Privacy Policy

1. Who we are

BlendU (also written VBlendU) is a snack ordering platform operated by Sky Blend Ventures, a business based in Kallakurichi, Tamil Nadu, India. In this policy, “we”, “us” and “BlendU” mean Sky Blend Ventures.

This policy explains what personal information the platform collects, why we collect it, who else sees it, how long we keep it, and what you can ask us to do with it. It covers the website at vblendu.com and the three kinds of account the platform supports: individual customers, retail (business) customers, and delivery or distribution partners.

It is written for India and follows the Digital Personal Data Protection Act, 2023 (DPDP Act). We have tried to keep it plain and specific rather than long and vague.

2. The short version

3. What information we collect

Individual customer accounts

If you sign up to order for yourself, we store:

• Your email address, which is also how you sign in.
• Your password, stored only as a bcrypt hash. We never store or see the password itself, and it is never returned by any part of the site.
• A display name, and optionally a separate contact name.
• Your phone number.
• Your city.
• A delivery address, if you save one to your profile or enter one at checkout.
• The date the account was created, and whether the account is active.

Each order keeps a copy of the delivery address as it stood when you placed that order, so changing the address on your profile never rewrites where a past order was sent.

Retail (business) accounts

Retail accounts are opened by our team rather than by self sign-up. For each one we store:

• The business name.
• A contact email address, which is also the sign-in name.
• A password, again stored only as a bcrypt hash.
• A contact phone number. This is unique across retail accounts, so it also acts as the identifier that links a business to its orders.
• The business address.
• The date the account was created, and whether it is active.

Delivery and distribution partner accounts

Partner accounts (distributors and transporters) are also created by our team. For each partner we store a name, an email address used to sign in, a bcrypt password hash, a phone number, whether the partner is a distributor or a transporter, whether the account is active, and the date it was created.

Partners see a deliberately limited view of each order, matched to the job they do. A distributor, who only packs the carton, sees no address and no contact number — only the town or city an order is headed for. A transporter, who has to find the door, also sees the delivery address and a contact phone number. Neither sees your email address or any payment reference.

Orders

For every order we store an order number, the products and quantities, the unit price and line total captured at the moment you ordered (a price snapshot, so a later price change does not rewrite your history), the order total, the current status, whether it has been paid, and the times it was created and last updated.

Retail orders can also carry an optional free-text note you type at checkout, up to 2,000 characters. Because we cannot know what you will write there, please do not put sensitive personal information in it.

Order status history

Every change to an order writes a permanent row to an order timeline: the status it moved from and to, who made the change (an admin, a distributor, a transporter, you, or the system), their account identifier, a snapshot of their name at the time, an optional note such as the reason a delivery failed, and the exact time. The name snapshot keeps a past timeline accurate even after a name changes or an account is removed. This history is what shows you the tracking steps on your order page, and what we use to resolve disputes about what happened to an order.

Payments

Payments are processed by Razorpay. When you pay, the card, UPI, wallet or netbanking details are entered inside Razorpay’s own checkout window and are sent to Razorpay, not to us.

Product images

Product photos are uploaded by our team, stored in Cloudflare R2 object storage and served from cdn.vblendu.com. Customers and partners cannot upload images to the platform, so no customer photos are stored anywhere.

Technical information

Our server keeps ordinary operational logs: the type of request, the address it was sent to, the response code, how long it took, and any error. They are used to keep the service running and to investigate faults — never to build a profile of you, and never shared for advertising.

What we do not collect

To be explicit, the platform does not collect any of the following:

• Location or GPS data.
• Government identifiers such as Aadhaar or PAN.
• Biometric data.
• Advertising identifiers, or any record of your browsing on other websites.
• Any marketing or behavioural profile.

4. How we use your information

We use what we collect for these purposes and no others:

• To create and run your account, and to sign you in securely.
• To take, process, pack, dispatch and deliver your orders.
• To take payment and, where necessary, to issue a refund.
• To contact you about a specific order, or to answer a question you have asked us.
• To keep the accounting, tax and dispute records that a business in India is required to keep.
• To keep the platform secure — for example, to detect and block fraudulent or abusive requests.

We do not use your information for advertising, profiling, automated decision-making, or to build any kind of behavioural score.

5. Our basis for processing

Under the DPDP Act, we process your personal data on the basis of the consent you give when you create an account and place an order, having been told through this policy what we collect and why.

Some processing continues after that consent is withdrawn, but only where the law requires it — mainly the retention of order, payment and tax records described in section 9.

