Effective 3 October 2026 · Version 1.1
This Privacy Policy ("Policy") constitutes an electronic record within the meaning of the Information Technology Act, 2000 and the rules made thereunder, and is published and executed in accordance with the provisions of Rule 3(1) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, which requires the publishing of the privacy policy and terms of use for access or usage of the Platform. This electronic record is generated by a computer system and does not require any physical, electronic or digital signature.
This Policy is issued by Pitta ("Pitta", "we", "us", "our", or the "Data Fiduciary") and governs the manner in which we collect, receive, possess, store, deal with, handle, use, process, disclose, transfer and retain Personal Data of natural persons ("you", the "Data Principal" or "User") in the course of, and in connection with, your access to and use of the Platform and the Services. By accessing, browsing, installing, registering upon or otherwise using the Platform, you expressly acknowledge that you have read, understood and unconditionally and irrevocably accept and consent to the practices described herein.
1.1 In this Policy, unless the context or meaning otherwise requires, the following capitalised expressions shall bear the meanings ascribed to them hereunder:
1.2 The headings herein are for convenience only and shall not affect construction. Words importing the singular include the plural and vice versa; references to a "person" include a body corporate, unincorporated body or partnership; and the words "include", "including" and "in particular" shall be construed as being by way of illustration and without limitation.
2.1 This Policy applies to all Personal Data Processed by the Data Fiduciary in relation to Users, whether such Users access the Platform as customers or as businesses. Where a business communicates with a customer through the Platform, such business shall, in respect of its own dealings, act as an independent controller and be responsible for its own compliance with Applicable Law, and Pitta shall carry, store and transmit the relevant User Content on such business's behalf as an intermediary.
2.2 This Policy is to be read conjunctively and in seamless integration with the Terms and Conditions and any supplemental terms, each of which is incorporated herein by reference mutatis mutandis.
3.1 By your continued use of the Platform, you grant to the Data Fiduciary your free, specific, informed, unconditional and unambiguous consent, signified by a clear affirmative action, to the Processing of your Personal Data for the purposes enumerated herein.
3.2 We may, additionally and in the alternative, Process Personal Data on any lawful basis available under Applicable Law, including for the performance of the Services requested by you, for compliance with legal obligations to which we are subject, and for such legitimate uses as may be permitted under the DPDP Act.
3.3 You may withdraw your consent at any time in the manner set out in Clause 11; provided that the consequence of such withdrawal shall be borne by you, and any lawful Processing undertaken prior to such withdrawal shall remain unaffected.
4.1 From customers, we may collect: (a) the mobile telephone number constituting the account identifier, verified by a one-time passcode, no password being seen or stored by us; (b) device identifiers, platform and application version, for the purposes of single-session enforcement and version compatibility; (c) User Content, including messages, media, orders, bookings and gift-card purchases, together with any delivery address you input and the transaction reference furnished by the payment processor, it being clarified that we do not receive your card number, card verification value or unified-payments-interface personal identification number; (d) follows, mutes, importance markings and notification preferences; and (e) correspondence and safety reports you submit.
4.2 From businesses, we may collect owner and personnel telephone numbers, business name, category, contact particulars, operating hours, catalogue, broadcast content, audience lists (representing recipients who have opted in), and API keys, webhook endpoints and delivery logs.
4.3 Where you set a display name or profile photograph, the same is stored upon our systems and is made visible to the businesses with which you communicate, in order that they may identify you in their requests, orders and bookings. Your "about" text resides solely upon your device and is not transmitted to us.
5.1 Personal Data is Processed for purposes reasonably ancillary and incidental to the provision of the Services, including to: (a) effectuate delivery of messages, orders and bookings; (b) facilitate the sale of gift cards and the issuance of vouchers through our voucher partner, and effect refunds where a voucher cannot be issued; (c) transmit push notifications you have enabled; (d) preserve the integrity, security and lawful operation of the Platform, including rate-limiting, fraud prevention and the suspension of abusive accounts; and (e) discharge our obligations under Applicable Law.
5.2 For the avoidance of doubt, and notwithstanding anything to the contrary, we do not sell Personal Data and we do not serve third-party behavioural advertising.
6.1 We may disclose Personal Data, strictly on a need-to-know basis and to the extent necessary, to: (a) the businesses you elect to follow, who shall receive your number, the name you input into an order, and the User Content you transmit to them; (b) our payment processor (Razorpay) and our voucher partner (Hubble), each receiving only such data as is necessary to consummate the relevant transaction; (c) infrastructure, hosting, communications and notification providers (including Google/Firebase), acting as data processors under obligations of confidentiality and of Processing only upon our documented instructions; and (d) any court, tribunal, regulatory, statutory or governmental authority, where such disclosure is required or permitted under Applicable Law, or is expedient for the protection of the rights, property or safety of Pitta, its Users or the public.
