1. Who we are
Aandhipe ("Aandhipe", "we", "us") is operated by BNPRS, Private Limited,registered at #5-216/1-3, AI Technology Park, Amalapuram, Konaseema, 533201, Andhra Pradesh, INDIA..
This policy explains what personal data the Aandhipe Android app collects, why we collect it, who we share it with, and the rights you have over it. It is written for consumers who use the Aandhipe Android app. Merchants who sell through Aandhipe are covered by a separate merchant agreement.
2. What this policy covers
Aandhipe is a platform app. Inside it you'll find "mini apps" — independent storefronts built and operated by individual merchants. This policy covers the data Aandhipe collects and how we handle it.
It does not cover what a merchant does with data you give their mini app directly. Section 7 explains that boundary in detail, because it's the most important thing to understand about how this app works.
3. Information we collect
3.1 Information you give us
Account details. Your name, email address, phone number, and — if you choose to provide it — your date of birth. Your email address is your login identifier and is verified with a one-time code. Your phone number is verified with a one-time code before it is stored against your account.
Password. If you register with an email and password, your password is stored only as a cryptographic hash by our identity provider. We cannot read it, and no Aandhipe employee can retrieve it.
Google account details. If you sign in with Google, we receive your name and email address from Google to create or match your account. We do not receive your Google password.
Support communications. Anything you send us — a support request, a complaint, a message about your account.
3.2 Information we collect automatically
Transaction data. Orders you place, payments you make, refunds you receive, and their status and timestamps.
Payment method details. Payment itself happens inside the app through Razorpay's own Standard Checkout, embedded directly as an SDK — we never see your full card number, CVV, UPI PIN or bank credentials at any point. After a payment completes, we receive and store limited details from Razorpay describing how it was paid: the payment method (UPI, card, netbanking), the UPI ID (VPA) used, the bank code, and — for cards — only the last four digits, the network, the card type and the issuing bank. Any phone number or email address Razorpay returns alongside a payment is masked before we store it.
Device and technical data. Device manufacturer and model, device type, operating system version, app version, and a randomly generated device identifier that we create ourselves on first launch. This identifier is not your Android ID, advertising ID, IMEI, or any hardware serial — it is a random value that exists only to distinguish your sessions and is discarded when you delete your account.
Session and security data. Your IP address, sign-in and sign-out times, and session duration. We show this back to you in the app so you can see every device signed into your account and sign one out remotely.
Push notification token. If you enable notifications, a push token issued by Google Firebase Cloud Messaging.
Mini app usage data. When you open a mini app, we record which mini app and version you opened, how you entered it, the session identifier, and how long the session lasted. We use this to operate the platform, bill merchants, and investigate abuse.
Diagnostics and crash data. If the app crashes, we may collect a crash report through Google Firebase Crashlytics, including the device state at the time of the crash and an identifier linking it to your account so we can investigate a problem you report.
3.3 Information we collect only with your permission
Precise location. Some mini apps need to know where you are — to show nearby stores, calculate delivery, or locate a rental vehicle. When a mini app asks, Android will prompt you, and you can refuse. If you allow it, we obtain your device's precise latitude and longitude (via Google's Fused Location Provider) and convert it into a readable address, then pass it to the mini app that asked for it. Aandhipe does not store your location on our servers. We do not collect location in the background, and the app never asks for background location permission.
Camera. Used only to scan QR codes when a mini app requests a scan. Scanning and decoding happens on your device using Google's ML Kit barcode-scanning library — the camera image is processed locally and discarded immediately. No photo, video, or image is ever stored, uploaded, or transmitted.
Notifications. Used only to display messages a mini app sends you while you're using it.
You can withdraw any of these permissions at any time in your device's Android settings. Withdrawing a permission stops the related feature from working but does not affect the rest of your account.
4. Why we need each permission
| Permission | Why |
|---|---|
| Internet, Network state | To communicate with our servers and detect connectivity |
| Precise & approximate location | To give a mini app your location when it asks and you agree |
| Camera | To scan QR codes on request |
| Notifications | To show messages from a mini app you're using |
| Vibrate | Haptic feedback during checkout |
We do not request, and the app does not contain, any permission to read your SMS messages, your call log, your contacts, your photos, or your files.
5. How we use your data
- To create and run your account — sign-in, checkout, order history, refunds
- To process your payments through Razorpay
- To pass a mini app the information it needs to serve you (see Section 7)
- To verify your identity and prevent fraud on a platform that moves real money
- To notify you about things that need telling — an order confirmed, a refund issued
- To respond when you contact support
- To keep the platform secure — rate limiting, abuse detection, audit logging
- To meet our legal, tax, and financial-record obligations
We do not use your data for advertising. This app contains no advertising SDKs and no ad-tracking. We do not sell your personal data, and we do not share it with data brokers.
6. Legal basis
We process your data because it is necessary to provide the service you asked for, to comply with Indian law (including tax and financial record-keeping obligations), and — for location, camera and notifications — on the basis of the consent you give at the time, which you can withdraw.
