This policy explains how Folded Labs Private Limited (“Folded”, “we”, “our”, “us”) handles personal data when you use foldedpos.com, the Folded dashboard and point of sale, and the customer and rider mobile apps that shops run on Folded. We aim for plain language; if anything below is unclear, email support@foldedpos.com.
Who is responsible for which data
- Your Folded account (shop owners, staff and riders): we decide how this data is used, so we are the data fiduciary (DPDP) / data controller (GDPR).
- A shop's business data — its customers, orders and payments, including what a shop's customers enter in that shop's app: the shop decides how it is used. We store and process it on the shop's behalf, as its data processor. If you are a customer of a shop, that shop is your first point of contact; we will help it respond to you.
What we collect
We collect only what we need to run the product:
- Account data — name, email address, phone number, password (stored only as a hash), and shop details such as legal name, address, GSTIN where applicable, country and currency.
- Google account data, if you choose “Continue with Google” — see the next section.
- Shop business data — orders, garments, prices, customers, payments, riders, deliveries, staff records and similar information a shop enters.
- Customer app data — phone number (verified by a one-time code), name, saved addresses, order history, and wallet or loyalty balances with that shop.
- Location — when you tap “use current location” or place a pin on the map, we use that position to check whether the shop delivers there and to save the address you confirm. We ask for your permission first, only read location while the app is open, and do not track you in the background. The rider app shares a rider's position with their shop only while the rider is checked in for a shift and has the app open.
- Photos — pictures of garments taken by shop staff or riders, for example to record a stain or damage before cleaning.
- Payment information — payments are handled by the payment provider. We receive a reference, the amount and the status. We never see or store card numbers, UPI PINs or bank passwords.
- Device and usage data — browser or device type, operating system, IP address, a push-notification token if you allow notifications, error reports and page performance measurements.
Sign in with Google
Signing in with Google is optional; you can always use an email address and password instead. If you choose Google, this is exactly what happens to your Google data:
- What we receive — your name, email address, profile picture and the unique identifier of your Google account. We request only Google's basic sign-in permissions (
openid,email,profile). We do not access your Gmail, Drive, Calendar, contacts or any other Google data. - How we use it — only to create your Folded account, sign you in, and show your name and email inside the product.
- How we store it — with the rest of your account data, in our database and authentication service. We never receive or store your Google password.
- Who we share it with — no one, other than the service providers listed below that host our systems. We do not sell it, use it for advertising, or use it to train AI models.
- How to remove it — email support@foldedpos.com to delete your account and the Google data attached to it. You can also withdraw Folded's access at any time from your Google Account's security settings.
Folded's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How we use it
- To run a shop's point of sale, customer app and delivery flows.
- To sign you in and keep your account secure.
- To send the messages you and a shop's customers expect — one-time codes, order updates, payment receipts.
- To produce a shop's invoices, such as GST tax invoices in India.
- To prevent fraud and abuse.
- To fix errors and improve the product.
Who we share it with
We share data only with the service providers we need to run Folded, and only to the extent each one needs:
- Supabase — database, file storage and sign-in.
- Vercel — website and API hosting, and page-performance measurements.
- Google — “Continue with Google” sign-in, and Google Maps Platform for address search and maps.
- MSG91 — one-time codes by SMS, and WhatsApp messages.
- Resend — email.
- Expo, Google Firebase Cloud Messaging and Apple Push Notification service — push notifications.
- Razorpay and Cashfree — a shop's customer payments, only if the shop has connected its own account with them.
- Dodo Payments — payments for Folded plans.
- Ably — live updates inside the product.
- Upstash — rate limiting, to protect against abuse.
- Sentry — error monitoring.
- Clerk — sign-in for accounts created before we moved sign-in to Supabase.
We never sell your data. We never share personal data with advertisers or marketing partners. We never use your data to train AI models. We may disclose data if the law requires it, and we will tell you when we are allowed to.
Where your data is kept
Our main database is hosted in India (Mumbai). Some of the providers above process data in other countries; where they do, the data is protected by their contractual commitments to us.
Security
- All connections are encrypted in transit (TLS).
- Payment-gateway credentials a shop gives us are encrypted at rest.
- Each shop's data is isolated from every other shop's at the database level.
- Passwords are stored only as hashes; two-factor sign-in is available to operators.
- We keep an audit log of sensitive actions.
- We never store card numbers.
No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant authority as the law requires.
Your rights
You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, or withdraw a consent you gave. We respond within 30 days. Email support@foldedpos.com with “DSAR” in the subject. If you are a customer of a shop, you can ask the shop or us.
Deleting your account in a shop's app. You can delete your account yourself from the app (Profile → Delete account). We first check that nothing is still open between you and the shop — an order in progress, money you owe or money owed to you, or an active plan — and ask you to settle it. When you delete, your name, phone number, email, saved addresses and business details are removed straight away and you are signed out. Any bonus credit or reward points left are lost. The shop keeps an anonymous record of your past orders and payments, without your name or number, because the law requires it for their accounts and tax.
To stop new-customer offers (first-order discounts, welcome offers, referral rewards) being claimed again by deleting and re-joining, we keep an encrypted one-way marker of your phone number. It cannot be turned back into your number, is only compared within the same shop, and is used for nothing else.
Retention
- Account data: for the life of your account, then up to 30 days after it is closed so you can export your data.
- Shop business data: for as long as the shop's account is open, then deleted after the same 30-day period — except records the law requires us or the shop to keep, such as tax invoices.
- Audit log: 2 years.
- A deleted customer account: personal details removed at once; the anonymous order record and the encrypted number marker are kept for as long as the shop's records are.
- Data that no longer identifies anyone: may be kept indefinitely.
Children
Folded is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 18.
Cookies
We use a small number of essential cookies to keep you signed in and to remember your active shop. We do not use advertising cookies or sell data to ad networks. Page-performance measurements are collected without identifying you.
Changes
If we change this policy materially, we'll email account holders at least 30 days before the changes take effect, and update the date at the top of this page.
Contact and grievance officer
Folded Labs Private Limited
Plot no. 337, WorkYard Coworking Space, Phase 2, Business and Industrial Park, Chandigarh 160002, India
Grievance officer: Amit Khatkar — support@foldedpos.com. For data requests, mention “DSAR” in the subject line.