7.1 This website deploys Google Analytics, a web-analytics service, which sets cookies and Processes usage information (including a truncated internet-protocol address, device and browser attributes, and pages accessed) for the purpose of compiling aggregate, statistical and non-identifying measures of Platform usage. Such Processing is not correlated to your Pitta account. You may decline or disable such cookies through your user-agent settings or an appropriate blocking extension. The mobile applications do not employ advertising cookies or third-party advertising identifiers.
8.1 We shall retain Personal Data and User Content for so long as your account subsists and thereafter for such period as may be necessary to: (a) provide, administer and improve the Services; (b) comply with our obligations under Applicable Law, including those pertaining to accounting, taxation and applicable periods of limitation; (c) establish, exercise or defend legal claims; and (d) enforce our agreements and prevent fraud, abuse or misuse.
8.2 For the avoidance of doubt, and in supersession of any prior representation to the contrary, User Content and messages are retained upon our systems to enable their continued availability, delivery and functionality within the Services, and are not subject to automatic deletion upon the expiry of any fixed short interval. A Data Principal may at any time delete individual conversations, all conversations, or the account in its entirety, whereupon the Personal Data associated therewith shall forthwith cease to be available within the Services and shall be permanently erased from our systems within thirty (30) days of such deletion, save for (i) residual copies subsisting within secure backup media for a limited period pending cyclical overwriting, and (ii) any records we are obliged to retain under Applicable Law.
9.1 We have implemented and maintain reasonable security practices and procedures within the meaning of Section 43A of the Information Technology Act, 2000 and the SPDI Rules, commensurate with the nature of the Personal Data and the harm that may result from its compromise, including encryption of data in transit, access controls on a least-privilege basis, protected secret storage and encrypted backups. Notwithstanding the foregoing, no method of transmission or storage is impregnable, and, save to the extent mandated by Applicable Law, we do not warrant absolute security. In the event of a personal-data breach, we shall act and notify in the manner and within the timelines prescribed by Applicable Law.
10.1 The Platform is developed and operated in India. Certain of our processors (including Google) may Process Personal Data upon infrastructure situated outside the territory of India. By your continued use, you consent to such transfer, subject to the safeguards afforded by such processors and to the transfers permissible under Applicable Law.
11.1 Subject to and in the manner contemplated by Applicable Law, you may: (a) seek access to, and the correction, completion, updating or erasure of, your Personal Data; (b) mute or unfollow any business, whereupon it shall no longer be able to message you, and report any channel; (c) clear any or all conversations and log out to purge local cache; (d) delete your account through Settings → Delete account, as further detailed on the account-deletion page; (e) withdraw consent previously granted; and (f) nominate, where the law so provides, another individual to exercise your rights in the event of death or incapacity. Requests may be made as provided in Clause 15.
12.1 The Platform is intended solely for persons who have attained the age of eighteen (18) years. We do not knowingly Process the Personal Data of a child save with the verifiable consent of a parent or lawful guardian in accordance with Applicable Law. Should we become aware of any such Processing absent the requisite consent, we shall expunge the same.
14.1 We reserve the right, at our sole and absolute discretion, to modify, amend, supplement or restate this Policy at any time. The date of the latest revision shall be reflected above, and, in respect of material variations, we shall endeavour to notify you within the application. Your continued use of the Platform subsequent to any such revision shall constitute your acceptance thereof.
15.1 In compliance with the Information Technology Act, 2000, the rules framed thereunder and the DPDP Act, any grievance, request or complaint concerning the Processing of Personal Data may be addressed to the Grievance Officer at hello@pitta.pro, by written communication to the official Pitta channel within the application, or by telephone to +91 94919 99998. We shall acknowledge each grievance and endeavour to redress the same within the timelines stipulated by Applicable Law.
16.1 Severability. If any provision of this Policy is held to be invalid, illegal or unenforceable, the validity, legality and enforceability of the remaining provisions shall not in any way be affected or impaired, and such provision shall be deemed modified to the minimum extent necessary to render it enforceable.
16.2 Governing law. This Policy shall be governed by and construed in accordance with the laws of India, and the courts of competent jurisdiction in India shall have jurisdiction over any matter arising herefrom, without prejudice to any non-derogable statutory rights you may possess.
16.3 Contact. Further assistance is available on the support page, or via the business portal at app.pitta.pro. This Policy should be read together with our Terms and Conditions.