Privacy Policy

Pados is an ordering app for shops in the Andaman & Nicobar Islands. This page describes what the app collects, why it needs it, who else sees it, and how to have it removed. It covers the three Pados Android apps — the shopping app (business.pados.app), the Pados Partner app for shops (business.pados.merchant) and the Pados Rider app for delivery riders (business.pados.rider) — and this website, including its shop and rider web apps.

The data fiduciary — the party that decides what is collected and why, in the language of the Digital Personal Data Protection Act, 2023 — is Sekhar Mridha, sole proprietor, trading as Pados, Harinagar, Billiground, North & Middle Andaman, Andaman & Nicobar Islands 744201. This page is also the notice that Act requires us to give you.

The short version: Pados collects what it needs to put a shop on a map and get an order from a customer to that shop. There is no advertising in Pados, no advertising identifier is collected, and no personal information is sold or handed to data brokers.

One thing worth knowing before the detail, because it shapes everything below: Pados provides the technology, and the shop is the seller. The shop takes your payment, packs your order and arranges its delivery, so the shop — not Pados — needs your name, your number and your address to do it. What Pados holds beyond that is the account, the record of the order, and the checks it runs on shops and products. Who does what is set out in the Terms of Use.

What is collected

Everyone with an account

• Email address, and a password if you set one on this website. The password is stored only as a cryptographic hash, and cannot be read back by us or by anyone else. The Pados app on Google Play has no password at all: it signs in with Google only, and the paragraph below is the whole of it.
• If you sign in with Google— the only way to sign in to the app, and one of the ways on this website: the name, email address and profile photo on your Google account, supplied to us by Google when you approve the sign-in. We never see your Google password. This is only ever used to create and sign in to your Pados account — see “Google Sign-In” under service providers below.
• Name and phone number, so a shopkeeper can call you when your order is ready or a delivery cannot find the door.

If you shop on Pados

• Delivery addressesyou save, including a map pin if you choose to drop one. The pin is what answers “is this address inside the shop’s delivery range”; no address line can answer that.
• Your orders — what you bought, from which shop, for how much, and whether it was picked up or delivered.

If you run a shop on Pados

Shops use the Pados Partner app, and the shop website for reports and credits. None of the following is collected by the shopping app.

• Business details: shop name, type, phone, email, address, area and PIN code; and, if you enter them, GSTIN and a trade licence or registration number.
• Your shop’s locationas a map pin. This is the whole basis of “shops near me” and is shown publicly. In the Partner app your phone’s location is read only when you tap to move the pin to where you are standing.
• Photos of your shop and your products, your logo, and any document you attach to a stock adjustment, and the photograph of your UPI QR code — taken or chosen by you in the Partner app or uploaded from a browser. The Partner app asks for the camera or your photos only when you tap to add one.
• Your UPI ID,so customers can pay you directly. See “Payments” below.
• Your business records: catalogue, stock movements, bills, invoices, expenses, and your own address book of customers.

From your phone, in the Pados app

The Pados app on Google Play is the customer app. It is for finding shops near you and ordering from them, and it asks for exactly two things:

• Location,only when you ask for it, and after the app has told you why and you have said yes. There are two moments: tapping “Where I am now” to see the shops that can reach you, and tapping “Use my location” while saving a delivery address so the pin is right. Your position is sent to Pados to answer that one question and is not kept, unless you choose to save it as the pin on an address. It is never read in the background, and no history of where you have been is kept. You can refuse and pick your town or type the address instead; shops can still find it, they just measure the distance less precisely. To turn a pin into an area name, your phone may ask Google’s location service on your device.
• A notification token,plus your phone’s model name and platform, so an order can ring the right phone. Removed when you sign out.

The app never asks for your camera or your photo library. It has no barcode scanner and nothing in it uploads a picture. Shop and product photographs are added by shopkeepers in the Partner app or a browser, and delivery riders work in the separate Rider app, not in this app.

Pados does not collect contacts, call logs, SMS, files, health data, or an advertising ID. There is no third-party analytics or advertising SDK in the app.

Why it is collected

If you deliver for a shop (the Rider app)

Delivery partners use the Pados Rider app, and the rider website for earnings; neither is part of the shopping app. We hold your name, phone, email, town and district, the code you joined with, the deliveries you made and what each paid you, and — if you add them — your UPI ID and payment QR so a shop can pay you. While you are carrying an order, Pados shares where you are with that order’s customer,so they know when to come to the gate. This only happens while the Rider app or page is open on your screen — the Rider app has no permission to read your location in the background — and it applies to riders only — somebody who just shops on Pados is never asked for it.

