Privacy Policy

1. Introduction & Scope

Everyday Companion ("Alfred", "we", "our", or "the App") is developed, owned, and operated by Ratelo Technologies Private Limited (operating as Ratelo Labs), an AI and mobile software studio based in Vellore, Tamil Nadu, India.

This Privacy Policy explains how we collect, process, store, and protect your personal data in strict compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act 2023) of India and the Swiggy Model Context Protocol (MCP) Developer Terms.

2. Roles: Data Fiduciary and Data Processor

To ensure full transparency regarding your personal data:

• Swiggy (Bundl Technologies Pvt. Ltd.) acts as an independent Data Fiduciary for food and grocery ordering, delivery logistics, payment processing, and restaurant transactions. When you interact with Swiggy tools or place an order, Swiggy's Privacy Policy governs the fulfillment and delivery lifecycle.
• Ratelo Technologies Private Limited (Ratelo Labs) acts as the Data Fiduciary for your Everyday Companion account profile, meal preferences, and pantry inventory, and as a Data Processor when bridging your requests to Swiggy MCP tools on your explicit instruction.
• Zero Direct Financial Handling: Payments are executed via secure UPI intent directly within authorized third-party UPI applications (e.g., Google Pay, PhonePe, Paytm) or Swiggy payment surfaces. We never handle, collect, or store your credit/debit card numbers, UPI PINs, or bank account credentials.

3. What Data We Collect and Why

A. Information You Provide

• Account Credentials: Email address and user identifier (uid) managed securely via Firebase Authentication.
• Meal & Routine Preferences: Weekly schedules (breakfast, lunch, dinner times), target food budgets, dietary categories (e.g., Vegetarian, Vegan), and avoided ingredients or allergies.
• Kitchen Pantry Inventory: Ingredient names, estimated quantities, and freshness dates to assist in recipe generation and waste reduction.
• Days Off & Shift Schedules: User-selected days off and optional rotational shift patterns used to organize daytime and evening outings.
• Timeline Moments: High-level summaries of meals prepared, orders placed, dining reservations, or event bookings (dish/restaurant/show name, date, and reference order ID).

B. Swiggy MCP Integration Data

• OAuth Session Tokens: When you link your Swiggy account, authentication tokens are stored strictly inside hardware-backed secure storage (Android Keystore / iOS Keychain) or encrypted server-side via Google Cloud KMS envelope encryption. They are never written to unencrypted storage, shared databases, or log files.
• Delivery Addresses: Retrieved dynamically via Swiggy MCP solely to determine serviceability and delivery options. We enforce strict data minimization: full street addresses are never persisted to disk or Firestore, and street addresses are stripped before any AI processing.
• Cart & Order Information: Displayed in real time for user confirmation. Instamart orders and restaurant checkouts require explicit user authorization before placement.
• Event & Outings Data (Swiggy Scenes & Dineout): Event listings, venues, show timings, and restaurant table availability are retrieved dynamically via Swiggy MCP to plan day-off outings on explicit user request. Venue locations and show times are processed in-session. Ticket purchases and dining reservations require explicit, two-step confirmation and user-initiated UPI payment. No autonomous ticket purchases or bookings are permitted.

4. Artificial Intelligence & Data Residency Guarantees

• No Foundation Model Training: Your personal data, conversations, food orders, and pantry records are never used to train, retrain, or improve foundation AI models (Google Gemini, Vertex AI, or third-party models).
• Log Hygiene & Minimization: Operational logs record only pseudonymous 12-character SHA-256 hashed user identifiers, tool names, and latency metrics. Logs never contain request bodies, response payloads, cart items, delivery addresses, phone numbers, or authentication tokens.

5. Storage and Retention

We retain your personal data only as long as you maintain an active account with Everyday Companion. If you choose to delete your account or unlink your services, data is removed immediately:

• Cloud Firestore Records: Erased atomically upon request.
• Local Device Cache: Purged immediately from device memory and application sandbox.
• Secure Keystore Tokens: Flushed from hardware keystore upon disconnect or deletion.

6. Your Rights and the In-App Deletion Path ("Delete My Data")

Under the DPDP Act 2023, you have the right to access, correct, review, and permanently delete your personal data.

You do not need to contact customer support to exercise your right to erasure. You can permanently delete all your data directly inside the application:

1. Open the App and navigate to the You tab.
2. Select Settings & Privacy.
3. Tap Delete my data.
4. Confirm the destructive action in the verification dialog.

Upon confirmation, our automated UserDataService irreversibly purges your Firestore documents, removes hardware Keystore tokens, clears local preferences, cancels all background alarms, and deletes your Firebase Authentication account.

7. Security Safeguards

• Encryption in Transit: All communication is encrypted using TLS 1.3 / HTTPS.
• Encryption at Rest: AES-256 hardware encryption in Firestore and Cloud KMS envelope encryption for session secrets.
• Static Egress & Zero Blind Retries: Server-side proxy routing with dedicated static IP addresses prevents request tampering, and double-tap guards prevent accidental duplicate orders.

8. Grievance Redressal & Contact Information

In accordance with the Digital Personal Data Protection Act, 2023, Ratelo Technologies Private Limited has designated a Data Protection Grievance Officer:

Grievance Officer: Ajay K.
Entity: Ratelo Technologies Private Limited (Ratelo Labs)
Title: Data Protection Officer & Founder
Email: privacy@ratelo.ai (or privacy@everyday-companion.com)
Registered Location: Vellore, Tamil Nadu, India

Inquiries will be acknowledged within 24 hours and addressed within 72 business hours.