Legal
Privacy notice
Last updated: 7 October 2026
We collect only what we need to cook and deliver your food: your phone number (to sign you in), your name, your delivery address and, only if you want it, your email (receipts and delivery updates). We never sell data, we don't run ad trackers, and you can delete your account from My account at any time.
If you choose to switch on order-update notifications (a button on your order page, never pre-selected), we store your browser's push address to send you order status messages only. You can turn it off any time in My account, which deletes it. Photos you attach to a help request are used only to resolve that request. Location is used only to place your delivery pin and is not kept apart from your saved address.
1. Data fiduciary
REIKS RETAILS (OPC) PRIVATE LIMITED (trading as Wok Authority (by Karunwala)), New No 25, Sivan Kovil South Mada Street, Villivakkam, Chennai 600049, Tamil Nadu, India, GSTIN 33AANCR1058F2ZG ("we", "us") operates wokauthority.com and its apps (the "Site"). Data questions and grievances: Karun Aditya Mohanavel (Director), karunaditya@wokauthority.com, 63851 10369.
2. What we collect and why
| Data | When | Why (purpose) | Kept for |
|---|---|---|---|
| Mobile number | When you sign in with an OTP | Signing you in; contacting you and the rider about your order | until you delete your account |
| Name; email (optional) | First sign-in | Order confirmation, delivery updates, receipts; confirming the address is yours | until you delete your account |
| Delivery address and map pin (latitude/longitude) | At checkout, and if you choose to save it | Checking we deliver there, quoting the delivery fee, giving the rider your door | until you delete your account |
| Order details, amounts, payment status, order code | Every order | Preparing and delivering the order; refunds; GST invoices and accounts | 8 years (GST and accounting records), with personal fields anonymised on account deletion |
| Where you scanned our QR code (e.g. "poster") | If you arrive via a QR link | Knowing which posters and flyers work; not linked to advertising | With the order |
| Server logs (IP address, browser, pages, time) | Every visit, automatically | Security and diagnosing errors | up to 1 year |
Payment card and UPI details are entered on Cashfree's secure page and never reach our servers; we receive only a payment reference and status. Cookies: we set one sign-in cookie and store your cart on your device. We use Google Analytics to understand how visitors use our site (pages viewed, items added to cart, orders). It sets analytics cookies. We do not use advertising cookies or sell your data.
3. Consent
When you create your account you tick a box agreeing to this notice; we record when you did and which version. Consent is the legal basis for storing your contact details and addresses. You can withdraw it at any time by deleting your account (My account → Delete my account), after which we stop processing your personal data except where the law requires us to keep accounting records (section 2 above).
4. Who else sees your data (processors)
- Firebase (Google) — sends the OTP and verifies your phone number.
- Supabase — hosts our database (orders, accounts, addresses) with row-level security so you can only read your own orders.
- Cashfree Payments — processes online payments and refunds.
- Resend — sends our order emails from orders@wokauthority.com.
- Our third-party delivery partners (hyperlocal logistics providers) and their riders — receive your name, phone, address and map pin to deliver the order.
- OpenStreetMap — map tiles and address lookup for the pin (your approximate coordinates are sent to look up the pincode).
- Railway / Cloudflare — hosting and DNS. Servers may be located outside India; transfers are to countries not restricted by the Government of India under the DPDP Act.
Each processor acts only on our instructions and under its own security obligations. We do not sell or rent personal data to anyone.
5. Ordering through Zomato or Swiggy
When you tap "Order on Zomato" or "Order on Swiggy" you leave this Site. Data you provide there is processed by that platform under its own privacy policy; it shares with us only what is needed to cook and hand over the order.
6. Your rights (Digital Personal Data Protection Act, 2023)
- access a summary of the personal data we hold about you (My account shows it; email us for a copy);
- correct or update it (edit your profile and addresses in My account);
- erase it (My account → Delete my account, or email us) — orders are kept in anonymised form for accounting;
- withdraw consent at any time, as easily as you gave it;
- nominate another person to exercise these rights for you;
- raise a grievance with us and, if unresolved, with the Data Protection Board of India.
Write to karunaditya@wokauthority.com from the email on your account (or quote your phone number). We acknowledge within 24 hours and respond within 15 days; the statutory ceiling is 90 days.
7. Children
The Site is intended for adults. We do not knowingly collect data from anyone under 18 and we do not target advertising at children.
8. Security
HTTPS everywhere, httpOnly sign-in cookies, row-level security in the database, secrets kept out of the browser, two-factor authentication for administrators, and an audit log of staff actions. If a breach ever affected you, we would tell you without delay and report it to the Data Protection Board as the law requires.
9. Changes
If this notice changes materially we will update the date at the top and ask for consent again where required. Last updated 7 October 2026. See also our terms and cancellation & refund policy.