Privacy Policy

Last updated: 4 October 2026

NukkadKart helps street food stalls take orders and confirm UPI payments. It has two parts: a customer web app (scan a stall's QR code, order, pay) and the NukkadKart Board Android app used by the stall owner. This page explains what each part collects.

Customers (web app)

• The name you type at checkout and what you ordered, so the stall can match the order to you.
• An anonymous device session (no sign-up, no phone number, no email) to prevent order spam and to show you live status.
• Order time, token number and a short order code.

Payments are made directly from your UPI app to the stall's UPI ID. NukkadKart never sees or stores your UPI PIN, bank details or payment app.

Stall owners (NukkadKart Board app)

• Your mobile number and PIN to log in (the PIN is stored hashed by our authentication provider, Supabase).
• Your stall name, UPI ID, menu, optional FSSAI number and packing charges.

Why the Board app reads bank SMS

The app asks for the RECEIVE_SMS permission for one purpose: to detect that a customer's UPI payment has reached your bank account, so the matching order can be marked Paid automatically and announced aloud.

• The app looks only at incoming messages from bank-style sender IDs that say money was credited.
• It extracts just the amount and the UPI reference number (UTR), on your phone.
• Only the amount, the UTR and the sender ID (for example "VM-HDFCBK") are sent to your NukkadKart account. The text of your messages is never stored or uploaded.
• OTPs, personal conversations and all other messages are ignored.
• You can revoke the permission at any time in Android Settings. The app still works: you then confirm payments by tapping orders yourself.

Sharing and retention

• We do not sell your data or use it for advertising.
• Data is stored with Supabase (hosting in India, Mumbai region) and the web app is served by Vercel.
• Each stall can see only its own orders and payments. Customers can see only their own order.
• Orders and payment records are kept so stalls can reconcile their day. Ask us to delete your data using the contact below.

Contact

Questions or deletion requests: vishwatsen@vooz.in