7. Mini apps — please read this section
Each mini app inside Aandhipe is an independent merchant's own storefront. It is their software and their business. When you open one and use it, the following happens:
What we pass to a mini app automatically:
- Your name
- Your phone number
- An Aandhipe user identifier (an internal ID specific to our platform)
What we pass only after you agree to a prompt:
- Your precise location and the address it resolves to
What we never pass to a mini app:
- Your email address
- Your date of birth
- Your password
- Your login token or any authentication credential
- Your payment card or bank details
- Any identifier that would let a merchant track you across other services
Once a merchant's mini app receives your name, phone number or location, that merchant is an independent controller of that data and their own privacy practices apply to it. We require merchants by contract to handle it lawfully and only for fulfilling your order, and we can suspend or remove a mini app that breaches that — but we cannot control what they do after the fact in the way we control our own systems.
Data a mini app stores on your device. A mini app can save data locally on your phone, in a sandbox that only that mini app can read. Another mini app cannot access it. This data never leaves your device through us and is deleted when you clear the app's data or uninstall Aandhipe.
Clipboard. A mini app can copy text to your clipboard — for example an order reference. It cannot read your clipboard.
8. Who we share your data with
Merchants and their mini apps — as described in Section 7.
Razorpay Software Private Limited — our payment processor. Every payment on the platform runs through Razorpay's Standard Checkout SDK, embedded directly in the app. The details needed to complete your payment are shared with them, and Razorpay's own privacy policy governs what they do with it. Razorpay is regulated by the Reserve Bank of India.
Google LLC — for Google Sign-In (if you use it), Firebase Cloud Messaging (push notifications), Firebase Crashlytics (crash diagnostics), and Google Play Services location (Fused Location Provider) and ML Kit barcode-scanning libraries — the last of these processes entirely on your device and sends nothing to Google.
Service providers who help us operate — for example our hosting provider and our transactional email provider. They see only what they need for that one job, under contract, and cannot use it for anything else.
Law enforcement or regulators, only where we are required to by valid legal process, and only to the extent required.
A successor entity, if our business is merged or acquired — in which case we will notify you and this policy will continue to apply until replaced.
9. How we protect your data
- All communication between the app and our servers uses HTTPS. The app refuses unencrypted connections outright in its production build.
- Passwords are stored only as hashes, by our identity provider, and are never readable by us.
- Sensitive identifiers we hold are encrypted at rest.
- Payment contact details returned by Razorpay are masked before storage.
- Every account action — a profile change, a refund, a deletion — is written to an audit log recording who did it and when.
- Access to production systems is restricted to staff who need it.
No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the Data Protection Board of India as required by law.
10. How long we keep your data
| Data | Retention |
|---|---|
| Orders, payments, refunds | As long as Indian tax and financial regulation requires — currently 5-8 Years — even after you close your account |
| Profile data (name, phone, email, date of birth) | Until you delete your account, then erased or anonymised immediately |
| Session and device records | Deactivated and cleared on account deletion |
| Audit logs | Retained without personal identifiers |
| Crash diagnostics | Retained by Firebase for up to 90 days |
Financial records survive account deletion because the law requires it — but once your account is deleted they are no longer linked to information identifying you.
11. Your rights
Under India's Digital Personal Data Protection Act, 2023, you have the right to:
- Access — get a summary of the personal data we hold about you and who we've shared it with
- Correct or complete — fix inaccurate or incomplete data
- Erase — have your personal data deleted, subject to our legal retention obligations
- Withdraw consent — for location, camera or notifications, at any time, through Android settings
- Nominate — appoint someone to exercise your rights if you die or become incapacitated
- Grievance redressal — raise a complaint with us and receive a response (see Section 14)
You can review and correct your profile in the app at any time. For anything else, contact us at support@bnprs.in and we will respond within [30] days.
12. Deleting your account
In the app: Profile → Delete Account.
From the web, without installing the app: Click here
Deleting your account will:
- Erase or anonymise your name, phone number, email address and date of birth immediately
- Sign out and close every active session
- Deactivate your registered devices and clear your push tokens
- Remove your identity from our authentication system
Your order and payment records remain, because the law requires the financial record to survive — but they are no longer linked to information identifying you. This cannot be undone.
13. Children
Aandhipe is a payments platform and is not directed at, or intended for use by, anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
14. Grievance Officer
As required by Indian law, our Grievance Officer is:
Name: Murali Krishna Dodda
Designation: Head of Technology
Email: krishna@bnprs.in
We will acknowledge a complaint within 48 hours and resolve it within 30 days.
If you are not satisfied with our response, you may escalate to the Data Protection Board of India.
15. Where your data is stored
Your data is stored on servers located in India. Some of our service providers — including Google and Razorpay — may process data outside India. Where that happens, we ensure appropriate safeguards are in place.
16. Changes to this policy
If this policy changes, we'll update the date at the top. Where a change materially affects your rights, we'll tell you directly through the app before it takes effect.
17. Contact
Privacy questions and data requests ,General support: support@bnprs.in
Postal: #5-216/1-3, AI Technology Park,
Amalapuram, Konaseema, 533201,
Andhra Pradesh, INDIA.