The camera is used once, at the door:when you tap to photograph a customer’s payment confirmation, and not before. Your phone asks then, and you can refuse. (It is also used if you choose to photograph your own payment QR.) That photo goes to the shop so they can check the money arrived, and it is deleted as soon as they confirm it— Pados does not keep a copy and nobody else can open it.

The limits on location are enforced by the database, not by the page:

• Only while a parcel is in your hands. It starts when you mark an order collected and stops when the PIN is entered at the door. A position sent at any other time is refused and not stored, because the rule lives on the server.
• Only that customer sees it, and only until their order arrives. Not other customers, not the shop, not other riders.
• No history is kept. There is one row per rider, overwritten as you move and deleted when your last delivery ends. Pados cannot reconstruct where you went, because it never stored it.
• You can always see that it is on. Your phone shows a location indicator for as long as it is sharing, and the Rider app says so on screen.

You can refuse, or withdraw it later in your phone’s app or browser settings. Deliveries still work — the customer simply does not see you coming.

If you are a Growth Partner

Growth Partners — the independent local partners who bring shops onto Pados in their area — sign in on this website with Google or an email address. To run the partnership and pay commission, Pados holds your name, phone, email, full address, state, district and town, your photo, your territory and Partner ID, who referred you, when you accepted the Growth Partner Terms, your PAN (needed to pay commission under the income-tax rules), and the UPI ID or bank account and IFSC you want commission paid to. We also keep the shops you brought on and the commission each earned.

Your PAN and bank details are seen only by you and by Pados staff paying commission. Commission records are business records and are kept as long as the tax laws require; the rest is removed when you stop being a partner and ask us to delete your account.

Who else sees it

The shop you order from sees your name, your phone number, the delivery address you chose, and what you ordered. It cannot be otherwise — somebody has to pack the bag and find the door. A shop cannot see your account, your other addresses, or anything you ordered from any other shop.

The delivery rider bringing your order sees your name, your phone number, the delivery address and its map pin, because they have to find the door. You can call them from your order screen, and while they carry your order you can see where they are. The rider asks you for the four-digit delivery PIN at the door to prove the order reached you; it is shown only to you and is never shown to the rider. When the order is done, the rider no longer sees it.

A shop’s own data stays its own.One merchant cannot read another merchant’s catalogue, stock, customers or takings. This is enforced by the database itself rather than by the app, so a modified or rebuilt app cannot get around it. The single exception is the shared product catalogue described next, which the merchant controls and which carries no prices.

A Growth Partner— the independent local partner for an area — sees the registration details of a shop applying in their territory, because they are the person who checks that the shop is real before it can go live: the shop name and address, the trade, the owner’s name and contact number, and the registration details the shop gave, including its GSTIN if it is registered. Where Pados has given them the duty, they also see a new product a shop in their territory has written, so it can be approved or refused, and the identity details of a rider a shop has added, so the rider can be verified before riding. A Growth Partner never sees a customer’s account, a customer’s orders or addresses, or a shop’s prices, stock or takings.

Pados staff see the same shop, product and rider records, for the same approvals and for support, and can see an order when somebody asks us to look into one. Access is limited to the people who need it and leaves a record.

The shared product catalogue

So that a new shopkeeper can stock their shelf by tapping instead of typing several hundred items, Pados keeps one catalogue of products that every shop picks from. When a merchant adds a product, four things about it join that catalogue: the product name, the brand, the pack size, and the photograph if there is one.

Those are facts about a manufacturer’s packet, the same in every shop. Five things are never shared, with anybody, for any reason: what the shop paid for it, what it sells it for, the MRP it recorded, how many it has, and which shop the product came from. A contributed photograph is copied to a neutral location before it is shared, so its web address cannot identify the shop either — nobody can read the catalogue to work out what a particular shop stocks.

This is enforced by the database rather than by policy: the shared catalogue has no column capable of holding a cost or selling price. Merchants can switch their contributions off at any time under Settings → The shared catalogue, and keep full use of the catalogue either way.

None of this is personal information about a shopper. It concerns packets on a shelf, and no customer’s data forms any part of it.

