Cookzy — Privacy Policy
How we collect, use, and protect your information. Last revised: 03-Sep-2026
Cookzy is operated by Upsway Services Private Limited ("Cookzy," "we," "us," or "our"). We are the data fiduciary or data controller for personal data processed through the Cookzy mobile application and website (together, the "App").
For privacy questions or concerns, contact our Grievance Officer at [email protected] (see Section 15). This Privacy Policy should be read together with our Terms of Use and Refund Policy.
Table of Contents
- What Information Do We Collect?
- How Do We Use Your Information?
- Legal Basis for Processing
- Will Your Information Be Shared?
- Who Will Your Information Be Shared With?
- How Do We Handle Sign-in?
- Cookies and Tracking Technologies
- How Long Do We Keep Your Information?
- How Do We Keep Your Information Safe?
- Children's Privacy
- Your Privacy Rights
- GDPR Rights (EU Users)
- CCPA/CPRA Rights (California Residents)
- DPDPA Rights (Indian Residents)
- Grievance Officer
- Data Breach Notification
- International Data Transfers
- Automated Decision-Making
- Do-Not-Track Features
- Third-Party Websites
- Cooks' Information
- Policy Updates
- Contact Us
- Review, Update, or Delete Your Data
1. What Information Do We Collect?
Personal Information You Provide
We collect personal data that you voluntarily provide to us when you register, purchase a plan, contact a cook, or contact our support team.
- Name, email, phone number
- Gender, date of birth
- Cook preferences and cooking requirements
- Address, city, and locality
- Allergies and dietary restrictions you choose to share
- Phone number, sign-in verification details, and authentication-provider identifiers
- Messages, ratings, reviews, and feedback
- Direct and Concierge purchases, search and outreach requests, screening outcomes, and contact history
- Communication preferences
Sensitive Personal Data (SPDI Rules, 2011)
In line with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, certain categories — including financial information, identity-document numbers, and any health-related information you choose to share — receive additional protection. We process such data only with your consent and only to the extent required to deliver the relevant Service.
Information Automatically Collected
When you use our App, we automatically collect certain technical information:
- Device Data: Device type, model, operating system, app version, installation identifiers, and device or app integrity signals used for security checks.
- Log Data: IP address, network carrier, timestamps, screens viewed, taps, crashes, and diagnostic events.
- Usage Data: Features used, plan and add-on activity, daily contact counts, and interaction patterns. Analytics and crash-reporting services may associate events with your account identifier.
- Location Data: City, locality, addresses you provide, and location collected by supported app features with device permission. Cook daily dashboard activity may obtain precise coordinates, a derived address, and a timestamp, and save recent location history. This is foreground app activity; availability depends on the platform and permission.
Sign-in information
Phone verification and optional Truecaller sign-in are described in Section 6.
2. How Do We Use Your Information?
We process your personal data only for specific, lawful, and proportionate purposes — to deliver the Services you request, to comply with our legal obligations, and, where required, with your consent.
- Account creation and authentication
- Listing cooks, matching, and enabling contact
- Processing Direct and Concierge purchases, outreach, and screening requests
- Customer support and grievance handling
- Service-related notices, OTPs, and security alerts
- Marketing and promotional messages (only with your consent)
- Personalising your experience and recommendations
- Analytics, debugging, and Service improvement
- Detecting and preventing fraud, abuse, or circumvention of plan limits
- Security monitoring and incident response
- Enforcing our Terms of Use and other policies
- Complying with applicable laws, regulations, and tax obligations
- Responding to lawful requests from courts, regulators, and law-enforcement authorities
- Establishing, exercising, or defending legal claims
We will not use your personal data for any new purpose materially different from those listed above without notifying you and, where required, obtaining your fresh consent.
3. Legal Basis for Processing
Our legal basis for processing your personal data depends on which law applies to you:
For most processing, we rely on the consent you give when you sign up, accept this policy, or enable a specific feature (such as precise location or marketing communications). You can withdraw consent at any time as described in Section 11.
Where the applicable law recognises this basis, processing necessary to provide the Services you request — for example, cook discovery, a Direct purchase, or Concierge outreach. Contract performance is not a separate substitute for consent under the DPDPA.
