Privacy policy

1. Who we are

Shangpung Express (“we”, “us”) is operated by Shangpung Express, Shangpung, West Jaintia Hills, Meghalaya, India. We run a marketplace app that lets you order food from local restaurants and book bike or cab rides with independent captains. For the purposes of the Digital Personal Data Protection Act, 2023 (DPDP Act), we are the data fiduciary for the personal data described here.

2. What we collect

Account information

Phone number when you sign in with a one-time code sent by SMS.
Email address when you sign in with a one-time code sent by email.
Google account details when you choose “Continue with Google”: your name, email address, profile picture and Google account identifier. We do not receive your Google password and we do not access your contacts, files, Gmail or any other Google data.
The name you enter and any email you add to your profile.

Location

Your device’s location while you use the app, to show restaurants that deliver to you, set your delivery or pickup point and find nearby captains. We only ask for location while the app is in use, never in the background.
Captains: while you are online in the captain dashboard, the app sends your location regularly (more often during a job) so we can match you with nearby requests and show your position to the customer you are serving. Sharing stops when you go offline.
Addresses and places you save, and the pickup, drop and delivery points of your orders and rides.

Orders, rides and payments

What you order, from which restaurant, delivery instructions, ride routes, fares, timestamps, cancellations, ratings and feedback.
Payment method and status. Cash is collected by the captain. If you pay online, the payment is processed by Razorpay; we receive a payment reference and status but never your card, UPI PIN or bank login details.

Restaurant partners and captains (verification)

Restaurants: restaurant and owner name, address and map location, phone number, FSSAI licence or registration number and certificate photo, storefront photo, optional GSTIN, menu and ID proof, menu items and photos, opening hours, and a UPI ID or bank account (account holder, number, IFSC) for payouts.
Captains: full name, date of birth, photograph, driving licence number and photo, vehicle type, registration number, make, colour and registration certificate (RC), optional ID proof and insurance, an emergency contact, a contact number if your account has none, and a UPI ID or bank account for payouts.
Earnings, settlements, cash collected and payouts, and records of jobs accepted, completed or handed back.

Device and usage

A push notification token so we can send order, ride and account updates, and the device platform.
Basic technical logs (such as error reports and request times) needed to run and secure the service.

3. How we use your data

To create and secure your account and let you sign in.
To take, price, fulfil and track orders and rides, and to connect you with the restaurant or captain involved.
To verify restaurants and captains before they can work on the platform, and to pay them.
To send service messages: one-time codes, order and ride updates, and replies to your requests.
To provide support, resolve disputes, prevent fraud and abuse, and keep people safe.
To keep the records that tax, accounting and other laws require.
To understand and improve the service using aggregated statistics.

We process your data on the basis of your consent, which you give when you create an account and use features such as location, and for the legitimate uses permitted by the DPDP Act, such as complying with law. We do not sell your personal data and we do not use it for third-party advertising.

4. Information from Google

If you sign in with Google we request only the basic profile scopes (openid, email and profile). We use your name, email address and profile picture only to create your Shangpung Express account, sign you in and show your name in the app, and we do not share them with third parties except the service providers listed below that host our sign-in system. Shangpung Express’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The restaurant you order from sees your first name, the items, your order note and payment method.
Your captain sees your first name, phone number, pickup and drop or delivery address and any delivery note, for the duration of the job.
Customers see their captain’s name, photo, phone number, vehicle details, rating and live location during the job, and a restaurant’s name, address and phone number.
Service providers who process data for us under contract: Supabase (database, sign-in and file storage, hosted in Mumbai, India), Google (Maps and Places for maps and address search, the map on this website, and Google Sign-In), Twilio (SMS codes), Razorpay (online payments), Expo and Firebase Cloud Messaging (push notifications), Vercel (website hosting) and our email provider (email codes and support).
Authorities when the law requires it, or to protect the safety of people using the service.
A buyer or successor if the business is transferred, who must keep protecting your data under this policy.

6. How long we keep it

Account and profile data: while your account is open, and deleted after you ask us to delete the account.
Order, ride, payment and settlement records: for as long as tax and accounting laws require (generally up to 8 years), then deleted or anonymised.
Verification documents of restaurants and captains: while the partnership is active and for as long as required afterwards to meet legal obligations or resolve disputes.
Captain location: we keep the latest position while you are online; trip routes are stored with the ride record.

7. How we protect it

Data is encrypted in transit. Access is controlled by account-level security rules in our database, verification documents are kept in private storage that only you and authorised staff can open, and staff actions in our admin console are logged. No system is perfectly secure; if a breach affects you, we will tell you and the Data Protection Board of India as the law requires.

8. Your rights and choices

Access a summary of the personal data we hold about you and how we use it.
Correct or update your data. You can change your name and email in the app at any time.
Delete your account and personal data: see Delete your account.
Withdraw consent, for example by turning off location or notification permission in your phone settings. Some features will stop working without them.
Nominate another person to exercise your rights in case of death or incapacity.
Raise a grievance with us, and if you are not satisfied, with the Data Protection Board of India.

To use any of these rights, email nxgsstudio@gmail.com from the phone number or email linked to your account (or tell us both).

9. Children

Shangpung Express is meant for people aged 18 and over. Captains and restaurant owners must be at least 18. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.

10. Changes to this policy

We may update this policy as the service changes. We will post the new version here with a new effective date and, for significant changes, tell you in the app.

11. Contact and grievances

Grievance officer and privacy contact: Shangpung Express, Shangpung, West Jaintia Hills, Meghalaya, India. Email nxgsstudio@gmail.com. We aim to reply within 7 days and to resolve grievances within 30 days.