This policy explains what personal data Druto ("we", "us") collects through the Service, why, and the choices you have. It is written to meet the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023.
1.What we collect
From customers:
- Mobile number (verified by OTP) and the name you give us.
- Your loyalty activity: scans, stamps, rewards earned and redeemed, and which businesses you visit.
- Your device location when you scan, used to confirm you are at the business and to detect which branch you are at.
From Merchants:
- Business and owner details: business name, owner name, phone, email, address, location, logo, branches.
- Content you upload, such as menus, photos and reward descriptions.
- Billing records. Card, UPI and bank details are handled by Razorpay; we do not store them.
If you apply for a job: the details, résumé and documents you submit, used to assess your application.
If you use our Contact form: the name, phone number, email, business name, city and message you send, and your IP address, used to reply to you and to block abuse.
From everyone: device and browser details, IP address, pages visited and cookies, collected for security and analytics.
2.How we use it
- To sign you in, run stamp cards, rewards and scratch cards, and show Merchants their programme activity.
- To process payments, activate plans and ship QR stands.
- To send service messages such as OTPs and reward updates by SMS or WhatsApp.
- To prevent fraud and abuse, and to fix problems. Our support staff may access an account to help resolve an issue, and that access is logged.
- To measure and improve our website and advertising.
3.What Merchants see
When you scan at a business, that Merchant can see your name, mobile number and your visit and reward history with them. They cannot see your activity at other businesses.
6.How long we keep it
We keep account data while your account is active. After you delete your account we remove or anonymise your personal data within 90 days, except records we must keep by law, such as invoices and tax records.
7.Your rights
You can ask to access, correct or delete your personal data, or withdraw consent, by emailing contact@druto.in. You may also nominate someone to exercise these rights for you. If you are unhappy with our response you can contact the Data Protection Board of India.
8.Security
Data is sent over encrypted connections, and access to it is restricted to staff who need it. No system is perfectly secure; tell us at contact@druto.in if you believe your account has been compromised.
9.Children
The Service is not directed at children under 18. We do not knowingly collect their data without verifiable parental consent.
10.Changes to this policy
We will post changes on this page and update the date above. We will notify you of material changes before they take effect.
11.Contact
For privacy questions or complaints, write to the Grievance Officer, Druto, at contact@druto.in or call 8446791696.
Questions about this policy?
Write to us and we'll help.