A permitted legitimate use under DPDPA Section 7 applies only where its specific conditions are met. Where GDPR applies, legitimate interests may support security, fraud prevention, debugging, or legal claims, subject to that law. These are different legal bases, not a general permission under both laws.
Processing required to comply with applicable laws (e.g., tax, accounting, anti-money-laundering, lawful requests from authorities).
4. Will Your Information Be Shared?
We may share your data in the following situations:
- With cooks: Publishing a search makes job details such as locality, city, cooking requirements, schedule, budget, and free-text instructions visible to eligible cooks before you call or hire. The job-discovery view excludes your identity, exact coordinates, and phone number. Contact details are disclosed separately through authorised contact features, depending on the search contact mode. Information you share directly by phone or WhatsApp is visible to its recipient. Do not put unnecessary personal or sensitive details in visible job instructions.
- With service providers (data processors): Vetted third-party vendors who process data on our behalf and only on our instructions — for payment processing, hosting, communications (SMS, email, WhatsApp), analytics, and customer support tooling.
- With your consent: Whenever you ask us to share your information with another party (for example, optional Truecaller sign-in).
- For legal reasons: When required by law or by a regulator, court, or law-enforcement authority, or to protect the safety of any person, prevent fraud, or defend our legal rights.
- In a corporate transaction: In connection with a merger, acquisition, financing, reorganisation, or sale of all or part of our business — we will require the recipient to honour this Privacy Policy.
- Aggregated or anonymised: We may share aggregated or de-identified information that cannot reasonably be linked back to you.
5. Who Will Your Information Be Shared With?
Categories of third-party processors and partners we currently engage:
- Payments: Razorpay Payments Pvt. Ltd.
- Cloud & hosting: Google Cloud / Firebase
- Analytics & crash reporting: Google Analytics, Firebase Analytics, Crashlytics, Sentry
- Sign-in and communications: Message Central for phone verification, optional Truecaller authentication, Brevo for email, and Meta WhatsApp services for messages where used
- Support and operations: Slack receives operational notifications, including account-deletion requests or events containing the account identifier, name, and submitted reason or details
- App security: Firebase App Check and platform verification services, including Play Integrity, App Attest, and web reCAPTCHA where enabled
- Cooks: Independent cooks listed on the Mobile Application (only the limited information described in Section 4)
The data shared depends on the feature and provider. Contact us for information about providers involved in your account or a privacy request. Provider-specific processing is also described in their privacy notices.
6. How Do We Handle Sign-in?
Customer sign-in uses phone verification, with optional Truecaller authentication on supported devices. We process the phone number, verification or authentication result, and identifiers needed to create and secure the account. When you choose Truecaller, we use the profile information it returns with your authorisation for that sign-in.
Do not send OTPs or authentication credentials to support. Withdrawing provider access does not itself delete data already held by Cookzy; use the privacy-request process below.
7. Cookies and Tracking Technologies
Cookies, local storage, and software development kits (SDKs) support sign-in, security, saved preferences, analytics, and error reporting. Firebase Analytics, Crashlytics, and Sentry may receive usage or diagnostic information and account identifiers where configured.
Browser and device settings control some storage and permissions. Disabling them may affect features.
8. How Long Do We Keep Your Information?
Closing a customer account removes the active profile and sign-in account. Archived copies of the customer profile and search or alert records remain. Transaction, support, security, and provider records may also remain.
Retained records can support payment reconciliation, grievance handling, fraud prevention, and legal obligations or claims. Retention periods depend on the record and applicable requirements. Account closure does not set an automatic deletion deadline for these records.
Email [email protected] to request deletion or ask which records remain, why we retain them, and for how long. Your rights under applicable law remain protected.
9. How Do We Keep Your Information Safe?
Cookzy uses authenticated accounts, access rules and role checks, encrypted network connections, and device or app verification on supported platforms. Service providers also apply their own security measures. These controls reduce risk; no electronic transmission or storage system is completely secure.
Keep your device and sign-in credentials secure. Do not share OTPs, and report suspected unauthorised access to [email protected].
