Last Updated: May 10, 2026
We have summarised the key points below. Please read the full Policy for complete details.
WAYCUBE COMMERCIAL PRIVATE LIMITED ("WayCube," "Company," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy ("Policy") explains how we collect, use, disclose, retain, and safeguard personal information when you access or use our website, mobile application, and related services (collectively, the "Platform").
This Policy applies to all users of the Platform, including customers, vendors, vendor staff, delivery members, visitors, and other individuals who interact with our services. It does not apply to information you provide directly to third parties such as vendors, third-party tools, or external integrations — please consult their respective privacy notices.
By accessing or using the Platform, you agree to this Policy and our Terms of Service. If you do not agree, please do not use the Platform.
We collect personal information in three ways: directly from you, automatically through your use of the Platform, and from third-party sources.
When you create an account, place orders, list products, or otherwise use the Platform, you may provide:
When you use the Platform, we automatically collect:
We may receive personal information about you from:
We use personal information for the specific purposes set out below, and only to the extent necessary for each purpose:
| Purpose | Categories of Data Used |
|---|---|
| Creating and managing your account | Identity, contact, credentials |
| Processing orders, payments, refunds, and settlements | Transaction, payment, vendor, delivery data |
| Enabling vendor discovery and live delivery tracking | Location, device data |
| Customer support and Review Chat resolution | Contact, transaction, chat data |
| Fraud prevention, risk scoring, and dispute investigation | Account, device, transaction, behavioural data |
| Compliance with applicable laws (GST, TCS, AML, KYC, accounting, tax) | KYC, transaction, payment data |
| AI-powered features (described in Section 4) | Search queries, product interactions, order context |
| Service-related communications (transactional emails, SMS, push) | Contact, transaction data |
| Marketing communications (only with your consent) | Contact, preferences, behavioural data |
| Improving the Platform, debugging, and security | Usage, device, log data |
We process personal information based on (a) your consent, (b) the necessity of providing the services you have requested, and (c) compliance with our legal and regulatory obligations.
We use artificial intelligence services, including Google's Gemini API, to provide enhanced in-app experiences such as:
When you use these features, certain interaction data — such as your search queries, product browsing context, and order history — may be processed by these AI services to generate responses, recommendations, or insights. We aim to limit the personally identifying information (such as full name, phone number, or address) shared with such services to what is necessary to fulfil your request.
Under the enterprise terms of Google's Gemini API as applicable to us, customer data sent to the API is not used by Google to train its general-purpose foundation models.
Separately, we may use information about how users interact with our AI-powered features — including which recommendations are clicked, search refinements, and feedback signals — to improve the quality, accuracy, and relevance of these features over time. Where we use such data for improvement purposes, we do so in de-identified or aggregated form to the extent practicable.
We do not make solely automated decisions that produce legal or similarly significant effects on you. Where AI assists in decisions such as fraud screening or risk scoring, a human review is available on request through our grievance channel (Section 14).
Where the Platform offers controls to opt out of personalised recommendations, you may exercise these through your account settings. Core Platform functionality will continue to work without personalisation.
For active orders, the Platform may enable live location sharing between vendor staff or delivery members and the relevant customer (and vice versa) for the limited purpose of order coordination and tracking. Live location sharing:
You must not misuse location features or share another person's location without their knowledge and a lawful basis.
We do not sell your personal data. We share personal information only as described below.
We share order-related information between the customer, the vendor, and (where applicable) the delivery member, to the extent necessary to fulfil the order and resolve any disputes. This may include name, contact number, delivery address, order details, and live location during active orders.
