Wholesome food, effortless mornings
How TiffinTots collects, uses and protects your family's information. Last updated 23 October 2026.
TiffinTots ("TiffinTots", "we", "us") operates a school-lunch subscription service for families in Noida, Uttar Pradesh, India, through our website and app (the "Service"). This policy explains what personal data we collect from parents and account holders, why we collect it, and the choices you have. It is written to meet the requirements of India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), the rules made under it, and the Information Technology Act, 2000. Under the DPDP Act, we are the "Data Fiduciary" for your data.
Operating entity: Tiffin Tots (represented by its Proprietor) · Based in: Noida, Uttar Pradesh, India
Today, TiffinTots is a web app — it works in your phone or computer browser, and you can add it to your home screen as a progressive web app (PWA). Because it runs in your browser, we cannot read your contacts, photos, files, SMS or call logs. Your browser asks you before it shares your location or shows notifications, and you can say no.
Mobile apps are coming. We plan to launch Android and iOS apps, and this policy will cover them too — before they launch, we'll update this policy to list any new data they need, and tell you. This policy doesn't cover other websites we link to, such as our payment partner's checkout page — their own privacy policies apply there.
What we don't collect: we never see or store your card, UPI or bank details — you type those straight into Razorpay's secure checkout. We don't collect your child's date of birth, allergy or dietary information, photo, school records or health records, and we don't track your location in the background — only a map pin you choose to share. If your child has a serious or medically diagnosed allergy, we ask you to write to us directly at support@tiffintots.com rather than entering it in the app, so it's handled by a person, not stored as a data field.
We don't currently send promotional offers separate from your account updates. If that ever changes, we'll only send them with your consent, and you'll be able to opt out at any time without affecting your lunches.
We do not sell your personal data, and we do not use your child's information for advertising or to build profiles of your child.
With your consent, we send account and delivery notifications over WhatsApp using the Meta WhatsApp Business Platform, by email using our email provider, and by push notification through Firebase Cloud Messaging (Google). These are operational messages about your own account — meal credits, renewals, delivery status and similar — not third-party marketing. You can manage your channel preferences any time from Account → Notifications.
We share the minimum data needed with these service providers, strictly to operate TiffinTots on our behalf — none of them are permitted to use your data for their own purposes:
We may also disclose information where required by Indian law or a valid legal process.
All your data is stored on Google Cloud servers in India. Here's how long we keep each type — most of it is deleted automatically once its time is up:
We also keep backup copies so we can recover the Service if something goes wrong — point-in-time recovery covers the last 7 days, and weekly snapshots are kept for about 8 weeks. Data you delete may persist in these backups until they expire; if we ever restore a backup, we erase again any data you'd already asked us to delete.
If you delete your account, we erase your profile, addresses, meal plans, wallet history, notifications, messages and reviews. We separately keep the underlying payment/order records and processing logs described above, because accounting law and the DPDP Rules' log-retention requirement require it respectively, and anything else with a time limit above is still deleted once that time runs out. Any unused meal credits in your wallet are forfeited when you delete your account — please use them or request a refund under our Refund Policy first.
TiffinTots accounts are created and controlled by a parent or guardian — we do not knowingly collect information directly from children, and we do not allow a child to create their own account. We verify this in two layers before an account is ever created: (1) the signed-up adult must verify their own mobile number by one-time password (OTP), and (2) at the same sign-up step, they must explicitly confirm "I am the parent or legal guardian of the child this account is for" — a required checkbox, not a default or an inferred assumption. That confirmation is timestamped and kept as our record of consent. We ask only for your child's meal choices, provided by you — used solely to prepare the right lunch, never for advertising or to build a profile of your child.
Under the DPDP Act, you have the right to access your data and know who we've shared it with, correct or update it, erase it (unless the law requires us to keep it), withdraw consent at any time, nominate someone to exercise these rights on your behalf if you die or become unable to act, and to complain — to us first, and then to the Data Protection Board of India if we haven't resolved it. You can:
For any privacy request, correction or complaint we haven't resolved through the app, contact our Grievance Officer:
Mr. Piyush · Grievance Officer, TiffinTots
Email: support@tiffintots.com
Address: D-26, Sector 50, Noida, Uttar Pradesh 201301, India
We acknowledge your request within 7 days, and resolve it within 30 days of receipt.
We use industry-standard safeguards — access-controlled databases, encrypted (HTTPS) connections and role-based permissions — to protect your data. Riders can see your delivery details only for that day's delivery. Our payment pages are run entirely by Razorpay under PCI-DSS standards, so we never handle your raw card or bank details.
No system is perfectly safe. If a data breach ever affects you, we'll tell you and the Data Protection Board of India as the law requires, and explain what happened and what you can do.
Our website stores a small amount of data in your browser (such as your sign-in session and app preferences) to make the Service work, and functions as an installable app (PWA) with offline support. We don't use third-party advertising cookies.
We may update this policy as the Service evolves. We'll post the revised policy here with an updated "Last updated" date, and notify you of material changes through the app.
Questions about this policy or your data? Write to support@tiffintots.com or use our Contact page.