Privacy policy

Who this policy covers

Boxall is the brand operated by BOXALL ONLINE DELIVERY PRIVATE LIMITED. We are a private limited company incorporated in India with CIN U74999KL2021PTC070674.

Our registered address is C/o Sinish V K, Door No. VIII/390, Varikkatharappel (H), Madakkathanam, Muvattupuzha, Ernakulam, Kerala 686670, India.

This policy applies when you use the Boxall Android or iPhone app, visit boxall.in, place or receive an order, contact us by phone or WhatsApp, or work with Boxall as a delivery partner or merchant.

Data we collect

Customers

• Account details: your name, email address and phone number.
• Order and delivery details: delivery address, precise location when you choose to use it, order items, selected shops, delivery instructions, order history and timestamps.
• Payment records: the amount, payment status, payment method and transaction reference returned by Razorpay.
• Support records: WhatsApp messages, support requests and recordings of calls made to our contact number.
• App and device data: app-instance and installation identifiers, notification tokens, IP address, device model, operating system, app version, app activity, crash logs and diagnostic information.

Delivery partners

We collect the identity, contact, address, government-issued ID, bank, vehicle, driving licence, verification and other onboarding information needed to work with Boxall. We also process delivery history, earnings, payouts, complaints and operational location while a partner is working or completing a delivery.

Merchants

We collect owner or representative contact details, shop address, bank and settlement details, GST information, licences, identity and business verification documents, catalogue information, orders and settlement records.

How we use data

We use personal data to:

• create and secure accounts;
• accept, coordinate, deliver and support orders;
• connect customers with the relevant merchant and delivery partner;
• process payments, refunds, settlements and partner payouts;
• send order updates and other service notifications;
• respond to questions, investigate complaints and resolve disputes;
• prevent fraud, misuse and safety incidents;
• measure app and website use, diagnose crashes and improve reliability;
• maintain business, tax and accounting records; and
• comply with legal and regulatory obligations.

Where consent is required, we ask for it at the point the data or device permission is needed. Using Boxall does not give us unrestricted permission to use personal data for unrelated purposes.

Location and device permissions

With your permission, the customer app uses precise location while the app is open. This helps you select a delivery point, confirm service availability and coordinate a delivery. The customer app does not collect precise location in the background.

A delivery location and address may be shared with the assigned merchant and delivery partner where needed to complete an order. Delivery-partner location may be processed while the partner is working or completing a delivery so that Boxall can assign, coordinate and track the order.

We also use a notification token to send order and service updates. You can change location and notification permissions at any time in your device settings. Some features may not work without the permission they depend on.

Payments

Online payments are processed through Razorpay. Razorpay collects and processes the payment information needed to complete the transaction under its own privacy notice.

Boxall receives transaction information such as the order amount, transaction reference, payment method and whether the payment succeeded or failed. Boxall does not receive or store your complete card number, CVV, UPI PIN or online-banking password.

Who receives data

We share only the information needed for the following work:

• Merchants receive the order and customer details needed to prepare and hand over an order.
• Delivery partners receive pickup, contact and delivery details needed to complete an order.
• Razorpay processes online payments.
• Google Firebase provides authentication, database, file storage, push notifications, analytics and crash reporting.
• Google Analytics and Microsoft Clarity help us understand website use and diagnose usability problems.
• WhatsApp and Meta process messages sent through WhatsApp.
• Professional advisers and public authorities may receive information where reasonably necessary to protect legal rights, investigate wrongdoing or comply with law.

These organisations may process data under their own terms and privacy policies. We do not authorise a merchant or delivery partner to use order information for an unrelated purpose.

Calls, WhatsApp and pharmacy pickups

Recorded calls

Calls made to Boxall's contact number may be recorded for customer support, service quality, complaint handling, dispute resolution and fraud prevention.

WhatsApp conversations

When you contact Boxall on WhatsApp, we receive the phone number, profile information and message content that WhatsApp makes available. WhatsApp and Meta also process the conversation under their privacy policy.

Pickup and drop involving a pharmacy

Boxall does not operate a pharmacy, sell medicines or provide medical advice. You may use the general pickup-and-drop service for a purchase that you arrange directly with a pharmacy. The purchase, prescription check and suitability of the product remain between you and the pharmacy. Boxall processes the pickup and delivery information needed to transport the package.

Analytics, diagnostics and cookies

The app uses Firebase Analytics and Crashlytics. Depending on the device and configuration, Firebase may process installation or app-instance identifiers, device and operating-system information, app activity, crash traces, IP-derived approximate location and diagnostic data.

The website uses Google Analytics 4 and Microsoft Clarity. These services use cookies or similar identifiers and may process page views, clicks, scrolling, session interactions, browser and device information, IP address and approximate location.

You can restrict cookies through your browser settings. Blocking analytics technologies may not prevent the essential storage or processing needed to operate and secure the app or website.

Read the Google Privacy Policy and Microsoft Privacy Statement.

How long data is kept

• Account information is kept while the account is active and is processed for deletion when you use the account deletion option.
• Order, invoice, settlement and payment records may be retained for the period required by tax, accounting, fraud-prevention and other applicable laws. Records covered by GST requirements may need to be retained for 72 months from the relevant annual-return due date, and longer where a proceeding or investigation requires it.
• Call recordings and WhatsApp conversations do not currently have a fixed automatic deletion period. We retain them until you make a separate deletion request, subject to any unresolved complaint, dispute, fraud investigation or legal retention requirement.
• Location and delivery information may be kept with the related order record where needed for delivery support, complaints, fraud prevention or legal record-keeping.
• Merchant and delivery-partner records are kept during the working relationship and afterward where needed for payments, accounting, disputes, fraud prevention or legal compliance.
• Analytics and diagnostic information is retained according to Boxall's settings and the retention controls of the relevant provider.

A valid legal obligation or unresolved proceeding may require us to keep a limited record even after a deletion request.

Your choices and privacy requests

You may ask Boxall to:

• tell you what personal data we hold about you;
• correct inaccurate or incomplete account information;
• delete personal data that is no longer required;
• withdraw a consent you previously gave; or
• review a concern about how your data was handled.

Deleting your Boxall account

You can initiate account deletion from within the app. Deleting an account removes access to the account and starts deletion of the associated account data, except for order, payment, tax, dispute or other records that Boxall must keep.

We may ask for information needed to verify that the request comes from you. Deleting Boxall's copy of a WhatsApp conversation does not delete the copy on your device or information retained by WhatsApp under its own policy.

Age requirement

Boxall accounts are intended for people aged 18 or older. A person under 18 must not create or independently use a Boxall account. We do not knowingly collect personal data from children through a customer account.

If you believe a child has created an account or given us personal data, contact us so that we can review and remove it where appropriate.

Security and processing locations

We use access controls, authentication, encrypted connections, restricted staff access and service-provider security features to protect personal data. No internet or storage system can be guaranteed completely secure.

Firebase, Google, Microsoft, Razorpay, WhatsApp and their service providers may process information in India or in other countries where they operate. Their safeguards and contractual terms apply to their processing. If a data breach affects you, Boxall will take reasonable steps and provide notifications where applicable law requires them.

Changes to this policy

We may update this policy when Boxall's services, technology or legal obligations change. The revised page will show a new last-updated date. If a change materially affects how we collect, use or share personal data, we will provide additional notice or seek fresh consent where required.