Privacy Policy

This policy applies to everyone who uses The Kindness App, across all roles. Different roles share different information with us, so where it matters we call out what applies to you specifically:

• Donors— people who give funds or pay it forward, and who can also redeem meal credits (there is no separate “recipient” account type — anyone can walk in and enjoy a meal).
• Restaurants — kitchens that prepare and serve meals and receive payouts.
• Community Partners — non-profits and community organizations.
• Influencers — people who run campaigns and direct allocations.
• Admins — SEVA staff who operate, moderate, and review the platform.

[PLACEHOLDER — REVIEW: confirm this is the complete list of roles and that no other party (e.g. corporate sponsors) collects data through SEVA]

We collect only what we need to run the service, verify the businesses we pay, move donations safely, and prevent fraud. What we collect depends on your role.

2.1 Account information (all roles)

Name, email address, phone number, country, password (stored hashed), role, and the contents of your profile. Created when you sign up and updated as you use the app.

2.2 Donation details & beneficiary information (donors)

When you give, we keep a record of the donation — amount, currency, date, which campaign or pool it went to, and its status. If you create a campaign for someone else, you can optionally provide details about the beneficiary: their name, email address, mobile number, and address. We use beneficiary details only to run that campaign (for example, to let the beneficiary choose a restaurant).

If you provide information about another person, you are responsible for having their permission to share it with us. [PLACEHOLDER — REVIEW: whether SEVA must notify beneficiaries directly that their data was provided, and the lawful basis for processing third-party beneficiary data in each jurisdiction]

2.3 Location information (meal offers & proximity eligibility)

If you opt in to being offered nearby meals, we collect your physical location — an address or map position you provide, which we convert to coordinates using a third-party geocoding service (see §4.6). We use it solely to work out which funded meals are close enough to offer you, and to match restaurants to nearby neighbours. We do not track your device’s live location in the background.

[PLACEHOLDER — REVIEW: confirm final location UX (user-typed address vs device geolocation prompt), the precision stored, whether location is treated as sensitive data in target jurisdictions, and how a user removes their stored location]

2.4 Verification & KYC information (restaurants & community partners)

To verify a business before it can receive funds, we collect government and tax identifiers and supporting documents. In India this includes the FSSAI licence number, PAN, annual turnover band, and — where applicable — the GSTIN, along with uploaded copies of the FSSAI certificate, PAN card, GST certificate, and bank/UPI proof. Outside India, equivalent business identity and tax details apply.

[PLACEHOLDER — REVIEW: confirm exact KYC fields collected per country, and whether any recipient-side identity data is collected for redemption/anti-fraud]

2.5 Payment & payout information

For donations and payouts we rely on third-party payment processors (see §4). Card and bank details are entered directly with those processors through their secure onboarding and are not stored on SEVA’s servers. We retain transaction records — amounts, dates, status, and the processor’s reference IDs — needed to operate the service and meet accounting and legal obligations.

2.6 Usage & device information

Basic technical data created when you use the app: log records, IP address, device and browser type, and in-app activity (for example, campaigns viewed, donations made, credits redeemed). Used for security, debugging, and improving the service.

[PLACEHOLDER — REVIEW: confirm analytics/telemetry tooling in use]

2.7 SMS & phone-verification data

If you choose to claim a meal, we ask you to verify your mobile number — that verification step is where you opt in to receiving text messages from us. We collect your mobile number, its verification status and timestamp, and a record of your consent. We use this to send verification codes and, where you have opted in, service messages such as meal-offer alerts. Message and data rates may apply. You can opt out of texts at any time by replying STOP, or reply HELP for help.

Your mobile number and SMS opt-in data are not shared with third parties or affiliates for marketing or promotional purposes. SMS consent is never sold, rented, or transferred for anyone else’s marketing.

[PLACEHOLDER — REVIEW: confirm consent-record retention period and per-market SMS disclosure requirements (US CTIA / TCPA, Canada CASL, India DLT)]

• Provide the service — create and manage your account, run campaigns, issue and redeem meal credits, and show your impact.
• Verify businesses — confirm that restaurants and organizations are legitimate before they can receive funds, using the identifiers and documents in §2.2.
• Process donations & payouts — move funds from donors to kitchens through our payment processors.
• Offer nearby meals — use the location you share (§2.3) to work out which funded meals and restaurants are close enough to offer you.
• Prevent fraud & abuse — detect suspicious activity, enforce our terms, and keep the platform safe. This includes verifying one phone number per account before a meal credit can be accepted.
• Communicate — send service messages, verification updates, and notifications you’ve enabled.
• Meet legal obligations — comply with tax, accounting, and regulatory requirements.

[PLACEHOLDER — REVIEW: confirm legal basis for each purpose (consent, contract, legitimate interest, legal obligation) per applicable jurisdiction]

We share the minimum necessary data with trusted service providers who process it on our behalf, under contract, only for the purposes below. We do not sell your personal information.

4.1 Verifico and SurePass — business verification (India only)

[PLACEHOLDER — REVIEW: confirm the contractual chain. Our agreement with Verifico must cover the onward transfer to SurePass and state a retention period for each. The Verifico–SurePass relationship described below is documented by the vendor, not independently observed by us. Confirm also which API host is canonical — Verifico publishes three — before any identifier is transmitted.] When a restaurant or organization onboards in India, we verify its government and tax registrations. The FSSAI licence number, PAN and GSTIN you provide are sent to The Verifico (theverifico.com), our verification provider for India.

