Privacy policy
Last updated: 13 October 2026
1. Who we are and what this policy covers
This policy explains how Mandya Organic Foods Private Limited (“Organic Mandya”, “we”, “us”) collects, uses, shares and protects your personal data. Our registered office is 444, S I Kodihalli Gate, Keragodu Hobli, Hulivana Village, Mandya, Karnataka 571446 (CIN U74110KA2016PTC086245).
It applies to all of our services:
| Service | Who uses it |
|---|---|
| organicmandya.com (website and online store) | Customers |
| Organic Mandya app (Android and iOS) | Customers |
| Milkman app | Milk and dairy subscription customers |
| Suggi by Organic Mandya app (Android and iOS) | Farmers and home growers |
| Our retail stores and cafés, when you share details at billing | Customers |
| WhatsApp, phone, SMS and email conversations with us | Everyone |
The law that applies. We handle your data under the Information Technology Act, 2000 and the rules made under it, including the rules on sensitive personal data. India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the DPDP Rules, 2025 are being brought into force in stages, and most of their duties start on 13 May 2027. From that date we will be a Data Fiduciary under the DPDP Act. We have chosen to give you the rights and choices in this policy now, ahead of that date. Where this policy says something is required by law, it says which law and from when.
Sections 3 and 4 add details that apply only to our apps. Where a section is about one service, it says so.
The Mandya Organic Farmers Cooperative Society and the Mandya Organic Farmers Foundation are separate organisations with their own policies. We share your data with them only with your separate consent (section 6).
2. Personal data we collect
We collect only what we need to run our services. Data you give us:
| Type | Examples |
|---|---|
| Identity and contact | Name, mobile number, email, date of birth (if you choose to give it) |
| Delivery details | Delivery addresses, landmarks, delivery instructions |
| Account | Login via mobile OTP, account preferences, wishlist, saved carts |
| Orders and payments | Items bought, order and invoice history, GST number for business orders, refunds. Card, UPI and bank details are entered with our payment provider, not stored by us |
| Memberships and subscriptions | Co-op membership plan, milk and product subscriptions, wallet balance and transactions |
| Communications | Messages, calls, reviews, feedback and support requests |
Data collected automatically:
| Type | Examples |
|---|---|
| Device and technical | Device model, operating system, app version, browser, IP address, language |
| Identifiers | Advertising ID, app instance ID, push notification token, cookie IDs |
| Usage | Pages and screens viewed, products searched and clicked, items added to cart |
| Approximate location | Location inferred from your IP address |
Data from others: delivery partners (delivery status, proof of delivery), payment providers (payment success or failure, last 4 digits of a card), and our stores (purchases billed to your mobile number).
Health information. We do not ask for health or medical information. If you choose to mention it in a message, for example an allergy when asking about a product, we use it only to answer that message and do not add it to your profile. If we launch a feature that asks for health information, such as a nutrition profile, we will ask for your separate, explicit consent first and update this policy.
3. Organic Mandya app and Milkman app
The apps collect the data in section 2, plus the following. Each phone permission is asked for only when a feature needs it, and you can turn it off in your phone settings at any time.
| What | Why we use it | If you say no |
|---|---|---|
| Mobile number and OTP | To log you in and secure your account | You cannot create an account |
| Precise location (only while using the app) | To pin your delivery address on the map and check whether we deliver there | You can type your address instead |
| Push notifications | Order and delivery updates, subscription reminders and, if you agree, offers | You still get order updates by SMS or WhatsApp |
| Camera and photos | Only if you choose to attach a photo, for example to a support request | The rest of the app works normally |
| Analytics and app events | To understand how the app is used and fix problems | Switch off in Profile → Settings → Privacy (section 10) |
One account. The website, the Organic Mandya app and the Milkman app share one Organic Mandya account, linked to your mobile number. Suggi has its own account (section 4).
Payments. Payments in the app go through Razorpay. Card, UPI and net banking details go directly to the payment provider. We never see or store your full card number or UPI PIN.
Co-op membership, wallet and subscriptions. We keep your membership plan, wallet balance, wallet transactions and subscription schedule so we can apply member prices, deliver on time and give refunds to your wallet.
Milkman. The Milkman app also keeps your delivery slot, daily quantities, pauses and delivery history.
4. Suggi by Organic Mandya
Suggi helps farmers and home growers plan what to grow for better income. It uses your farm details to make that plan. This section is also shown in Kannada inside the app before you sign up.
| What | Why we use it |
|---|---|
| Mobile number, name, village or town, language | To create your account and talk to you in your language |
| Farm or garden location (pinned on a map or GPS, with your permission) | To match crops and advice to your climate, soil zone and nearby markets |
| Land size, current crops, water source, animals, equipment | To build your crop and income plan |
| Income goals and farm costs you enter | To suggest crops and layouts that meet your income goal |
| Soil and field photos (camera, with your permission) | To read soil type and crop condition for advice |
| Plans you save and how you use the app | To show your plans again and improve Suggi |
How the advice is made. Suggi uses an AI service, Claude from Anthropic, to write your plan. We send it only what the plan needs: your land size, crops, water source, animals, equipment, income goal, the district or taluk of your farm, and any soil or field photos you choose to add. We do not send your name or mobile number. Under Anthropic’s commercial terms, this data is not used to train its AI models by default. Anthropic may keep it for a limited time, for example for safety and misuse checks, as described in its data retention policy. This processing may happen outside India (section 7).
Your income and farm data are private. We do not sell them. We never use your farm costs, income goals or exact farm location for advertising or marketing profiles. We do not share them with lenders, traders, insurers or government bodies unless you ask us to, or the law requires it.
Use by Organic Mandya. If you agree on a separate consent screen, Organic Mandya may use your crop, quantity and location details to offer to buy your produce, supply seeds and inputs, or invite you to grower programmes. You can withdraw this consent at any time in the app, and Suggi keeps working without it.
You can edit or delete your farm details and photos in the app at any time.
5. Why we use your data
| Purpose | Basis |
|---|---|
| Create and secure your account, take orders and payments, deliver, handle returns and refunds | Your consent, given when you sign up and order |
| Run memberships, subscriptions, the wallet and Suggi plans | Your consent, given when you sign up for them |
| Send order, delivery and account messages | Your consent; needed to provide the service you asked for |
| Detect and prevent fraud, fake accounts and misuse of offers | Your consent, given when you create an account, as part of providing a secure service |
| Send offers and marketing by WhatsApp, SMS, email, push or ads | Separate consent; you can withdraw it at any time (section 10) |
| Understand how our website and apps are used, fix errors, improve products | Separate consent; you can withdraw it at any time (section 10) |
| Keep accounting and tax records, respond to lawful requests from courts and authorities | Compliance with law |
We will ask for fresh consent before using your data for a new purpose not listed here. Withdrawing consent does not affect processing already done, and some services may stop working if they depend on it.
6. Who we share your data with
We do not sell your personal data. We share it in two ways.
Service providers acting for us. They process your data only on our instructions and under contract with us:
| Provider | What they do for us | Services |
|---|---|---|
| Shopify | Online store, accounts, orders | Website, apps |
| Odoo (our billing and inventory system) | Billing, invoices, stock | All |
| Google (Firebase, Google Analytics, Google Cloud / BigQuery) | App hosting, analytics, reporting | All |
| WebEngage | Push notifications, in-app and campaign messages | Apps, website |
| Supabase | Databases and back-end services | Apps, Suggi, internal tools |
| Anthropic (Claude) | AI that writes Suggi plans (section 4) | Suggi |
| SMS, WhatsApp and OTP login providers | Login codes and order messages | Apps, website |
| Porter and other delivery partners | Delivering your order (name, phone, address only) | Website, apps, stores |
Independent recipients. These organisations receive some of your data but also decide for themselves how to use it, under their own privacy notices:
| Recipient | When | Their notice |
|---|---|---|
| Razorpay and other payment providers | When you pay or get a refund | Razorpay privacy notice |
| Shopify, for services where it acts on its own account (for example Shop Pay) | When you use those services | Shopify privacy policy |
| Meta (WhatsApp) | When you message us on WhatsApp | WhatsApp privacy policy |
| Google Ads and other ad platforms | Only if you accept advertising cookies or app tracking | Google privacy policy |
| Marketplaces where you buy from us | To fulfil those orders | The marketplace’s own policy |
| Government, courts, police and regulators | When the law requires it | — |
| A buyer or successor of our business | If our business is merged or sold; they must honour this policy | — |
| Mandya Organic Farmers Cooperative Society or Foundation | Only with your separate consent for a named purpose | Their own policy |
7. Where your data is stored
Our main databases are stored in India, in Mumbai. Some providers also process data outside India, including Shopify, WebEngage and Anthropic. We transfer data outside India only where the law allows it, and each provider is bound by contract to protect it.
