This policy explains how Sumeza Mastery Foods Private Limited (CIN U47214HR2026PTC151349, "Sumeza", "we") handles personal data collected through this website, sumeza.com. We are the Data Fiduciary for that data under the Digital Personal Data Protection Act, 2023 ("DPDP Act").

1. What we collect

When you…	We collect	Why (purpose)
Create a Sumeza account or sign in (sumeza.com/account or the Sumeza app)	Name, mobile number (checked with a one-time SMS code), email (checked with a one-time email code), a password (we store only a salted hash of it, never the password itself), saved delivery addresses; if you choose “Continue with Google”, your Google account’s email and ID; if you ask for a business account, the business details and location you give	To give you one account for the website and the app, sign you in securely (including a code by email when you sign in on a new device), fill in your details at checkout, show your orders, and show business pricing to approved business accounts
Place an order	Name, mobile number, email (optional), delivery address, pincode, slot, delivery notes, items ordered	To confirm, deliver and support your order, collect cash on delivery, issue invoices and handle cancellations, refunds and complaints
Ask for a call back, notify-me, enquiry, samples, product catalogue or contact form	Mobile number and email, plus anything else you choose to give (name, business details, city, pincode, message)	To reply to that request and follow up on it
Join the waitlist	Name, mobile number, pincode	To tell you about the launch and your founding-member benefit
Rate a product	Stars, comment, and optionally your name and mobile	To show product ratings (first name only, never your number) and improve recipes
Answer the feedback questions or tap "I'd try this"	Your answers; no name or number is asked	To decide what to make next
Visit with a campaign link	The campaign tags in the link (utm_source / medium / campaign)	To count which campaigns bring enquiries and orders

Our servers also receive standard technical data (IP address, browser type, time of request) to deliver the site, prevent abuse (for example rate limits on forms) and keep it secure.

2. No trackers, no tracking cookies

This site runs no advertising or analytics trackers and sets no tracking cookies. We count leads, orders and feedback ourselves, inside our own systems. Your browser stores a few things only on your device: your basket and a link to your last order (local storage), the campaign tags of your visit (session storage, cleared when you close the tab), whether you already tapped "I'd try this", and whether this device has signed in (a yes/no flag, nothing personal). You can clear them in your browser at any time.

When you sign in, our server sets one cookie: your sign-in session. It is strictly necessary, can't be read by scripts on the page (httpOnly), is sent only to sumeza.com, and ends when you sign out or after 30 days. Your details are loaded only after you sign in and are never stored in the pages themselves.

Every page, image, font and script is served from our own domain, and your browser doesn't contact any other company's servers while you use the site (apart from links you choose to open, such as Google Maps or LinkedIn), with one exception: the sign-in pages (sumeza.com/account). Only there, and only when you start a sign-in step: Google’s Firebase Authentication sends the SMS code to your mobile and runs reCAPTCHA to stop automated sign-ups (Google receives your mobile number and technical data such as your IP address and browser for this); and if you choose “Continue with Google”, Google Identity Services signs you in with your Google account. Google handles that data under its own privacy policy. No other page loads anything from Google.

When you send a form, a small calculation in your browser checks you’re not a bot; nothing is sent to anyone else, and no cookie is set.

Business enquiries (reserving early supply, the business enquiry, distributor and private-label forms) need your business location: your browser shares it only when you press “Share business location”, never on its own. We use it to check delivery and to plan a visit to your business (our server looks up the street address for it from OpenStreetMap, sending only the coordinates), and keep it with your enquiry for as long as we keep the enquiry. If you’re not at the business, we email you a link to finish the form there; we keep what you typed for up to 14 days for that. Photos of your business are optional; only our team sees them, inside our own system, and we remove the location data stored inside the photo file.

When you send a request (an enquiry, pre-order, notify-me or waitlist sign-up), we email you a receipt with its reference. Every email from us has a one-click unsubscribe link; after you use it we only write about a request you sent us.

We count what is typed in our search box, without knowing who typed it: only the words (with long numbers and email addresses removed), how many results there were, the page and the date.

3. Consent

Every form shows this consent text next to the submit button (version v1-2026-10): "I agree that Sumeza may contact me about this request. See Privacy Policy." We process the data you give in that form only for that request, and record the consent version with it. Order data is also processed because it is needed to perform the order and to meet legal obligations (for example tax records).

You can withdraw consent at any time by writing to the Grievance Officer below. Withdrawal doesn't affect anything already done, and we may still keep what the law requires us to keep.

4. Who we share it with

Our own team, only those who need it for your request or order.
Delivery partners, only the name, phone and address needed to deliver your order.
Service providers who host and run our systems for us (cloud hosting and email), under contracts that limit them to processing on our instructions.
Authorities, when the law requires it.

We do not sell your personal data, and we do not share it for anyone else's marketing.

5. How long we keep it

Orders and invoices: as long as Indian tax and company law requires (currently up to 8 years), then deleted.
Enquiries, call-back and notify-me requests: up to 2 years from our last contact with you, unless you become a customer or ask us to delete them sooner.
Waitlist: until launch communications are done or you ask to be removed.
Technical logs: a short period for security, typically up to 90 days.

6. Your rights

Under the DPDP Act you can ask us to:

tell you what personal data we hold about you and how it is used, and who we shared it with;
correct, complete or update it;
erase it, where we no longer need it for the purpose or by law;
stop contacting you (withdraw consent);
nominate someone to exercise these rights if you die or become unable to;
resolve a grievance about how we handled your data.

Write to the Grievance Officer below from the mobile number or email you used with us, so we can confirm it's you. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

7. Vendors and suppliers who register with us

When a business registers as a supplier on our vendor form at forms.sumeza.com:

What we collect: company name, contact person, mobile, email, city and state, GSTIN and PAN, the categories you supply and any notes you add — and later, during onboarding, KYC and bank documents.
Why: to evaluate and onboard suppliers, and to pay them.
Where: on forms.sumeza.com and in Sumeza Systems, our own management system. We don't share it, except with banks, government and tax authorities where the law requires.
How long: records of approved vendors are kept for 8 years for tax purposes; declined or unfinished registrations are deleted after 12 months.
Your rights: the rights in section 6 under the Digital Personal Data Protection Act, 2023 — write to accounts@sumeza.com.

8. Job applicants

When you apply through our Careers form (forms.sumeza.com), we collect what you send — your name, mobile, email, CV and answers — and use it only to consider you for a role. It stays on forms.sumeza.com and in our own systems and isn't shared outside Sumeza. If you're not hired we delete it within 12 months, unless you ask us to keep it for future roles. Your rights under the DPDP Act apply; write to accounts@sumeza.com.

9. Security

The site is served only over HTTPS, forms are protected against automated abuse, and personal data is stored in access-controlled systems where staff see only what their role needs. No system is perfectly secure; if a breach affects your data we will inform you and the Data Protection Board as the law requires.

10. Children

This site is meant for adults. We don't knowingly collect data from anyone under 18. If you believe a child has given us data, write to us and we'll delete it.

11. Contact & grievances

Grievance Officer: [PLACEHOLDER: Grievance Officer name], Grievance Officer
Email: accounts@sumeza.com
Sumeza Mastery Foods Private Limited, First Floor, Plot No. 235, Sector 8, IMT Manesar, Gurugram, Haryana 122051, India

We acknowledge every request within 48 hours and resolve it within one month. See Grievance Redressal.

12. Changes

If we change this policy we'll update the date above and, for significant changes, tell customers we have contact details for.