Verifico is an aggregator rather than the source of the verification: it obtains the result from SurePass, another Indian verification provider — Verifico’s own API specification describes the data it returns to us as SurePass fields. SurePass in turn checks each number against the Indian government registry that holds it: FoSCoS for FSSAI licences, NSDL for PAN, and GSTN for GSTIN.

The identifiers you provide therefore reach three parties beyond us — Verifico, SurePass, and the relevant government registry. What comes back to us is only a verification result: whether the registration exists, its status, and the name recorded against it.

This is used solely to confirm that a business is legitimate before it can receive funds. Neither Verifico nor SurePass uses this data to provide services to you directly.

This registry check applies to India only. Businesses onboarding elsewhere are still screened, but differently: the licence or registration document they upload goes through the AI document pre-screen described in section 4.4 below, and is reviewed by a person. No registry lookup is performed for them, and neither Verifico nor SurePass receives their data.

4.2 Stripe — payments & payouts (North America)

For donors and restaurants in North America, payments and payouts are handled by Stripe through its secure onboarding. Card and bank details are entered directly with Stripe and never touch our servers; we receive only transaction records and status. Stripe processes this data as an independent controller under its own privacy policy for the payment activity it performs.

4.3 India payout processor

[PLACEHOLDER — REVIEW: India payout processor not yet selected. Add provider name, what data is shared, role (processor / controller), and link to their privacy policy once chosen.]

4.4 Anthropic — AI document pre-screening

To help our team review uploaded verification documents, we use Anthropic’s AI models to perform an automated pre-screen (including reading text from documents via OCR). This is an assistive step only: the AI does not make verification or approval decisions — a human admin always makes the final call. Document contents may be transmitted to Anthropic for this processing.

[PLACEHOLDER — REVIEW: confirm Anthropic data-retention / no-train terms and that the “assist-only, human decides” description is accurate]

4.5 Supabase — data storage & infrastructure

Your account data and uploaded documents are stored using Supabase, our database, authentication, and file-storage provider. Documents are kept in private storage accessible only to you and authorized members of our verification team.

[PLACEHOLDER — REVIEW: confirm hosting region(s) and sub-processor list; add any other infrastructure providers (e.g. hosting, email, push notifications)]

4.6 Geocoding provider — location lookup

When you share a location to be offered nearby meals (§2.3), we send the address or place you provide to a third-party geocoding service, which returns map coordinates. Only the address/place text is shared — not your name or account details.

[PLACEHOLDER — REVIEW: geocoding provider not yet selected (Google Maps Platform or Mapbox under evaluation). Add the provider name, their processor/controller role, retention terms, and privacy-policy link once chosen — before the location feature goes live.]

Beyond the processors above, we may share information: with other users only as needed for the service to work (for example, a restaurant sees a redemption); to comply with the law, a court order, or a lawful government request; to protect the rights, safety, and property of SEVA, our users, or the public; and in connection with a merger, acquisition, or sale of assets, subject to this policy.

[PLACEHOLDER — REVIEW: confirm exactly what is visible between roles (donor ↔ recipient ↔ restaurant) and whether any donor or recipient identity is shown publicly]

We keep personal information for as long as your account is active and as long as needed to provide the service. We keep verification and transaction records longer where required to meet legal, tax, and accounting obligations, after which we delete or anonymize them.

[PLACEHOLDER — REVIEW: define concrete retention periods per data category (KYC docs, transaction records, account data, logs)]

Depending on where you live, you may have the right to access, correct, update, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. You can update much of your account information directly in the app, or contact us using the details in §11.

[PLACEHOLDER — REVIEW: confirm how requests are verified and fulfilled, response timelines, and any limits where data must be retained for legal reasons]

SEVA operates across more than one country, and some of our processors are located outside the country where you live. This means your information — including verification data collected in India — may be transferred to, stored in, and processed in other countries whose data-protection laws may differ from your own. Where we make such transfers, we put appropriate safeguards in place.

[PLACEHOLDER — REVIEW: specify which countries data is transferred to/from (India ↔ operating country/hosting region) and the legal transfer mechanism relied on]

If you are in India, the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) gives you specific rights over your personal data, and places specific obligations on us as a Data Fiduciary, including in relation to notice, consent, and grievance redressal.

[PLACEHOLDER — REVIEW: legal to confirm DPDP Act obligations — consent-notice wording, Data Fiduciary details, Consent Manager (if any), data-principal rights mechanism, and grievance-officer requirements]

Depending on where you live, additional or different data-protection laws may apply to you (for example, GDPR in the EU/UK, or US state-level privacy laws), giving you further rights and us further obligations.

[PLACEHOLDER — REVIEW: legal to confirm jurisdiction-specific requirements for every market SEVA operates in, and add the corresponding rights/obligations sections]

We use cookies and similar technologies to keep you signed in, run the app securely, remember your preferences, and understand how the service is used. You can control cookies through your browser settings, though some features may not work without them.

Text messages: we send SMS only after you opt in by verifying your mobile number (see §2.7) — verification codes and, where opted in, service messages like meal-offer alerts. Reply STOP to any message to opt out, or HELP for help; message and data rates may apply. We do not share your mobile number or SMS opt-in data with third parties or affiliates for marketing or promotional purposes.

[PLACEHOLDER — REVIEW: confirm exact cookies/SDKs used (essential, analytics, etc.) and whether a cookie consent banner is required]

For any questions about this policy or your personal data, or to make a privacy request, you can reach us at:

[PLACEHOLDER — REVIEW: real privacy contact email / address]

If you are in India, you may also contact our Grievance Officer:

[PLACEHOLDER — REVIEW: Grievance Officer name, designation, email, and address as required under the DPDP Act / IT Rules]

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, where required, notify you. Your continued use of the service after an update means you accept the revised policy.