Retention & deletion
You can delete your account on the web or in-app. After a 30-day grace period your identity (name, phone, addresses) is permanently anonymised. Order and rating records are retained in de-identified form — shops need their sales records and the platform needs integrity of history. Sessions and push tokens are purged immediately at completion.
Grievance officer (DPDP)
Chetan Chopda · grievances@citysetu.com
We acknowledge complaints within 72 hours and resolve within 30 days.