AquaDrop — Privacy Policy

Last updated: July 29, 2026

AquaDrop ("we", "us", "our") operates the AquaDrop drinking-water and water-services delivery marketplace, available via our website and Android/iOS apps (the "Service"). AquaDrop is operated by an Udyam-registered proprietorship (Udyam Reg. No. UDYAM-AP-17-0082345) based in Andhra Pradesh, India.

This policy explains what information we collect, how we use it, and the choices you have.

Information we collect

• Account information: phone number, name, and email address (if you sign in with Google).
• Location information: delivery addresses you save, and live GPS location while an order is being delivered or a courier/supplier is actively fulfilling one — used to show accurate delivery ETAs and maps.
• Order and payment information: your order history, subscriptions, and payment status. Card, UPI, and other payment instrument details are collected and processed directly by our payment partner, Razorpay — we do not store your full payment card details.
• Communications: support tickets you raise with us.
• Device information: basic technical data (IP address, app version) used for fraud prevention and troubleshooting.
• Identity verification information (suppliers and delivery partners only): the identity document you upload during registration — a driving licence for delivery partners — and, for delivery partners, a live facial capture. See Identity and facial verification below. Customers never upload identity documents or facial media.

How we use your information

• To create your account and process orders, subscriptions, and deliveries.
• To send you one-time passwords (OTPs) for login via WhatsApp.
• To show live delivery tracking and estimated arrival times.
• To process payments securely via Razorpay.
• To detect and prevent fraud and abuse (for example, verifying that a delivery address is genuine and within a supplier's service area).
• To respond to support requests and improve the Service.
• To verify the identity of suppliers and delivery partners before they are allowed to operate on the marketplace.

Identity and facial verification (delivery partners)

AquaDrop sends delivery partners to customers' homes, so before a delivery partner is approved we verify that the person using the account is the person named on the identity document they submitted. This section applies only to delivery partners in the AquaDrop Partner app. Customers are never asked for an identity document or a facial capture.

• What we collect. A photo of your driving licence, and a short live facial capture — either 3–5 photos or one short video — recorded in the app while you perform a simple action we choose at random (for example "Blink twice" or "Turn your head left"). We also record when the capture was made and basic details of the device it was made on, so that we can tell a genuine live capture from a re-used file.
• Consent. The camera does not open until you have read and accepted an on-screen consent notice. If you do not consent, no facial media is collected; you will not be able to complete delivery-partner onboarding, but you can continue to use AquaDrop as a customer.
• Live capture only. The capture is taken with the in-app camera. The app has no access to your photo gallery and cannot read any existing photo or video from your device.
• How it is used — reviewed by a person, not a machine. An authorized AquaDrop administrator compares the capture with your licence photo by hand and approves, rejects, or asks you to record it again. We do not run face detection, face recognition, or face matching on it; we do not create a faceprint or any other biometric template; and no automated system makes a decision about you from it. The result of the review is shown to you in the app.
• Who can see it. Only authorized AquaDrop administrators. Your facial media is never shown to customers, suppliers, or other delivery partners, is never sold or shared with any third party, is not used for advertising or analytics, and is not used to train any machine-learning or artificial-intelligence model.
• How long we keep it. While your account is active, and then as described under Data retention below. You can ask us to delete it at any time using the contact address at the end of this policy.

Third-party services we use

• Razorpay — payment processing.
• Meta (WhatsApp Business Platform) — delivering login OTP messages.
• Google — "Sign in with Google" authentication, and Google Maps for address search and live delivery maps.

Each of these providers processes data under its own privacy policy.

Data sharing

We share your delivery address and contact details with the supplier and delivery courier assigned to your order, solely to fulfil that order. We do not sell your personal information to third parties.

Data retention

We retain account and order data for as long as your account is active, and as needed to comply with legal, accounting, or dispute-resolution obligations.

Identity records of suppliers and delivery partners — the identity document, a delivery partner's facial verification media, contact details and payout details — are handled differently when an account is deleted. They are moved to a restricted archive that is unreachable from the apps and accessible only to AquaDrop administrators, and only to answer a specific dispute, fraud claim, insurance claim or lawful request. That archive is automatically and permanently deleted 8 years after the account is closed, the period Indian tax and accounting rules expect business records to be kept. This is explained in full on our account deletion page.

Your choices

• You can update or delete saved addresses from within the app.
• You can decline the facial verification consent; no facial media is collected unless you accept it.
• You can request deletion of your account and associated personal data from within the app, from our account deletion page, or by contacting us below.
• You can ask us to delete your identity document or facial verification media sooner than the retention period above, and we will consider the request against any legal obligation we have to keep it.

Children's privacy

The Service is not directed to children under 18, and we do not knowingly collect personal information from them.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

Contact us

For any privacy questions or data-deletion requests, contact us at asheeshanuroop@gmail.com.