Privacy Policy

Effective date: 10 May 2026 · Last updated: 10 May 2026

This Privacy Policy explains how Skapian Private Limited (“GullyDrop”, “we”) collects, uses, stores, and shares personal information when you use the GullyDrop website, our WhatsApp commerce service, or our mobile applications (collectively, the “Platform”).

1. Information we collect

1.1 Information you give us

• Name, mobile number, email address, and delivery address(es)
• Order history, cart contents, and product preferences
• Customer-support messages, photos, and voice notes you send us via WhatsApp or the app
• If you are a merchant or delivery partner: business name, owner name, GSTIN (where applicable), bank/UPI details, identity documents required for KYC

1.2 Information collected automatically

• Device identifiers, operating system, app version, and crash logs
• Approximate or precise geolocation, only when you grant permission, in order to show nearby merchants and route deliveries
• Usage analytics such as pages viewed, actions taken, and time spent in-app

1.3 Information from third parties

• Payment status and limited payment metadata from our payment aggregator (e.g. Razorpay, PhonePe). We do not receive your full card number, CVV, or UPI PIN.
• WhatsApp message metadata and templates from Meta when you interact with our verified business number.
• Map and address data from Google Maps APIs.

2. How we use your information

• To create and manage your account, fulfil your orders, and process payments and refunds
• To route deliveries, communicate order status, and resolve customer-support queries
• To detect and prevent fraud, abuse, and unauthorised access
• To comply with applicable law, including tax, GST, and consumer-protection requirements
• To improve product quality, debug issues, and (only with your consent) send promotional or transactional messages

3. Sharing of information

We share information only with:

• Merchants — the items you order, your name, delivery address, and contact number, so they can prepare and hand off the order
• Delivery partners — your delivery address, contact number, and order summary, so they can complete the delivery
• Payment aggregators — transaction amount and reference, to process your payment
• Service providers — cloud hosting (e.g. MongoDB Atlas, Hetzner, Google Cloud), communication providers (Meta WhatsApp Cloud API), analytics tools, all under written contracts that limit their use of the information to providing services to us
• Government authorities — only when required by law, court order, or to enforce our Terms

We do not sell your personal information to advertisers or third parties.

4. Payment data

All online payments are processed by RBI-licensed payment aggregators. We never store full card numbers, CVVs, UPI PINs, or net-banking passwords on our servers. We retain only a transaction reference, the amount, the payment status, and the last four digits of the instrument (where shared by the aggregator) for reconciliation and refund purposes.

5. Cookies and similar technologies

The website uses essential cookies to keep you signed in and to remember your cart. We may also use analytics cookies (e.g. for measuring page performance). You can disable cookies in your browser, but parts of the website may not work as expected.

6. Data retention

We retain your account information for as long as your account is active and for a reasonable period thereafter to comply with legal, tax, and audit obligations. Order, invoice, and GST records are retained for at least 8 (eight) years as required under Indian tax law. You may request deletion of your account; some records (e.g. invoices) will be anonymised but cannot be fully deleted.

7. Security

We use industry-standard measures including HTTPS/TLS in transit, encrypted database connections, hashed and salted passwords (bcrypt), JWT-based authentication for the API, role-based access controls, and regular backups. No internet-facing service is perfectly secure, however, so we cannot guarantee absolute security.

8. Your rights

Subject to applicable law, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Withdraw consent for marketing communications at any time
• Request deletion of your account, subject to legal retention requirements
• Lodge a grievance with our Grievance Officer (see “Grievance Officer” below)

To exercise any of these rights, write to ankush.ag.1208@gmail.com from the email or mobile number associated with your account.

9. Children

The Platform is not directed at persons under 18. We do not knowingly collect personal information from children. If you believe a minor has provided us information, please contact us so we can remove it.

10. Cross-border transfers

Some of our service providers may store or process information outside India. Where this happens, we ensure equivalent safeguards through written contracts.

11. Grievance Officer

In accordance with the Information Technology Act, 2000 and the rules made thereunder, the contact details of our Grievance Officer are:

We aim to acknowledge complaints within 48 hours and resolve them within 30 days, in line with the IT Rules, 2021.

12. Changes to this Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent revision. Material changes will be notified via the Platform.