Privacy policy

In this document, “Loopul”, “we”, “us” and “our” mean Doublyu Labs, with its registered office at 2-29, Main Street, Mugachinthala Village, Kondapi Mandal, Prakasam District, Andhra Pradesh 523270, India. We operate the Loopul mobile apps, the website at loopul.in and the Loopul shop console. You can reach us at support@loopul.in or +91 79896 51171.

This policy explains what personal data we process when you use Loopul, why, who receives it, how long we keep it, and the rights you have under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it. For the personal data described here, Doublyu Labs is the data fiduciary. By creating an account or using Loopul you give the consent described below; you can withdraw it at any time (see “Your rights”).

1. Who this policy covers

• Shoppers who order from shops through the Loopul app or website.
• Shop owners and their staff who run a shop on Loopul.
• Visitors to our website.

Each shop is an independent seller. When you order from a shop, the shop receives the details it needs to fulfil your order and keeps its own records of the sale (for example, the invoice it must keep under tax law). For those records the shop is responsible as a data fiduciary in its own right.

2. What we collect and why

If you shop on Loopul

• Mobile number — to create your account and sign you in with a one-time code, and so that the shop can reach you while your delivery is on its way. A shop sees only the last four digits of your number, except while a delivery to you is live.
• Name (optional) — so the shop knows who the order is for.
• Delivery address and map pin — only when you choose delivery, to deliver the order and plan the rider's route. We remember your last address so you do not have to type it again.
• Orders — the items, prices, payment method and status of each order, to process the order, issue the shop's invoice and show you your order history.
• Shopping patterns derived from your completed orders — which items you buy and how often, to suggest your usual items and remind you when you may be running low. These suggestions never place an order or charge you.
• Lists, product requests and notifications — lists you save, items you ask a shop to stock, and the messages we show you in the app. A shop sees how many people asked for an item, never who asked.
• Your location for “shops near me” — used once to find nearby shops and not stored.
• Device notification token and app language — to send order updates to your phone in your language.

If you run or work in a shop

• Mobile number and name of the owner and of each staff member, and the permissions the owner gives each staff member.
• Shop details — business and legal name, GSTIN, address, map location, opening hours, phone number for customers, logo, photos, products, prices and stock.
• Payment set-up details — to accept online payments, a shop owner connects their own payment-gateway account to Loopul. Registration and the verification required by law — identity documents, PAN, business details and bank account — are done by the gateway on its own pages; Loopul receives only the account identifier, its status and an access token, stored encrypted. A shop's own UPI ID, if it adds one, is stored and shown to its customers on their orders.
• Voice entry (optional) — in the shop app, a shopkeeper can tap the microphone at the till or when receiving stock and say the items. The microphone is used only while that button is on. The phone's own speech service (Google on Android, Apple on iPhone) turns the speech into text under its own privacy terms; Loopul never receives or stores the audio or the words heard — only the bill or delivery the shopkeeper then confirms, exactly as if it had been typed.
• A record of sensitive actions taken in the shop (for example stock corrections, refunds and staff changes), which identifies who acted and when, to protect the shop and its customers.

From everyone who uses Loopul

• Saying your shopping list (optional) — in the customer app you can tap the microphone in a shop's search and say your list. The microphone is used only while that button is on. Your phone's own speech service (Google on Android, Apple on iPhone) turns the speech into text under its own privacy terms. We never receive the audio; only the product words reach our servers, as a typed search would.
• Technical data — IP address, device and app version, and records of requests to our servers, to keep the service secure, prevent abuse and fix faults. Our logs do not record mobile numbers, one-time codes, PAN or bank details.
• On our website — we do not use advertising or analytics trackers. The site stores only your display preferences (such as light or dark mode) on your own device; it sets no cookies (Cookies & local storage).

We do not collect your contacts, your photos (other than pictures a shop uploads of its products and premises), or your activity in other apps. We do not sell personal data and we do not use it for third-party advertising.

3. Payments

Online gateway payments are processed by the payment gateway the shop has connected (named on the payment page) and paid directly into the shop's own account. If you pay by UPI straight to the shop, the money goes from your bank to the shop's bank without passing through Loopul. We never see or store your card number, UPI PIN or net-banking credentials, and we never hold your money. When you tell a shop you paid by UPI we keep what you send — the time, the UPI reference, the app and, if you add one, a screenshot — so the shop can check it and so a dispute can be resolved. to the data you give it during payment.

4. Who receives your data

• The shop you order from — your order, your name, and (for a delivery that is on its way) your address and phone number.
• Service providers who process data for us, under contracts that let them use it only to provide their service: payment processing and merchant verification (the payment gateway a shop connects); delivery of sign-in codes as WhatsApp messages (Meta); push notifications (Expo / Google / Apple); hosting, storage and email providers.
• Authorities — when we are required to by law, a court order or a lawful request from a government agency.
• A successor — if our business is merged or transferred, under the same protections described here.

Some of these providers may process data outside India. We transfer personal data outside India only as the DPDP Act permits, and never to a country the Government of India has restricted.

5. How long we keep it

The full table, and how to delete your account, is in Account deletion & data retention.

• Your account — for as long as it is active. When you delete it, we immediately remove your name and saved address, replace your mobile number with an irreversible code (so the number can register again), and sign you out everywhere.
• Orders and invoices — kept even after an account is deleted, because the shop must keep invoices for the period Indian tax law requires (currently up to eight years).
• Security logs — for the period the law requires, and then deleted.
• UPI payment screenshots — the picture is deleted 180 days after the order is finished; the payment details you entered stay with the order as the payment record.
• Backups — rolling copies kept for up to 14 days, then overwritten.
• One-time sign-in codes — expire within minutes and are never stored in readable form.

6. How we protect it

Data is encrypted in transit, access is limited to people who need it for their work, each shop can see only its own data, and sensitive actions are recorded. If a personal data breach occurs, we will inform you and the Data Protection Board of India as the law requires, with what happened, what it means for you and what we are doing about it.

7. Your rights

Under the DPDP Act you have the right to:

• access a summary of the personal data we process about you and of who we have shared it with;
• correct, complete or update it — most details can be changed directly in the app;
• erase it — delete your account in the app under Account, or on the web at Delete your account. Shop owners can close their shop and delete their account in the shop console;
• withdraw consent at any time, as easily as you gave it. Withdrawal does not affect processing already done, and some features (such as ordering) cannot work without the data they need;
• nominate another person to exercise these rights if you die or become unable to do so;
• have your grievance redressed by our grievance officer.

Write to support@loopul.in from the mobile number or email linked to your account (or include the last four digits of your number). We will respond within 30 days. If you are not satisfied with our response to a grievance, you may complain to the Data Protection Board of India.

8. Children

Loopul is for people aged 18 and over. We do not knowingly create accounts for children; if we learn that an account belongs to a child, we will delete it.

9. Changes to this policy

If we change this policy in a way that affects how your data is used, we will tell you in the app before the change takes effect and, where the law requires, ask for your consent again.