Privacy Policy

Last updated: 3 October 2026

This Privacy Policy explains how A M Agency ("Town Basket", "we", "us") collects, uses, stores and protects your personal data when you use our website and grocery delivery service. We are committed to handling your data responsibly and in accordance with applicable Indian law, including the Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Data we collect

We collect the following personal data when you sign in, place an order or contact us:

• Name — to identify and address you.
• Phone number — to sign you in (we send a one-time code by SMS), and to confirm and coordinate deliveries.
• Delivery address and location — the address you type and the map pin you set (or, if you allow it, your device's current location), to deliver your order and confirm it is within our service area. Saved addresses stay on your account until you delete them.
• Order history — to process orders, handle refunds and provide support.
• Notification settings — if you choose to turn on order notifications, a notification token for that device, used only to send updates about your orders.

Orders are currently paid in cash on delivery, so we do not collect or store any card, UPI or banking details. If we start accepting online payments, those details would be handled directly by the payment provider under their own security standards, and we will update this policy.

2. Why we collect it (purpose)

We use your personal data only for the following purposes:

• To accept, process, pack and deliver your orders.
• To verify your phone number when you sign in.
• To communicate order status, confirmations and delivery updates, including any notifications you have turned on.
• To show you your delivery partner's position and an estimated arrival time while your order is out for delivery.
• To handle cancellations and refunds, and to record the payment you make on delivery.
• To provide customer support and respond to your queries.
• To comply with legal, tax and regulatory obligations.

3. Consent and lawful basis

We process your personal data based on the consent you provide when you place an order or share your details with us, and where necessary to fulfil the order you have requested. You may withdraw your consent at any time (see "Your rights" below); however, this may prevent us from fulfilling pending or future orders.

4. How we store and protect your data

We retain your personal data only for as long as necessary to fulfil the purposes described above or as required by applicable law (for example, tax and accounting records). We apply reasonable technical and organisational security measures to protect your data against unauthorised access, loss or misuse. Personal data is stored on systems located in India or with reputable service providers.

5. Sharing your data

We do not sell your personal data. We share it only with:

• Our delivery staff/partners, to fulfil your order (your name, phone number, delivery address and location).
• Google, which provides the sign-in service that sends and checks your one-time code (Firebase Authentication, with reCAPTCHA to prevent misuse) and the maps used to set your delivery location. These services receive your phone number and the map area you view, and are governed by Google's own privacy policy.
• Companies that host our systems and help us run and secure the service, such as cloud hosting providers.
• Authorities or regulators, where required by law.

6. Your rights under the DPDP Act, 2023

As a Data Principal, you have the right to:

• Access a summary of the personal data we hold about you and how it is processed.
• Request correction or updating of inaccurate or incomplete data.
• Request erasure of your personal data where it is no longer required.
• Withdraw consent previously given.
• Nominate another individual to exercise your rights in case of death or incapacity.
• Raise a grievance with us regarding the handling of your data.

To exercise any of these rights, contact our Grievance Officer using the details below. We will respond within the timelines required by applicable law.

7. Cookies and browser storage

We keep this to the minimum the shop needs. Your browser's local storage holds your sign-in, shopping cart, the delivery location you chose and your display preferences, so the shop works as you expect, and one small cookie remembers your language choice. We do not use analytics, advertising, or tracking cookies, and we do not track you across other websites. The sign-in check uses Google reCAPTCHA to prevent misuse; Google may set its own cookies or storage for this, under its own policy. Any business reporting we carry out (such as sales summaries) is based on your order records, not on browsing-tracking.

8. Children's data

Our services are intended for users aged 18 and above. We do not knowingly collect personal data of children. If you believe a child has provided us data, please contact us so we can remove it.

9. Grievance Officer / contact for data matters

For any questions, requests or grievances about your personal data, please contact:

10. Changes to this policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised "Last updated" date.