Privacy Policy

Last updated: 29 September 2026 · Applies to the Pani Wala app, the Pani Wala Partner app and this website.

In short: we collect only what is needed to deliver water and run the marketplace. We do not sell your data, show ads or use advertising or analytics trackers. Location is used only when you tap a "use my location" button, never in the background. You can delete your account from inside the app at any time.

1. Who we are

Pani Wala ("we", "us") runs an online marketplace that connects people who want drinking-water cans (20, 10 and 5 litre) with independent local water suppliers who deliver them. Customers use the Pani Wala app, suppliers use the Pani Wala Partner app or this website, and our administrators use this website to verify suppliers and run the platform. Pani Wala is responsible for your personal data as described here (a "data fiduciary" under India's Digital Personal Data Protection Act, 2023).

2. Data we collect

Customers (Pani Wala app)

Suppliers (Pani Wala Partner app and website)

Everyone

Our server records technical data needed to run the service securely (for example IP address, time and the page or API called) in server logs, which are kept for a limited period for security and troubleshooting. We do not use advertising IDs, cookies for advertising, or any analytics or advertising software in the apps. We do not collect or store payment card, UPI or bank details: online payments are entered directly in the checkout of our payment partner Razorpay (see section 6).

3. Location

• The apps ask for location permission only when you tap a button that needs it (for example "use my location" when adding an address). The app explains why before Android shows the permission prompt.
• Location is used only while the app is open. We never collect location in the background and never track your movements.
• To turn coordinates into a readable address, our server sends them to a map service (see section 6). No name or account details are sent with them.
• You can always type your address and pincode instead, and you can withdraw the permission in Android settings at any time.
• This website does not use your location.

4. How we use your data

• To provide the service: accounts, showing products and sending orders to the supplier you choose, delivery, order and payment notifications, older deposits, ratings, settlements and the supplier's business records.
• To verify suppliers, prevent fraud and misuse, and keep the platform safe.
• To contact you about your orders, account or important changes. We do not send marketing messages without your consent.
• To meet legal, tax and accounting obligations and resolve disputes.

We process your data on the basis of your consent (given when you sign up and use the app) and for the legitimate uses permitted by law.

5. Who we share it with

• The other party to your order: the assigned supplier sees the customer's name, mobile number and delivery address; the customer sees the supplier's business name and mobile number. This is needed to deliver the order.
• Visitors to our website: highly rated review comments may be shown publicly on our home page with only your first name and last initial (for example "Rahul S."), the supplier's business name and the month of the review. Your mobile number, address and full name are never shown. Deleting your account removes your review comments.
• Our administrators, who verify suppliers, handle disputes and run settlements.
• Service providers that host and operate the service on our behalf, under confidentiality obligations.
• Razorpay, our payment partner, for online payments and refunds (see section 6).
• Google (Firebase Cloud Messaging), which delivers push notifications to your phone (see section 6).
• Authorities, when required by law or to protect the safety of users.

We do not sell or rent personal data, and we do not share it with advertisers.

6. Third-party services

To show a readable address for a location, our server sends only the coordinates (latitude and longitude) to:

• Google Maps Platform (Geocoding), run by Google — privacy policy; used first
• OpenStreetMap Nominatim, run by the OpenStreetMap Foundation — privacy policy
• Photon geocoder, run by komoot — privacy policy

Online payments are processed by Razorpay Software Private Limited, a payment aggregator regulated by the Reserve Bank of India. When you pay online, we send Razorpay the amount, our order reference, and your name and mobile number (to pre-fill the checkout); you enter your payment details directly with Razorpay. Razorpay's handling of that data is covered by its privacy policy.

Push notifications are delivered by Firebase Cloud Messaging, a Google service. The app registers a notification token for your device, which we store with your account; when an order or payment changes we send Google that token with the notification title and text (for example "Order #123 is out for delivery"). No address, payment or location data is included. Google's handling is covered by the Firebase privacy information. You can turn notifications off in Android settings at any time; the in-app notification list keeps working.

When you pick your delivery location on the map in the app, your phone loads the map images directly from the OpenStreetMap Foundation's tile servers, which therefore see your device's IP address and the map area being viewed (privacy policy). Text you type in the location search box is sent through our server to Google (Geocoding) or, as a fallback, to Photon (komoot) to find matching places, with at most an approximate position (about 1 km) to rank nearby results; it is not stored by us.

Address data © OpenStreetMap contributors. We may later use Mappls (MapmyIndia) for the same purpose; this policy will be updated before that happens.

7. How long we keep data

• Account and profile data: while your account is active.
• After you delete your account, your personal data is erased or anonymised straight away (see section 8).
• Order, payment, settlement and deposit records are kept without your name, number or address for as long as Indian tax and accounting laws require (generally up to 8 years), and then deleted.
• KYC documents are deleted when a supplier deletes their account.

8. Deleting your account

You can delete your account yourself in the app: Profile → Delete account, confirm with your password. We then remove your name, mobile number, email, password, profile photo, saved addresses and locations, review comments, notifications and device notification tokens and (for suppliers) KYC documents and vendor contact details, and you can no longer sign in. Full steps, and how to ask us by email if you cannot open the app, are on the Delete account page.

9. Security

Data is sent over encrypted connections (HTTPS). Passwords are stored only as salted hashes. KYC documents are stored outside the public web folder and can be opened only by our administrators. Access is limited by role: customers, suppliers and administrators each see only what they need. No system is perfectly secure; if a breach affects your data we will inform you and the authorities as the law requires.

10. Your rights

Under the Digital Personal Data Protection Act, 2023 you can:

• ask for a summary of the personal data we hold about you and how it is used;
• correct or update it (most details can be edited in the app);
• have it erased by deleting your account, and withdraw your consent;
• raise a grievance with us, and if not resolved, with the Data Protection Board of India;
• nominate another person to exercise these rights in case of death or incapacity.

Write to us at the address below; we aim to reply within 30 days.

11. Children

The service is meant for adults. You must be 18 or older to create an account. We do not knowingly collect data from children; if you believe a child has signed up, contact us and we will delete the account.

12. Changes to this policy

If we change this policy we will update the date at the top, and for important changes we will tell you in the app before they apply.