10. Children's Privacy
Only adults aged 18 or older may register for the Services.
If you are a parent or guardian and believe your child has provided us with personal data without your consent, please write to our Grievance Officer at [email protected]. We will verify the request and delete such information promptly.
11. Your Privacy Rights
Subject to applicable law, you have the following rights in respect of your personal data:
Obtain a summary of the personal data we hold about you and the processing activities we undertake with it.
Request correction of inaccurate, misleading, or incomplete personal data.
Request deletion of your personal data, subject to retention exceptions described in Section 8.
Withdraw consent at any time. Withdrawal is as easy as giving consent — simply email [email protected] with the subject line "Withdraw consent" or use the in-app settings where available. Withdrawal does not affect processing already done on the basis of your earlier consent.
Object to processing for direct marketing, or restrict processing in specific circumstances permitted by law.
File a complaint with our Grievance Officer (see Section 15). If you are dissatisfied with our response, you may approach the Data Protection Board of India, your local supervisory authority, or any other competent authority.
We will respond to verified requests within 30 days.
12. GDPR Privacy Rights (EU Users)
For Users in the European Union / EEA
Where GDPR applies to the processing concerned, rights may include:
- Right to data portability: Receive your data in a structured, commonly used, machine-readable format.
- Right to object to automated decision-making: Not be subject to a decision based solely on automated processing producing legal or similarly significant effects (see also Section 18).
- Right to erasure ("right to be forgotten"): Request deletion of your personal data subject to lawful retention exceptions.
- Right to lodge a complaint: File a complaint with the supervisory authority of your habitual residence or place of alleged infringement.
Please identify the processing and location relevant to your request so we can assess the rights and obligations that apply. This section does not claim that GDPR applies to every user or processing activity.
13. CCPA / CPRA Privacy Rights (California Residents)
For California Residents
Where the CCPA or CPRA applies to the processing concerned, California residents may have the following rights:
- Right to know what data we collect
- Right to delete your information
- Right to opt out of sale (we do not sell data)
- Right to non-discrimination
- Right to correct inaccurate data
- Right to limit use of sensitive data
- Identifiers (name, email, phone, IP)
- Commercial information (purchases)
- Internet activity (App usage)
- Geolocation data
- Inferences (preferences)
14. DPDPA Rights (Indian Residents)
For Users in India
For users in India, this policy explains the purposes and categories of personal data processed by Upsway Services Private Limited. DPDPA rights and duties apply as the relevant provisions and Rules, 2025 come into force.
Specified purpose
Your personal data is processed only for the specific purposes described in Section 2 ("How Do We Use Your Information?"). The categories of personal data we collect are described in Section 1.
Lawful basis
Where applicable and in force, processing under the DPDPA requires consent or a specific permitted legitimate use whose statutory conditions are met. Section 7 is not a general legitimate-interest or contract-performance exception. Other applicable legal requirements may also govern processing.
Your rights as a Data Principal
The rights below apply as the relevant statutory provisions commence. You can contact Cookzy now to request access, correction, erasure, or grievance review.
Obtain a summary of your personal data being processed, the processing activities, and the identities of any data fiduciaries / processors with whom it has been shared.
Correct, complete, or update inaccurate personal data, and request erasure of personal data that is no longer necessary for the purpose for which it was processed.
Withdraw consent at any time, with the same ease as giving it. Email [email protected] with the subject line "Withdraw consent".
Raise a grievance with our Grievance Officer (see Section 15) who will respond within the timelines prescribed under applicable law.
Nominate another individual to exercise your rights under the DPDPA in the event of your death or incapacity. Please email us to record your nominee.
If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India established under the DPDPA.
Consent Manager
The Rules, 2025 provide for registered Consent Managers with phased commencement. Cookzy does not currently offer a registered Consent Manager integration. Contact us directly to make a consent or privacy request.
Grievance Officer: See Section 15 for contact details
DPDPA enquiries: Email [email protected] with the subject line "DPDPA Request"
Response time: Within 30 days, or such shorter timeline as prescribed under DPDPA Rules
This policy explains processing; it does not replace any specific consent required by applicable law. You may withdraw consent by contacting us. If the affected processing is necessary for a requested feature, withdrawing it may prevent us from continuing that feature.