6. Who else sees your information

Inside BlendU, order information is visible to our own administrators, and the restricted view described in section 3 is visible to the distribution or delivery partner handling your order.

Outside BlendU, three service providers are involved:

Each provider handles data under its own privacy policy and its agreement with us, and some operate servers outside India; any such transfer is solely for the purpose above. We may also disclose information where we are legally required to — for example, in response to a valid order from a court or a government authority.

7. Messages we send

The platform sends automated alert emails to our own internal admin mailbox when a customer registers, when an order is placed, and when a payment succeeds or fails. Each of those names the single customer whose order needs attention, because someone has to act on it.

Once a week it also sends a summary of the week’s orders to that mailbox. The weekly email carries aggregate figures — order counts and revenue — and a per-order line showing the order number, status, amount and time. It deliberately contains no customer names, email addresses, phone numbers or delivery addresses, and no attachment. A detailed export that does contain customer information is not emailed to anyone: an authorised administrator downloads it on demand from the admin dashboard, behind a login.

These messages go to us, not to you. At present the platform sends no automated email to customers, retailers or partners at all — when we need to reach you about an order, a person contacts you directly. Our outgoing mail is delivered through Google’s Gmail service, so those internal messages pass through and are stored on Google’s servers.

We send no WhatsApp messages today. We may introduce WhatsApp order updates in future, and if we do they will go only to customers who have given explicit consent for them, and you will be able to opt out at any time.

8. Cookies

We use a small number of cookies, and every one of them is strictly necessary for the site to work. There are no advertising cookies, no analytics cookies and no tracking pixels.

All four are httpOnly, meaning no script running in the page can read them, and in production they are marked Secure so they are only ever sent over an encrypted connection. Signing out deletes your session cookie.

9. How long we keep things

• Account details are kept for as long as your account exists.
• Orders, their line items, their payment references and their status timeline are kept for at least eight years after the order, because Indian accounting and tax law requires a business to be able to produce its transaction records for that period.
• Server logs are short-lived and kept only for operational troubleshooting.
• Internal alert emails and weekly summaries sit in our own mailbox and are cleared periodically.

If you ask us to delete your account, we deactivate it and remove the personal details we are not required to keep. The underlying order and payment records remain for the statutory period described above.

10. How we protect your information

• Passwords are stored only as bcrypt hashes and are never returned by any part of the site, even to our own administrators.
• Sign-in sessions use httpOnly cookies that scripts in the page cannot read, and every action that changes data is protected by a CSRF token.
• The site is served over HTTPS with strict transport security, a Content Security Policy, and headers that stop it being framed by other sites.
• Payment signatures from Razorpay are verified with a constant-time comparison before any order is marked paid.
• The connection between our application and its database is encrypted, and sign-in attempts are rate limited to slow down password guessing.

No system is perfectly secure. If you believe your account has been accessed by someone else, contact us straight away using the details in section 14.

11. Your rights

Under the DPDP Act you have the right to:

• Ask for a copy of the personal data we hold about you and a summary of how it is being processed.
• Have inaccurate or incomplete data corrected or completed.
• Ask for your data to be erased, subject to the record-keeping obligations in section 9.
• Withdraw a consent you gave, as easily as you gave it.
• Nominate another person to exercise these rights on your behalf if you die or become unable to do so.
• Raise a grievance with us and have it addressed.

While you are signed in, you can update your own name, contact name, phone number, city and delivery address from your profile page.

For anything else, email support@vblendu.com or call +91 95352 17276. Please tell us the email address on the account and, if your request is about a specific order, the order number, so we can find the right records and be confident we are talking to the right person. We will respond within 30 days.

We handle deletion and data-copy requests manually — the platform does not yet have a self-service button for either. That does not change your rights, only the route to exercising them.

If you are not satisfied with how we have handled a request, you may complain to the Data Protection Board of India.

12. Children

BlendU is intended for adults and for businesses. We do not knowingly open accounts for, or collect personal data from, anyone under 18.

The DPDP Act requires verifiable parental consent before a child’s data is processed, and prohibits tracking, behavioural monitoring and targeted advertising to children. We do none of those things for anyone, of any age. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

As the platform grows, this policy will change. When it does we update the date at the top of the page, and where a change materially affects how we handle your data we will tell you directly if we have a way to reach you.

This page is meant to describe what the platform actually does, not a generic template. If you find something here that does not match your experience, please tell us.

14. Contact us

For any question about this policy, any request about your data, or any grievance, contact us: