Privacy Policy

Introduction

This Privacy Policy describes how ZORA Healthy Foods, a brand of MK Food Ventures (a sole proprietorship based in Coimbatore, Tamil Nadu) ("we", "our", "us") collects, uses, shares and protects your personal data when you use our website https://www.zorahealthyfoods.com/, the ZORA app and our WhatsApp number (together, the "Platform"). You can browse parts of the Platform without creating an account. We serve customers in and around Coimbatore only, and your personal data is stored and processed in India. By using the Platform, placing an order or subscribing to a plan you agree to this Privacy Policy and to our Terms & Conditions. If you do not agree, please do not use the Platform.

What we collect

We collect what we need to cook for you and bring the food to your door: your name, mobile number, delivery address and location pin, your meal preferences (veg or non-veg, allergies and anything else you tell us about your diet), your plan, delivery days and timing, your order and payment history, and the messages you exchange with us on WhatsApp. Payments are taken by our payment gateway partner; we receive a confirmation and a reference, never your card or UPI credentials. If you report a problem or send feedback we keep that too, so we can act on it.

How we use it

We use your personal data to prepare and deliver your meals, to run your subscription (skips, pauses, renewals, wallet credit and referrals), to take payment and issue invoices, to tell you about your delivery and to answer your questions. We may message you about our plans and offers on WhatsApp; reply or write to us at any time and we will stop. We never sell your personal data.

Sharing

Your delivery name, phone number and address are shared with the rider who brings your food — our own staff or a delivery partner we have engaged for that trip — and nothing more. Payments are processed by our payment gateway; WhatsApp messages travel through Meta's WhatsApp Business platform. We may disclose personal data to a government or law-enforcement body where the law requires it, and to protect the rights, property or safety of our customers, our staff or the public.

Analytics, Cookies and Third-Party Processors

We use a small number of third-party services to keep the Platform working and to understand how it is used. Cloudflare Turnstile checks that requests to our booking, ordering and account-recovery forms come from a person rather than an automated script; it is a security measure and runs on every visit. Sentry records technical errors so that faults can be found and fixed; error reports are stripped of names, phone numbers, addresses, delivery locations and payment or login credentials before they are sent. Microsoft Clarity records how pages are used, including anonymised session replays and heat maps of the public pages, and PostHog records which steps of the booking, ordering and sign-in journeys are completed, so that we can see where the Platform is confusing or broken. Clarity and Microsoft, and PostHog, act as our processors for this purpose and may store this information outside India.

PostHog is loaded only after you agree to it. When you first visit the Platform you are asked whether this measurement is acceptable; if you decline, or ignore the request, it is not loaded and no behavioural information is collected. Microsoft Clarity is used only on our campaign order pages (currently the Deepavali page), where it runs without asking: it sets no cookies and stores no identifier, so a visit is never linked to you or to your other visits, and all text on the page is masked. Fields that carry personal data — your name, phone number and delivery address — are masked before any session recording is made, and the events we record for these purposes deliberately carry no name, phone number, address or location. You can change your answer at any time by clearing this site's stored data in your browser, at which point you will be asked again. These services are not used at all on the staff and administrator areas of the Platform.

We also keep our own simple count of visits to the Platform, on our own servers and without any third party. For each visit we record the pages opened, the website or link that brought you here (including any campaign tag in that link and, when you arrive from an advertisement, the ad's own tags and the click identifier the ad platform adds to the link), the approximate city and region your internet connection reports, and whether you used a phone, tablet or computer. Your IP address is not stored, and the count carries no name, phone number or address; it is tied to a random identifier kept in your browser. If you are signed in to your customer account, open a personal link we sent you (such as a link to your bill), or enter your number in one of our checkouts, the visits from that browser are linked to you, so that our team can see what you were looking at and help you with it. This record never leaves our systems and is not shared with anyone, so it is not covered by the analytics prompt above. Clearing this site's stored data in your browser resets the random identifier.