15. Grievance Officer
Our Grievance Officer is the contact for complaints about this policy, the App, and personal data. Applicable statutory response requirements continue to apply.
Designation: Grievance Officer, Upsway Services Private Limited (Cookzy)
Email: [email protected] (subject line: "Grievance")
State: Rajasthan, India
We will acknowledge receipt of a grievance within twenty-four (24) hours and will dispose of it within fifteen (15) days from the date of receipt, in line with the IT Rules 2021. For complaints under the DPDPA, we will respond within the timelines prescribed under the DPDPA Rules.
16. Data Breach Notification
In the event of a personal data breach that affects your personal data, we will:
- Where required by provisions then in force, notify the Data Protection Board of India and affected individuals in the manner and within the applicable timelines;
- Notify the Indian Computer Emergency Response Team (CERT-In) where required under CERT-In Directions, 2022;
- For users covered by GDPR, notify the relevant supervisory authority within 72 hours of becoming aware (where feasible);
- Describe the nature of the breach, the categories and approximate volume of data affected, the likely consequences, and the measures we have taken or propose to take to address it; and
- Provide guidance on protective steps you can take.
Notifications to you will be sent via email to your registered address and, where appropriate, via in-app notice.
17. International Data Transfers
Cookzy uses cloud, communications, payment, analytics, security, and support providers. The countries in which information is processed depend on the service, provider, and configuration, and may include countries outside India.
Applicable transfer restrictions and safeguards depend on the law governing the processing. Contact us for information about a transfer relevant to your account.
18. Automated Decision-Making
We do not use your personal data for automated decision-making — including profiling — that produces legal effects concerning you or similarly significantly affects you. Where we use algorithmic ranking or matching to suggest cooks or content, those suggestions are non-binding and do not replace your own decision to engage a cook.
19. Do-Not-Track Features
Most web browsers and some mobile operating systems include a "Do-Not-Track" (DNT) feature. Our App does not currently respond to DNT browser signals because no uniform technical standard for them has been adopted.
If a standard for online tracking is adopted that we must follow, we will inform you in a revised privacy policy.
20. Third-Party Websites
Our App may contain links to third-party websites, plug-ins, and applications.
21. Cooks' Information
Cooks who register on the Mobile Application also fall within the scope of this Privacy Policy in respect of the personal data they submit to us (such as name, contact details, photographs, identity-document information where collected, address, work experience, availability, applications, and location information described in Section 1). Cooks have the same rights of access, correction, erasure, and grievance redressal as any other Data Principal under Section 11 and Section 14.
When a customer engages a cook, Cookzy is acting as an intermediary that facilitates the introduction; it is not the employer of the cook. See Sections 14 and 15 of our Terms of Use for the role we play in cook–customer engagements.
22. Do We Make Updates to This Policy?
Yes, we may update this policy from time to time to keep it accurate and aligned with applicable law.
For material changes, we will give the notice and obtain any fresh consent required by applicable law. The revised policy will identify the changes; any required notice or consent is separate from publishing this page.
The revised version is identified by the "Last revised" date at the top of this page. We encourage periodic review of this policy.
23. How Can You Contact Us?
Company name: Upsway Services Private Limited
Business name: Cookzy
General enquiries:
[email protected]
Privacy-specific requests (please use the matching subject line):
- India / DPDPA: subject "DPDPA Request"
- EU / GDPR: subject "GDPR Request"
- California / CCPA: subject "CCPA Request"
- Withdraw consent: subject "Withdraw consent"
- Grievance: subject "Grievance" (routed to the Grievance Officer)
24. How Can You Review, Update, or Delete Your Data?
To exercise your data rights:
In-app access
Customers can open their profile and use the edit-profile screen to view and update supported personal details. For other data access or correction requests, email support.
Account deletion
- In the App: Open your customer profile, choose Edit Profile, then open the overflow menu and choose Delete Account
- By email: Write to [email protected] with the subject "Delete account". We may verify your identity and will review the request under applicable law. Account closure and erasure of retained records are separate; see Section 8.