XPando Privacy Policy
Official privacy policy for XPando: 30-Minute Food & Grocery Delivery and XPando Partner / Delivery Fleet App.
Prominent In-App Disclosure: Precise and Background Location Access
XPando requires access to your device's geographical location (ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION, and where applicable ACCESS_BACKGROUND_LOCATION) to enable its core 30-minute hyperlocal delivery functionality:
Collected only while the app is active to automatically detect your delivery address, calculate restaurant/grocery store delivery radius, and show estimated arrival time for your 30-minute order. XPando does NOT collect customer location data in the background.
Collected in the background while the driver is on "Duty / Online Mode", even when the phone screen is locked or another GPS navigation app is active. This is strictly essential to route nearby delivery requests, enable live map tracking for customers, and calculate delivery partner distance payouts.
XPando never sells, trades, or leases user or driver location coordinates to external ad networks or commercial data aggregators.
1. Introduction & Overview Section 1
Welcome to XPando ("we", "our", "us", or "Platform"). XPando operates a hyperlocal quick-commerce application designed to deliver food, fresh produce, daily groceries, and merchant goods to customers' doorsteps within 30 minutes.
This Privacy Policy governs your use of the XPando mobile applications (Customer App and Delivery Partner App), our websites, and integrated ordering services. This document explains how we collect, store, safeguard, and process your personal and device data in accordance with Google Play Store Policies, India’s Information Technology Act (2000), and Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
2. Data We Collect & Collection Methods Section 2
A. Information Provided Directly by You
- Profile Details: Full name, mobile phone number, and optional email address.
- Delivery Coordinates: House/flat number, road/street names, landmarks, and drop-off instructions.
- Rider & Merchant Verification: Driving license, vehicle details, PAN card, Aadhaar (where mandated for KYC verification), and bank account details strictly for partner payout disbursements.
B. Automatically Collected Information
- Device & Identifiers: Device hardware model, Android OS version, IP address, and unique app installation IDs to secure sessions and detect multiple fake accounts.
- Log & Crash Metrics: Crash traces, app load times, and diagnostic telemetry for app stability and error recovery.
- Order History: Past grocery and food items ordered, timestamps, order amounts, and payment method identifiers.
C. Payment & Financial Data
XPando does NOT process or store payment card numbers, CVVs, or UPI PINs on our servers. All digital payments (UPI, Cards, Net Banking) are securely facilitated through RBI-licensed payment gateways and aggregators (e.g., Razorpay/UPI) ensuring full PCI-DSS level compliance. For Cash-on-Delivery (COD) orders, only the payable balance amount is logged.
3. Device Permissions & Purpose Specification Section 3
To comply with Google Play's Limited Use & Purpose Specification Requirements, XPando only requests permissions that are directly necessary for its 30-minute quick-commerce features:
| Permission Tag | Intended Usage & Justification |
|---|---|
| ACCESS_FINE_LOCATION | Determines precise customer drop-off pin to ensure 30-minute delivery routing accuracy. |
| ACCESS_BACKGROUND_LOCATION | Delivery Fleet App Only: Continuously relays rider GPS coordinates to customer tracking screens while app is backgrounded. |
| CAMERA | Optional: Used by delivery partners to snap contactless doorstep delivery proofs or scan QR codes. |
| POST_NOTIFICATIONS | Dispatches live delivery countdowns, rider assignment alerts, and OTP authentication updates. |
| CALL_PHONE / Masked Calling | Allows one-tap calling between customer and rider strictly via phone dialer using masked number systems. |
4. Account & Personal Data Deletion (Google Play Data Safety Requirement)
You have the absolute right to delete your XPando account and request complete erasure of your personal data.
Open XPando App → Go to Profile / Account → Select Settings → Tap Delete My Account → Verify with OTP to immediately purge your account.
Email us with your registered phone number. Your account and associated profile records will be permanently removed:
5. Third-Party Disclosures & Cloud Services Section 5
XPando shares information with third-party service providers solely to ensure order fulfillment and app reliability:
- Assigned Delivery Partners: Shared only customer delivery drop-off pin, address text, and order contents to execute the 30-minute delivery.
- Google Maps Platform: For geocoding addresses and calculating route duration.
- Firebase / Google Cloud: For database hosting, authentication, crash logs, and cloud messaging.
- RBI Regulated Payment Gateways: For processing online payments via UPI, Cards, and Netbanking.
6. Security Standards & Safeguards Section 6
XPando implements standard cryptographic protection, including HTTPS/TLS encryption for all data transmitted between the mobile application and cloud servers. Authentication sessions are secured with dynamic one-time passwords (OTP). We conduct routine security audits to prevent unauthorized data tampering or breaches.
7. Children's Privacy Protection Section 7
XPando is intended for general audiences aged 18 and older. We do not knowingly solicit or collect personal identifiable data from children under 13 years of age. If we learn that personal data of a minor has been gathered without parental consent, we take immediate measures to delete such data from our records.
8. Grievance Redressal & Contact Officer Section 8
Pursuant to Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the contact information of our designated Grievance Officer is:
App / Platform Name: XPando Quick Commerce
Designation: Legal & Grievance Redressal Officer
Official Support Email: support@xpando.in
Operational Headquarters: Dinhata, Cooch Behar, West Bengal - 736135, India
* Grievance acknowledgements are provided within 24 hours, with definitive resolutions dispatched within 15 working days.