We share personal data with the following service providers, who are bound by confidentiality and data-protection obligations:
| Service Provider / Category | Purpose | Location of Processing |
|---|---|---|
| Google Cloud Platform / Firebase | Hosting, database, authentication, real-time data sync, file storage | Primary: Mumbai, India (asia-south1). Some sub-services may process globally. |
| Google Maps Platform | Maps, geocoding, distance and routing | Globally distributed Google infrastructure |
| Google Gemini API | AI-powered features as described in Section 4 | Google infrastructure as defined in Google's Generative AI terms |
| Cashfree Payments | Payment processing, payouts, KYC verification, settlement | India |
| SMS, OTP, and email service providers | Transactional communications | India / global, depending on provider |
| Customer support, analytics, and crash-reporting tools | Support, debugging, product analytics | India / global, depending on provider |
We may disclose personal data if required by law, court order, or governmental authority, or where we believe in good faith that disclosure is necessary to protect rights, property, or safety, or to prevent fraud.
If WayCube undergoes a merger, acquisition, restructuring, or sale of assets, personal data may be transferred to the successor entity, subject to the same protections set out in this Policy.
Our primary data hosting infrastructure (Google Cloud Platform / Firebase) is configured to store user data in the Mumbai, India region (asia-south1). However, certain service providers — particularly those providing AI services (such as the Gemini API), maps, analytics, and global communications — may process personal data on infrastructure located outside India.
Where such transfers occur, we rely on the contractual terms of our service providers to maintain comparable safeguards. The Government of India has not, as of the date of this Policy, restricted transfers to any specific country under the Digital Personal Data Protection Act, 2023.
We retain personal data only for as long as necessary for the purposes set out in this Policy, or for as long as required by applicable law. Indicative retention periods are set out below:
| Data Category | Retention Period |
|---|---|
| Active account data | Until account deletion, plus up to 90 days in backups |
| Transaction, payment, and invoice records | 8 years from the date of transaction (Companies Act, 2013 and GST law) |
| KYC and vendor onboarding documents | 5 years from end of relationship (PMLA norms) |
| Support tickets and Review Chat records | 24 months |
| Marketing communications and consent records | Until you withdraw consent, plus 12 months for compliance audit |
| Application logs and analytics data | Up to 12 months |
| Inactive accounts | Notice followed by deletion after 36 months of inactivity |
When data is no longer needed, we delete it or irreversibly anonymise it, except where retention is required by law or for the establishment, exercise, or defence of legal claims.
We use cookies, software development kits (SDKs), and similar tracking technologies on our website and mobile application. These fall into the following categories:
You can manage cookies through your browser settings and tracking permissions through your device settings. Disabling certain cookies may affect Platform functionality.
We implement industry-standard technical and organisational measures to protect personal data, including:
No system is completely secure, however, and we cannot guarantee absolute protection against unauthorised access, loss, or misuse. We rely on you to safeguard your account credentials and to notify us immediately at support@thewaycube.com of any suspected unauthorised use of your account.
In the event of a personal data breach affecting your information, we will notify the Data Protection Board of India and affected data principals as soon as practicable in accordance with applicable law, providing details of the breach, the categories of data affected, the likely consequences, and the mitigation measures we are taking.
Subject to applicable law (including the Digital Personal Data Protection Act, 2023), you have the following rights in respect of your personal data:
To exercise any of these rights, please write to support@thewaycube.com. We may need to verify your identity before responding.
We aim to acknowledge requests within seventy-two (72) hours and resolve them within the timelines prescribed by applicable law.
The Platform is intended only for users who are at least 18 years of age. We do not knowingly collect or process personal data of individuals under 18. If we become aware that we have inadvertently collected such data, we will take steps to delete it promptly.
If you believe a minor has provided personal data to us, please contact our Grievance Officer (Section 14).
In accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023, the contact details of our Grievance Officer / contact person for data protection matters are:
If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India established under the Digital Personal Data Protection Act, 2023.
We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or applicable law. The "Last Updated" date at the top of this Policy will indicate when it was last revised. Where changes are material, we will notify you through in-app notice, email, or other reasonable means. Continued use of the Platform after the effective date of any changes constitutes your acceptance of the revised Policy.