Privacy Policy

Last updated: 3 October 2026

Thallu Vandi Kadai (“we”) runs the website thalluvandikadai.in and the Thallu Vandi Kadai customer app and vendor app. We show which street vendors (thallu vandi and shops) are open near you, right now. This page explains what we collect, why, who can see it, and what you can do about it.

1. What we collect

If you are a customer

• Phone number, only when you sign in (to follow a vendor, call one, or send a request). We use it to send you a sign-in code and to recognise you next time.
• Name, if you add one.
• Follows and requests: the vendors you follow and the items you ask for (“I want”). When you send a request we also send your position at that moment, so vendors can see where people are asking for them. Vendors see requests grouped by area, not your name or number. A request stops being shown after 2 hours.
• Notification token, if you allow notifications, so we can tell you a vandi you follow is live.
• About your phone and the app: whether it is Android or iPhone, the app version, the operating system version, the phone model (for example “Samsung SM-A546E”), your language, the city you chose, and when you last used the app. This helps us fix bugs and know which phones to support. We do not collect advertising IDs, IMEI numbers, your contacts, photos or messages.
• Your location on the map: used on your phone to show distances. It is not sent to us unless you send a request (above).

If you are a vendor

• Your name, phone number, shop name, category, the area you sell in, the city, your menu and prices, and photos you add.
• Your location while you are LIVE. It is shown publicly on the map while you are live. We also save your route (the points your phone reports) so you can see where you went, your stops and your bills on the map. Only you and our admin team can see your saved route. A static shop shares one fixed pin, not a route.
• The bills you create in the billing screen (items, amounts, cash or UPI, time and place), for your own reports. Your UPI ID, which is used only to draw the payment QR; money goes directly to you and never through us.
• Your plan, payments, free days and referral activity.
• The same phone and app details as customers (platform, versions, model, language, city, last used).

If you only use the website

• A sign-in cookie (only after you sign in) and a language cookie. We do not use advertising or tracking cookies.
• Our servers keep ordinary technical logs. For security and fair use we also keep short-lived counters tied to your IP address or phone number (for example, to stop someone trying thousands of sign-in codes).

2. Why we use it

• To run the service: show vendors on the map, let customers follow and ask, let vendors go live, bill and see reports.
• To sign you in securely and prevent misuse.
• To take and record payments for vendor plans, and to meet our legal and tax duties.
• To send messages you would expect: sign-in codes, a vendor you follow going live, a payment or plan notice. We do not send advertising.
• To understand how the service is used and to fix problems (the phone and app details above).

3. Who can see what

• Everyone sees a vendor's shop name, category, area, menu, photos, and live position while they are live.
• A vendor sees the grouped demand near them, the items people ask for, and their own bills and route. They do not see customers' names or numbers.
• Our admin team can see account details, activity and payments, to give support, confirm payments and keep the service safe. Admin access is protected with a password and a second code, and every change and every download is logged.
• A vendor's phone number is shown only to signed-in visitors, through the Call button.
• We do not sell personal data and we do not share it with advertisers.

4. Services we use to run this

We rely on providers who handle data for us, only to provide their service: Vercel (hosting), Neon (database), Twilio (sending sign-in codes by SMS), Google Firebase (notifications and phone sign-in) and Google Maps (the map in the Android app), Expo (app builds and updates), Cloudflare (file storage), Razorpay (online payments, if you pay online), Resend (email), OpenStreetMap and OpenFreeMap (map tiles and place names; your IP address reaches them when a map loads). Some of these process data outside India.

5. How long we keep it

• Sign-in codes expire after 5 minutes. Customer requests stop being shown after 2 hours.
• Your account details, follows and (for vendors) bills and saved route are kept while your account exists.
• Payment records are kept for as long as the law requires, even after an account is deleted.
• When you delete your account we remove your personal details, follows, requests and notification tokens.

6. Your choices and rights

• Delete your account. Customers: in the app, Me, then Delete my account. Vendors: call us and we will remove your details (payments and bills we must keep stay, without your personal details).
• See, correct or get a copy of the data we hold about you, or withdraw your consent: contact us and we will respond as soon as we can, and within 30 days.
• Turn off location or notifications any time in your phone's settings. The app still works, with less.
• Complain. If you are not happy with how we handled your data, write to us first so we can fix it. You also have the right to complain to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.

7. Security

We use encrypted connections (HTTPS), store sign-in codes and admin passwords only in hashed form, and limit who can reach the data. No system is perfectly safe. If you think your account has been misused, call us straight away.

8. Children

The service is not meant for anyone under 18. If you believe a child has given us their details, contact us and we will delete them.

9. Changes

If we change this policy in a way that matters, we will update the date at the top and tell you in the app or on the website.

10. Contact us

Questions, requests, or a complaint about your data: +919003817379.