CloudMess Privacy Policy

1. What we collect

We collect only what we need to run a mess subscription service.

We do not collect:

• Any usage or behavioural analytics. We do not currently run analytics of any kind — no screen-view tracking, no feature-usage events, no profiling. If we ever add it, we will update this policy and ask for your consent first.
• Your bank account number, or debit / credit card details. From members we store only the transaction reference you paste in for a cash or UPI payment — never your own UPI ID. (A mess owner does give us the mess’s UPI ID, so that members can pay the mess by UPI.)
• Your location, contacts, microphone, or any other device sensor data beyond the camera (used only when you actively open the scanner). We do not read your photo library — the only image we hold is a mess photo a mess owner chooses to upload.
• Any data about your family, employer, food preferences outside the mess, or anything you have not explicitly entered into the app

2. How we use it

We process your data for these purposes only:

1. 1Run your account — sign you in (members with a one-time code, mess owners with an email address and password), profile, settings, language and theme preferences.
2. 2Deliver the service — record your meals, run the daily intent survey, dispatch your tiffin, track your dues.
3. 3Communicate with you — push notifications, in-app messages, and SMS, used only to send your login code.
4. 4Protect the service — detect fraud, recover from outages, audit sensitive actions for dispute resolution.
5. 5Comply with the law — keep financial records for the periods required by Indian tax and accounting rules.

We do not use your data for advertising. We do not sell your data to anyone, ever.

Lawful basis (DPDPA §4)

The DPDPA allows us to process your data on only two grounds: your consent (§6), or one of nine narrowly defined legitimate uses (§7) — none of which cover ordinary service delivery. So for CloudMess, your consent is the basis for everything below.

3. Who can see what

CloudMess is multi-tenant: each mess sees only its own data. Within a mess:

• Your owner can see your name, phone, plan details, scan history, survey responses, tiffin dispatch records, payment records, and any notes they have written about you — for the mess you are currently a member of.
• You can see your own data. You cannot see other members’ personal data, and you cannot see the notes your owner writes about you inside their own app. If you want to know what those notes say, email the contact in §9 and we will tell you.
• Owners of other messes cannot see your data.
• A small number of authorised people at InfiWorks can reach mess and member records where it is genuinely needed to run the service — to investigate a fault, answer a support request, meet a legal obligation, or suspend a mess that breaks our Terms. This includes resetting a mess owner’s password at their request. Every one of these actions, including simply viewing a mess, is written to a permanent record that cannot be edited or deleted by anyone.

Changes to your records are validated and recorded on our servers, not on your phone, so we can check and audit every one of them.

When you switch from one mess to another (Settings → Switch mess), your old data stays in the database for the old owner’s records and tax compliance, but is hidden from the new mess and from you. We explicitly enforce this through server-side access controls.

4. Where your data lives

These providers process data on our behalf, under our instructions, and are not permitted to use it for their own purposes.

Your data stays in India (Mumbai region) for the primary database. Notification and crash-reporting services use the closest available region to minimise transit time.

5. How long we keep it

We never keep data longer than needed for a stated purpose.

6. Your rights under DPDPA

You can:

• See what we have on you — email the contact below and ask for a copy of your data. We will respond within 30 days.
• Correct anything wrong — most fields you can edit directly in Settings. For fields you cannot edit (your diet type, for example, which is owner-controlled), ask your mess owner to update it. If they refuse and you believe the value is wrong, email us.
• Delete your account — email the contact in §9 and we will close your account and anonymise your records within 30 days.
  • If you are a member, tell us the mobile number you sign in with.
  • If you are a mess owner, write from the email address you sign in with. Closing a mess-owner account also closes the mess, so your members can no longer use it. We do not wipe the mess’s records: your members’ payment records and our audit log are kept for the periods in §5 because Indian law requires it, and everything else is anonymised. We will tell you exactly what will be kept, and what your members will see, before we act on your request.
  Request account deletion
• Withdraw consent — to manage push notifications, use your device’s notification settings for CloudMess; essential messages (such as login codes and payment alerts) and your in-app inbox are unaffected. For account-level consent: ask us to delete your account (above). Withdrawal does not affect any processing we did before you withdrew.
• Object to processing — contact us. We will explain what your options are.
• Nominate someone to act for you — the DPDPA lets you name another person who can exercise these rights on your behalf if you die or become unable to act yourself. Email the contact below with their name and phone number and we will record it.
• Raise a grievance — email the contact below. We will acknowledge within 7 days and respond within 30 days.
• Complain to the Data Protection Board of India — if we have not resolved your concern to your satisfaction.

7. Children

CloudMess is intended for users aged 18 and above, and we ask you to confirm that you are 18 or older before you finish signing up.

Under the DPDPA we may not process a child’s personal data without verifiable consent from their parent or guardian, and we may not use a child’s data for behavioural tracking or targeted advertising. We do not run targeted advertising at all.

If you are under 18, please do not create an account. A parent or guardian using the app “on your behalf” does not fix this — the data in the account would still be a child’s. Ask your mess owner to handle your membership without an app account instead.

If you believe we hold data about someone under 18, contact us and we will delete it.

8. Security

• All traffic between the apps and our servers is encrypted in transit.
• Server-side access controls prevent any user from reading data that does not belong to them. They are enforced on our servers and cannot be bypassed by a tampered app.
• Your login codes are never stored in a readable form and never leave our servers — the apps never see them.
• Mess-owner passwords are never stored in readable form. Your password is held only as a cryptographic hash by our authentication provider — we cannot read it or recover it, and the only thing we can do is reset it to a new one at your request.
• Sessions are cryptographically signed and refreshed each time you sign in.
• We log every sensitive action (payments, member changes, mess code rotation, mess switches) to an append-only audit log.

If we ever discover a breach affecting your personal data, two separate Indian laws apply and we will act on both:

• You — we will tell you without delay, in plain language: what happened, which of your data was involved, what we have done about it, and what you can do. We will not wait until we have the complete picture before telling you.
• The Data Protection Board of India — an initial report without delay, followed by a detailed report within 72 hours of us becoming aware of the breach, as the DPDPA requires.
• CERT-In, India’s national cyber-incident agency — within 6 hours of us noticing the incident, as the Information Technology Act requires.

9. Contact

CloudMess is not a Significant Data Fiduciary under DPDPA §10, so we are not required to appoint a formal Data Protection Officer. We are required to publish someone who can answer questions about how we handle your data, and that is the contact above. If our scale or the law changes, we will appoint a dedicated officer and update this policy.

10. Changes to this policy

If we make material changes to how we process data, we will update the “Effective date” and “Last updated” fields at the top of this document, and summarise what changed in a note below them.

The current version is always readable inside the app under Settings → Privacy Policy, and on the web at cloudmess.in/privacy.

Where the DPDPA requires it, we will ask you to re-confirm your consent before a change applies to you.