When you go through one of our checkouts — buying a plan or ordering meals — we also keep, on our own servers, a record of that checkout: the steps you reached, the plan or meals you chose and their price, any error the checkout showed you, and whatever you typed into it — name, mobile number (complete or not), delivery address, location pin and, where the checkout asks for one, a gift message — even if you have not yet paid. We use it only to help you finish an order that did not go through, for example by calling or messaging you if the payment failed, and to find and fix problems with checkout. If you entered a valid mobile number and did not pay, our team may add you to our list of enquiries (or note it on your customer record) so that someone can follow up. It is linked to the same random identifier, never shared with a third party, and deleted 90 days after you last used that checkout if you did not buy.

Cookies and similar local storage are used to keep you signed in, to remember your choice about analytics, to hold the random identifier used for our visit count, and — once accepted — by the analytics services described above. Blocking them may prevent parts of the Platform from working.

Google Contacts Integration

Our staff can connect a single Google account belonging to our business to the Platform, so that the phones our team uses to answer calls show the name of the customer or enquirer who is calling. This feature is used only by our staff; customers are never asked to connect a Google account. When it is connected, the Platform requests access to Google Contacts (the People API) and to the email address of that Google account, which is shown on our settings screen so that our staff can see which account is connected.

We use this access only to create, update and delete contact cards for our own customers and enquirers in that account — their name, phone number and a short note such as their delivery area or plan of interest — and to create and find the "Zora Leads" and "Zora Customers" labels those cards are filed under. We do not read, copy, store or use any other contact in that Google account. Information received from Google is not sold, not used for advertising, not used to train artificial intelligence or machine learning models, and not shared with anyone, except as necessary to provide this feature, to comply with applicable law, or as part of a merger or acquisition with your notice. The only Google data we store is the connection credential, which is kept on our servers with access restricted to the Platform itself.

Zora's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Access can be withdrawn at any time by disconnecting the account on the Platform's settings screen, or from the Google account itself at https://myaccount.google.com/permissions. Disconnecting removes the stored credential immediately. Contact cards already created are left in the Google account and can be deleted there, and you may ask us to remove your own card using the contact information below.

Security Precautions

To protect your personal data from unauthorised access or disclosure, loss or misuse we adopt reasonable security practices and procedures. Once your information is in our possession or whenever you access your account information, we adhere to our security guidelines to protect it against unauthorised access and offer the use of a secure server. However, the transmission of information is not completely secure for reasons beyond our control. By using the Platform, the users accept the security implications of data transmission over the internet and the World Wide Web which cannot always be guaranteed as completely secure, and therefore, there would always remain certain inherent risks regarding use of the Platform. Users are responsible for ensuring the protection of login and password records for their account.

Security

We keep your data behind authenticated accounts with access limited to the staff who need it, over encrypted connections, and we follow reasonable security practices to protect it from unauthorised access, loss or misuse. No transmission over the internet is completely secure, so we cannot guarantee it; keep your login PIN to yourself and tell us at once if you think someone else has used your account.

Your rights, retention and deletion

You can see and correct your details, addresses and preferences from your account on the Platform, or ask us to do it. You may ask us to delete your account by writing to the contact below; we will do so unless an order, a refund, a dispute or a legal obligation requires us to keep a record, and we may keep anonymised figures for our own analysis. Otherwise we keep personal data only as long as we need it for the purposes above or as the law requires.

Consent and changes

By using the Platform or giving us your information you consent to its collection and use as described here. If you give us someone else's details — for a gift or a family member's plan — you confirm you have their permission. We may update this policy from time to time; the current version is always at https://www.zorahealthyfoods.com/privacy-policy, and we will tell you about significant changes.

Grievance officer

For any question, request or complaint about your personal data, contact the proprietor of MK Food Ventures at help@zorahealthyfoods.com or on +91 89256 43947 (Monday to Saturday, 9:00 AM – 7:00 PM IST), or write to ZORA Healthy Foods, No.29, Perumal Kovil Street, Marutham Nagar, Saravanampatti, Coimbatore - 641035. We acknowledge complaints within 48 hours and aim to resolve them within 30 days.