Privacy Policy — Plants Daddy Lucknow

4.1 Who We Are

Plants Daddy is a premium plant boarding and vacation care service operated as a sole proprietorship in Lucknow, Uttar Pradesh, India. For the purposes of this Privacy Policy, "Plants Daddy," "we," "us," or "our" refers to the business entity and its authorised personnel.

This Privacy Policy is governed by and construed in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and applicable provisions of the Consumer Protection Act, 2019 of India.

4.2 Information We Collect

We collect only the minimum information necessary to provide our services effectively. This includes:

Category	Specific Data	Why We Collect It
Identity Data	Full name, as provided at booking	Booking confirmation, invoicing, plant tag labelling
Contact Data	WhatsApp number, email address (optional)	Booking communication, plant updates, delivery coordination
Location Data	Home address, society name, flat/tower number, floor	Pickup and drop-off logistics, route planning
Transaction Data	UPI ID or payment reference number, booking amount, payment timestamps	Payment confirmation, invoice generation, accounting records
Plant Data	Plant types, count, watering schedule, known conditions, estimated value	Customised daily care, intake documentation, liability assessment
Visual Data	Photographs of your plants (taken at intake and during stay)	Condition documentation, care verification, WhatsApp updates to you
Communication Data	WhatsApp message history, booking form submissions, feedback responses	Service delivery, dispute resolution, quality improvement

We do not collect: National ID numbers (Aadhaar/PAN), full bank account details, passwords, biometric data, or any sensitive personal data beyond what is described above.

4.3 How We Use Your Information

Every piece of data we collect serves a specific, defined purpose. We do not collect data speculatively or for purposes we have not disclosed. Your information is used for:

Service delivery: Processing your booking, coordinating pickup and drop logistics, assigning care protocols, and returning your plants safely
Communication: Sending booking confirmations, daily/bi-daily WhatsApp photo updates, return reminders, and responding to your queries
Invoicing and payments: Generating digital invoices, recording advance payments, collecting balance payments, and processing eligible refunds
Care quality: Maintaining our internal care logs (which plant, which customer, what care was given each day) to ensure we meet our service standards
Dispute resolution: Using intake photos, care logs, and communication records to objectively resolve any disagreements about plant condition
Service improvement: Reviewing aggregated, anonymised feedback to improve our care protocols, booking experience, and communication
Legal compliance: Retaining transaction records as required by Indian tax and accounting laws (typically 7 years for financial records)
Marketing (with your consent only): Sending you WhatsApp broadcast messages about seasonal offers, new services, or reminders — only if you are an existing customer and have not opted out

4.4 Photographs of Your Plants — Social Media Consent

We take photographs of your plants for operational and care documentation purposes — these are private records and are shared only with you (the customer) via WhatsApp updates.

We will never share photographs of your plants on our Instagram, website, or any public channel without your explicit, individual written consent — separate from these general terms. When we ask for permission to share a photo, you will receive a direct WhatsApp message asking specifically for that permission.

You may withdraw your consent to use photographs at any time by messaging us on WhatsApp. Photographs already published prior to withdrawal cannot be retroactively removed from third-party platforms (e.g., Instagram), but we will remove them from our own profile upon request where technically possible.

Testimonials: If you send us a WhatsApp message praising our service, we may ask for your permission to use it as a testimonial (with or without your name, as you prefer). We will never use your words publicly without asking first.

4.5 Data Sharing — Who Sees Your Information

Plants Daddy does not sell, rent, trade, or share your personal information with third-party marketers, advertisers, or data brokers. Full stop.

Your data may be accessed by the following within our operational framework:

Our Maali and care team: They access your plant care details (species, watering schedule) to deliver daily care. They do not have access to your address or contact details.
Our delivery team: They access your address and contact number for pickup and drop-off coordination only. This information is not retained on their personal devices after service completion.
Our nursery partner (if applicable): The nursery where your plants are housed has no access to your personal information. Only tagged plant numbers are visible in their space.
Payment processors: UPI payments are processed through your chosen payment app (GPay, PhonePe, Paytm). We do not store or have access to your full payment credentials — only the UPI reference number for our records.
Legal authorities: We may disclose your data to law enforcement or government authorities if legally compelled to do so by a valid court order or government directive under Indian law.

4.6 Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this policy, subject to the following timelines:

Data Type	Retention Period	Reason
Booking and contact details	3 years from last service	Re-booking, dispute resolution, service history
Transaction and payment records	7 years	Indian tax law (GST/income tax compliance)
Plant intake photos	2 years from service date	Liability documentation
Care logs and daily records	1 year from service date	Quality review and dispute resolution
WhatsApp message history	1 year	Communication records, dispute resolution
Marketing consent records	Until opt-out or deletion request	Proof of consent for DPDP Act compliance

4.7 Your Rights Under Indian Privacy Law

Under the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (DPDP Act), you have the following rights with respect to your personal data held by Plants Daddy:

Right to Access

You may request a summary of what personal data we hold about you at any time. We will respond within 10 business days.

Right to Correction

If any of your data is incorrect or outdated, you may request a correction. We will update our records within 5 business days of your request.

Right to Erasure

You may request deletion of your personal data, subject to our legal retention obligations (financial records cannot be deleted within the mandatory 7-year period).

Right to Opt Out

You may opt out of marketing communications (WhatsApp broadcasts, promotional messages) at any time by replying "STOP" to any broadcast message or messaging us directly.

To exercise any of your rights: Send a WhatsApp message to +91 9250052376 with the subject line "DATA REQUEST" and your full name. We will acknowledge within 2 business days and fulfil your request within 10 business days. All such requests are handled personally by the business owner.

4.8 Data Security

We implement reasonable security measures proportionate to the nature of the personal data we hold. Our security practices include:

Access control: Only authorised personnel have access to customer data, on a need-to-know basis for service delivery
WhatsApp Business: Our primary communication channel is WhatsApp Business, which uses end-to-end encryption for all messages
No cloud storage of sensitive data: Customer addresses and contact details are not stored on third-party cloud platforms accessible to external parties
Physical security: Paper records (printed booking sheets) are stored securely and destroyed after the retention period using cross-cut shredding
Staff training: All team members are briefed on data handling responsibilities and confidentiality expectations before beginning work

While we take all reasonable precautions, no data transmission or storage system is completely secure. In the event of a data breach that may affect your rights, we will notify you within 72 hours of becoming aware of the breach, in accordance with applicable Indian law.

4.9 Website & Cookies

Our website (plantsdaddy.in) may use basic analytics tools (such as Google Analytics) to understand visitor traffic patterns — such as how many people visit, which pages are most popular, and general geographic regions of visitors. This data is aggregated and anonymous — it does not identify individual visitors.

We do not use tracking cookies for advertising, retargeting, or behavioural profiling. If you use our website's booking form, the information you submit is transmitted directly to us via our contact system and treated as booking data under this policy.

You may adjust your browser's cookie settings at any time. Disabling cookies will not affect your ability to use any core features of our website.

4.10 Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, operations, or applicable law. When we make material changes, we will:

Update the effective date at the top of this policy
Post a notice on our Instagram account (@plantsdaddylko) for 7 days
Send a WhatsApp broadcast to existing customers informing them of the change

Your continued use of our services after such changes constitutes your acceptance of the updated policy. If you do not agree with the updated policy, you may request deletion of your data as described in Section 4.7.