Privacy Policy

1. Introduction

Welcome to DOOCAL ("we", "our", or "us"). This Privacy Policy explains how our mobile application and backend services ("Service") collect, use, disclose, and protect your information when you access or use DOOCAL as a Customer, Store Owner, or Vendor.

By installing, registering, or using DOOCAL, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the application.

2. Information We Collect

We collect the following categories of information to provide and improve our hyperlocal discovery service:

• Phone Number & Authentication Data: When registering or logging in, we collect your mobile phone number to generate and verify secure One-Time Passwords (OTPs).
• Profile Information: For Customers, we collect your display name. For Vendors/Shop Owners, we collect your shop name, owner name, shop description, business categories, physical shop address, city, pincode, and optional business verification details.
• Location Information (Precise and Coarse): With your explicit permission, we collect your device's GPS coordinates and location data. For Customers: Used in the foreground to connect your product requests with verified vendors located within a reasonable radius (up to 10 km). For Vendors: Used to display your verified storefront location to nearby customers and calculate accurate driving directions. Location is not tracked in the background.
• Photos and Camera Access: With your permission, we access your device camera and photo library so you can: (a) Attach sample photos of items you want to buy (Customer Requests), or (b) Upload store logos, storefront photos, and product quotation images (Vendor Offers).
• Push Notification Tokens & Device Identifiers: We collect and register a native Firebase Cloud Messaging (FCM) device registration token provided by Google Play Services. This allows our servers to dispatch instant, direct notifications to your device (such as when nearby customer requests match a vendor's category, when price offers arrive, when quotes are accepted, or when administrative announcements are broadcast). You can opt out of push notifications at any time through your device system settings.

3. How We Use Your Information

We use the collected information for specific, legitimate business purposes:

• To verify your identity and prevent fraudulent account creation using SMS OTP.
• To route customer product requests to nearby verified retail vendors.
• To allow customers to contact vendors via direct phone call or view turn-by-turn driving directions to the physical shop using Google Maps.
• To notify vendors of nearby purchase requests and notify customers when price quotes arrive.
• To send important administrative announcements and system updates.
• To maintain app security, prevent spam or abuse, and enforce our Terms of Service.

4. Data Sharing and Disclosure

We do not sell, rent, or monetize your personal information. Information is only shared in the following circumstances:

• Between Customers and Vendors: When a customer accepts a vendor's offer, the vendor's shop address, shop name, and contact phone number become visible to the customer to facilitate purchase fulfillment and navigation.
• Service Providers: We rely on trusted third-party service providers who assist us in operating our infrastructure under strict data protection commitments:
  • Cloud Database: MongoDB Atlas (Encrypted data storage)
  • Image CDN & Processing: ImageKit.io (Secure image hosting and processing)
  • SMS & Authentication: Fast2SMS / Renflair (Transactional OTP delivery)
  • Push Notifications: Google Firebase Cloud Messaging (FCM v1) (Direct push alerts delivery via Google LLC)
  • Mapping & Navigation: Google Maps API / Apple Maps (Store location mapping and directions)
• Legal Compliance: If required by law, regulation, subpoena, or governmental request to protect the safety and rights of our users or the public.

5. Data Security

We implement industry-standard administrative, technical, and physical security measures to safeguard your personal data:

• All network transmissions between the DOOCAL app and our servers use encrypted HTTPS / TLS 1.3 protocols.
• User passwords are not stored; authentication relies on expiring, brute-force protected 6-digit SMS OTPs.
• API access requires cryptographically signed JSON Web Tokens (JWT).

6. Data Retention and Account Deletion

We retain your personal information only as long as your DOOCAL account is active or as necessary to fulfill the purposes outlined in this policy.

7. Children's Privacy

DOOCAL is intended for general audiences aged 18 and older. We do not knowingly collect or solicit personal data from children under the age of 13. If we discover that a child under 13 has provided us with personal information, we will delete it immediately.

8. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last Updated" date. Continued use of the DOOCAL application after any modifications constitutes acceptance of the revised policy.

9. Contact Us