PRIVACY POLICY

1. Introduction

Welcome to Chotu ("Sab Kar Ley Ga!"), a hyperlocal micro-commerce platform operated by Chotu Digital. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and related services.

Chotu is a demand-first platform that connects household buyers with local suppliers (retailers, wholesalers, and distributors) within a hyperlocal radius. We do not operate as a marketplace, dark store, or logistics provider. We simply facilitate the connection between buyers and suppliers to enable demand generation and fulfillment.

By using Chotu, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not access or use our application.

2. Information We Collect

2.1 Personal Information

We collect the following personal information when you register and use our platform:

• Mobile Phone Number: Required for account registration and OTP-based authentication
• Name: Your display name for identification within the platform
• Location Data: GPS coordinates and delivery addresses to connect you with nearby suppliers within the hyperlocal service radius
• Profile Information: Role selection (buyer or supplier), and for suppliers: shop name, business categories, and delivery radius preferences

2.2 Supplier Verification Documents (For Suppliers Only)

If you register as a supplier, particularly for pharmacy category, we collect verification documents to ensure compliance with applicable laws:

• CNIC (National Identity Card): For identity verification
• Residential/Business Proof: To verify business location
• Pharmacy License (if applicable): Required for suppliers handling pharmacy category items, manually verified by our admin team before approval

2.3 Voice and Audio Data

Chotu is a voice-first platform. We collect:

• Voice Recordings: When you use the voice ordering feature, your audio is recorded and processed to extract order details
• Voice Messages: Audio messages sent during chat communications between buyers and suppliers

2.4 Order and Transaction Data

• Order history and details (items, quantities, preferences)
• Delivery addresses and location pins shared during orders
• Chat messages and communications between buyers and suppliers
• Order status and fulfillment information

2.5 Prescription Images (For Pharmacy Orders)

2.6 Device and Technical Information

• Device type, operating system, and version
• App version and usage statistics
• Error logs and crash reports for improving app stability

3. How We Use Your Information

We use the collected information for the following purposes:

Platform Operations

• To create and manage your account
• To authenticate users via OTP verification
• To connect buyers with nearby suppliers based on location data
• To facilitate order creation, communication, and fulfillment

Voice Processing

• To transcribe voice orders into text
• To extract order details (items, quantities, shop preferences) from voice input
• To provide multilingual support (Urdu, English, Roman Urdu)

Compliance and Safety

• To verify supplier credentials and approve pharmacy category suppliers
• To ensure prescription validation for non-OTC medicine orders
• To enforce platform policies and prevent misuse

Communication

• To send order notifications and status updates
• To enable real-time chat between buyers and suppliers
• To provide customer support

Service Improvement

• To analyze usage patterns and improve platform functionality
• To fix bugs and enhance user experience

4. Information Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

4.1 Between Buyers and Suppliers

When you place an order, relevant information (name, delivery address, order details, and for pharmacy orders - prescription images) is shared with the supplier fulfilling your order to enable successful delivery. Suppliers can see buyer locations within their service radius to accept and fulfill orders.

4.2 Third-Party Service Providers

We use trusted third-party services to operate our platform:

• Supabase: For secure database hosting, user authentication, and file storage
• Google Gemini AI: For voice transcription and natural language processing of orders
• Google Maps / Location Services: For geolocation and address services

These providers are bound by their own privacy policies and data protection obligations.

4.3 Legal Requirements

We may disclose your information if required by law, court order, or government regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5. Payment Information

6. Data Storage and Security

6.1 Storage

Your data is stored on secure cloud servers provided by Supabase, which employs industry-standard security measures including encryption at rest and in transit. Voice recordings and images are stored in secure cloud storage buckets with appropriate access controls.

6.2 Security Measures

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encrypted data transmission (HTTPS/TLS)
• Secure authentication via OTP
• Row-Level Security (RLS) policies ensuring users can only access their own data
• Regular security assessments and monitoring
• Restricted access to personal data by authorized personnel only

6.3 Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. Order history and related communications are retained for dispute resolution and legal compliance purposes. You may request deletion of your account and associated data by contacting us.

7. Your Rights and Choices

You have the following rights regarding your personal information:

• Access: You can access your profile information, order history, and saved addresses within the app
• Correction: You can update your profile information, name, and addresses at any time
• Deletion: You can request deletion of your account by contacting our support team
• Location Permissions: You can enable or disable location access through your device settings, though this may limit platform functionality
• Microphone Permissions: You can disable microphone access, though voice ordering features will not be available
• Notifications: You can manage notification preferences within the app settings

8. Children's Privacy

Chotu is not intended for use by children under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information promptly. If you believe we may have collected information from a child, please contact us immediately.

9. Prohibited Items and Platform Usage

Chotu strictly prohibits the use of the platform for ordering, selling, or facilitating the exchange of any items that are illegal or prohibited under the laws of Pakistan. This includes but is not limited to controlled substances, illegal drugs, weapons, counterfeit goods, and any other items prohibited by applicable law. Users found violating these policies will be immediately blocked from the platform.

10. Third-Party Links and Services

Our app may contain links to third-party services such as Google Maps for navigation. These third-party services have their own privacy policies, and we encourage you to review them. We are not responsible for the privacy practices of third-party services.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify you of any material changes by posting the new Privacy Policy within the app and updating the "Effective Date" at the top of this document. We encourage you to review this Privacy Policy periodically.

13. Acknowledgment

By downloading, installing, and using the Chotu application, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree to this Privacy Policy, please do not use our application.