Pados uses these service providers, and no others:

• Supabase — hosts the database, file storage and sign-in. Everything is stored on servers in Mumbai, India. Your data does not leave the country.
• Expo, together with Google’s Firebase Cloud Messaging on Android and Apple’s Push Notification service on iOS — deliver notifications. A notification’s title and text pass through them.
• Google Sign-In — the only way to sign in to the app, and one of the ways on the website. If you use it, Google shares your name, email address and profile photo with us, as described above. We do not use it for anything else, and it is not used to track you outside Pados.
• Google Maps— draws the delivery map in the Rider app and on a customer’s order screen. The rider’s position and the delivery pin are sent to it to draw them, and nothing else.
• Google Play — distributes the apps.
• Netlify — serves this website. It does not receive anything from the app.

Personal information is not sold, rented, or shared for advertising. It may be disclosed if a law or a valid legal order requires it.

Payments

Pados does not process payments and takes no commission. A customer pays the shop directly — cash, or UPI to the shop’s own ID. Pados never sees a card number, a UPI PIN, or a bank credential, because none of them are ever entered into it. A shop buys Pados credits, which it spends on orders, by UPI transfer to Pados, recorded as a reference number the shop supplies. That is the shop’s business account and nothing a shopper pays or sees.

Security

• Everything between the app and the servers travels over HTTPS.
• Data is encrypted at rest by the hosting provider.
• Who may read which row is decided by the database on every single query, not by the app. Sign in as one shop and the rows belonging to another shop are not merely hidden — they are never returned.
• A shopper’s view of a catalogue is served by a view listing only the columns a shopper may see. A shop’s cost price is not among them, and its stock appears only as a limit on how many you can add to a basket.
• Every sign-in and sign-out (with the time, the IP address and the app used), account deletions, changes to sign-in details, and every change to an order’s status, rider or payment — with who made it — are written to an activity log. No app can read or alter it; only Pados staff investigating misuse can read it. It exists so an unauthorised use of an account can be detected and traced.

How long it is kept

Your account details are kept while your account exists. A shop’s bills, invoices and stock history are kept for as long as Indian law requires a business to keep its books, which is longer than any one customer relationship — see the next section.

Deleting your account

You can delete your Pados account at any time, from inside the app or from a browser:

• In the app: Account → Delete my account.
• From a browser: padosandaman.in/delete-accountexplains the steps and takes a request by email, whether or not you still have the app installed.

Deleting removes your name, phone, email, saved addresses and map pins, notification devices, and your name, phone, delivery address, map pin and delivery PIN from past online bills that do not legally require them.

Two things deliberately survive, and it is fairer to say so than to imply otherwise. A shop keeps its own record of a sale it made, the way it would keep a paper bill — a business is required to. And if you run a shop, deleting your account takes the shop off the map immediately, but its accounts stay in its books; Pados will not put holes in last year’s turnover.

Your rights

Under the Digital Personal Data Protection Act, 2023 you can ask us to:

• Tell you what we hold about you, and who we have shared it with.
• Correct or complete it if it is wrong — a misspelt name, an old phone number.
• Erase it, where we no longer need it for the purpose you gave it for and no law requires us to keep it. The section above says what that leaves behind, and why.
• Nominate somebody to exercise these rights for you if you die or become incapable of exercising them yourself.
• Complain, and get an answer within the timetable on the grievance page.

Write to pados.andaman@gmail.com from the address on your account. We answer within 15 days.

You gave consent for each of these purposes when you signed up or when you first turned a feature on, and you can withdraw it — by turning the permission off in your phone’s settings, or by deleting your account. Withdrawing consent does not undo what was lawfully done before you withdrew it.

If something goes wrong with your data

If personal data is exposed by a breach, we will tell the people affected without delay, in the app and by email, describing what happened, what it means for you, what we have done about it, and what you can do to protect yourself. We will report it to the Data Protection Board of India as the DPDP Act and Rules require — straight away, with a full report within 72 hours — and report cyber-security incidents to CERT-In within six hours, as its directions under the IT Act require.

Complaints

Our Grievance Officer answers privacy complaints as well as everything else: see Grievance Redressal for the name, phone number and timetable. If we do not resolve it, you can take it to the Data Protection Board of India.

Children

Pados is a tool for running and shopping at a business. It is not directed at children and we do not knowingly collect information from anyone under 18.

Changes

If this policy changes in a way that affects what is collected or who sees it, the date at the top changes and the app will say so before the change takes effect.

Contact

Questions, corrections, or a request to see what is held about you: pados.andaman@gmail.com.

Sekhar Mridha, sole proprietor, trading as Pados
Harinagar, Billiground, North & Middle Andaman, Andaman & Nicobar Islands 744201