8. How long we keep your data
We keep data only as long as we need it for the purposes in section 5, or longer where the law requires.
| Data | How long |
|---|---|
| Account, addresses, preferences | While your account is active; deleted within 30 days of a deletion request |
| Suggi farm details, photos and plans | While your Suggi account is active; deleted within 30 days of a deletion request |
| Accounting records: invoices, vouchers and books of account | 8 years from the end of the financial year they relate to (Companies Act, 2013, section 128), or longer if GST law, a tax assessment, audit or dispute requires. We keep only the details needed in those records |
| Support messages and call notes | 2 years |
| App and website usage data | 14 months in identifiable form |
| Marketing consent records | As long as the consent lasts, plus 1 year |
| Processing logs and related traffic data | 1 year, for security, fraud prevention and legal compliance (required under the DPDP Rules from 13 May 2027) |
| Inactive accounts | Under our own policy, closed and deleted after 3 years without a login or purchase. We will remind you at least 48 hours before |
Deleted data may stay in our backups until they are overwritten, within 90 days, and is not used in the meantime.
9. Your rights
We give you these rights now. Most of them become legal rights under the DPDP Act from 13 May 2027.
- Access: get a summary of the data we hold about you and who we shared it with.
- Correct and update: fix wrong or incomplete data. Most of it you can edit in your account.
- Erase: ask us to delete your data, except what we must keep by law (section 8).
- Withdraw consent: at any time, as easily as you gave it (section 10).
- Nominate: name another person to use these rights for you if you die or become unable to.
- Complain: raise a grievance with us (section 13).
Deleting your account.
- In the Organic Mandya or Milkman app: Profile → Settings → Delete account. In Suggi: Profile → Delete account.
- On the web: organicmandya.com/pages/delete-account, or email support@organicmandya.com from your registered email or mobile number. We will confirm the request with you on your registered mobile number before deleting.
What deletion does.
- Deleting your Organic Mandya account closes it on the website, the Organic Mandya app and the Milkman app together. Your Suggi account is separate and is deleted separately.
- Active subscriptions are cancelled. Deliveries already packed or out for delivery are completed, or cancelled and refunded.
- Your wallet balance is refunded to your original payment method or bank account, after which the wallet is closed.
- Co-op membership ends, with any refund under the membership terms.
- We ask our service providers (section 6) to delete your data too.
- We keep only what section 8 says we must keep, then delete it.
We confirm deletion within 30 days. We reply to all rights requests within 30 days and may ask you to verify your identity first. Using your rights is free.
10. Cookies, analytics, notifications and marketing
Website. Essential cookies keep the store working, such as your cart and login. Analytics and advertising cookies (for example Google Analytics and Google Ads) are set only if you accept them in the cookie banner. You can change your choice at any time through the “Cookie preferences” link at the bottom of every page.
Apps. In Profile → Settings → Privacy you can switch off:
- Analytics: stops Firebase, Google Analytics and WebEngage usage tracking for your account and device;
- Personalised offers: stops us using your activity to tailor offers.
You can also turn off push notifications and limit your advertising ID in your phone settings (Android: Settings → Privacy → Ads; iPhone: Settings → Privacy → Tracking).
Marketing messages. We send offers by WhatsApp, SMS, email or push only with your consent. To stop them, reply STOP on WhatsApp or SMS, use the unsubscribe link in emails, or switch them off in the app. Order and delivery messages continue while you have an active order.
11. Children
You must be 18 or older to create an account or use our apps. We do not offer accounts to children and do not knowingly collect their data. If you believe a child has given us data, contact us (section 13) and we will delete it.
12. Security and data breaches
We protect your data with encryption in transit (HTTPS), access limited to staff who need it, logging of access, and contracts that require our providers to do the same. No system is completely secure, so keep your OTP and login details private.
If a breach affects your personal data, we will tell you without delay. We will explain what happened, the likely impact, what we are doing about it, and what you can do. We will also report it to CERT-In as the law requires today, and to the Data Protection Board of India once the DPDP Rules apply.
13. Grievance Officer and contact
For privacy questions, rights requests or complaints, contact our Grievance Officer:
| Name | Sahana Hegde |
| Designation | Grievance Officer and Data Protection contact |
| support@organicmandya.com | |
| Phone | +91 95909 22000 (Mon–Sat, 9 am–6 pm) |
| Address | Mandya Organic Foods Pvt Ltd, 444, S I Kodihalli Gate, Keragodu Hobli, Hulivana Village, Mandya, Karnataka 571446 |
We acknowledge complaints within 48 hours and aim to resolve them within 30 days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India once the DPDP Rules apply, or to a consumer commission.
14. Changes, governing law and your other rights
We will update this policy when our services or the law change, and show the new date at the top. For significant changes, we will tell you in the app or by email before they take effect and, where needed, ask for your consent again. The same policy applies on the website and in all our apps.
This policy is governed by the laws of India. Subject to your rights below, disputes are subject to the courts at Mandya, Karnataka. Nothing in this policy limits your right to complain to a consumer commission where you live or work under the Consumer Protection Act, 2019, or your rights under the DPDP Act.
This policy is available in English and Kannada. You can ask us for it in any other language listed in the Eighth Schedule of the Constitution of India.
