Privacy Policy

The WashHouse Laundry & Dryclean operates the DLM platform. For the purposes of applicable Indian privacy and data protection laws, we act as the data fiduciary / data controller for personal data processed through our website and apps.

Registered entity:
WashHouse Laundry & Dryclean Pvt. Ltd.
The WashHouse Laundry & Dryclean
Navratan near seven-eleven in front of The cross road school
Udaipur, Rajasthan 313001
India
Email: privacy@washhouse.in

Independent laundry Partners listed on the Platform may process your data as separate controllers when fulfilling your Order (e.g. handling garments at their facility). This policy covers data processed by WashHouse; Partner-specific practices may also apply at the store level.

Depending on how you use the Platform, we may collect:

• Identity & contact: name, mobile phone number, email address.
• Addresses: pickup and delivery addresses, saved locations, and address labels you provide.
• Order data: service selections, garment notes, order history, status updates, ratings, reviews, and complaint records.
• Payment metadata: transaction IDs, payment method type (UPI, card, net banking, COD), amounts, GST details, and refund status. We do not store full card numbers, CVV, or UPI PINs on our servers.
• Location: approximate or precise location (with your permission) to show nearby Stores, estimate delivery, and improve discovery — you can control this in device settings.
• Device & usage: IP address, browser/app type, device identifiers, pages viewed, clicks, crash logs, and diagnostic data for performance and security.
• Communications: messages you send to support, and records of SMS, email, or WhatsApp notifications we send (where enabled).

We collect data you provide directly, automatically when you use the Platform, and from payment and messaging providers as needed to complete transactions.

We use personal data to:

• Create and manage your account (including phone OTP verification).
• Process Orders — booking, pickup scheduling, Partner assignment, tracking, and delivery.
• Facilitate payments (UPI, cards, wallets, COD reconciliation) and issue GST invoices.
• Send service notifications via SMS, email, WhatsApp, and in-app alerts (order updates, OTPs, delivery ETAs).
• Provide customer support and resolve disputes or complaints.
• Prevent fraud, abuse, and unauthorised access; enforce our Terms.
• Improve the Platform — analytics, A/B tests, and product development (often using aggregated or de-identified data where possible).
• Comply with legal obligations, tax records, and lawful requests from authorities.
• Send marketing about WashHouse offers where permitted — you can opt out anytime.

We process personal data under applicable Indian law, including the Information Technology Act, 2000 and rules thereunder (including reasonable security practices), and with awareness of the Digital Personal Data Protection Act, 2023 (DPDP Act) and related rules as they come into force.

Depending on context, processing may be based on:

• Your consent — e.g. marketing messages, optional location, non-essential cookies where required.
• Performance of a contract — providing the services you request when you place an Order or subscribe to a plan.
• Legitimate interests — fraud prevention, security, and improving the Platform, balanced against your rights.
• Legal obligation — tax, accounting, and regulatory requirements.

Where consent is required, you may withdraw it through account settings or by contacting us. Withdrawal does not affect processing already carried out lawfully.

We share data with trusted processors who help us run the Platform, only as needed and under contractual safeguards:

• Razorpay — payment processing (UPI, cards, net banking).
• Cloud hosting — e.g. Vercel (frontend), Railway (backend APIs), Neon (database).
• SMS / OTP providers — phone verification and transactional SMS.
• Resend — transactional and service emails.
• WhatsApp Business API (where enabled) — order updates you opt into.
• Analytics & error monitoring — aggregated usage and crash reporting.

We may also share data with Partners to fulfil your Order, delivery personnel for pickup/drop, and authorities when required by law. We do not sell your personal data.

We keep personal data only as long as needed for the purposes above, including:

• Active account data — while your account exists and as needed to provide services.
• Order and payment records — typically 7–8 years for tax and audit compliance.
• Support tickets — for a reasonable period after resolution.
• Marketing preferences — until you opt out or delete your account.
• Logs and security data — shorter periods unless needed for investigations.

When data is no longer required, we delete or anonymise it in line with our retention schedule and applicable law. Backups may persist for a limited time before rotation.

Subject to applicable Indian law (including DPDP Act provisions as in force), you may have the right to:

• Access personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of data where legally permitted.
• Withdraw consent for processing that relies on consent.
• Nominate another person to exercise rights on your behalf in certain cases.
• Grieve to our Grievance Officer (see below) if concerns are unresolved.

To exercise these rights, submit a request via our contact page. We may verify your identity (e.g. OTP to your registered phone) before acting. We aim to respond within timelines prescribed by law.

We use cookies and similar technologies (including local storage) to:

• Session & auth — keep you signed in securely and protect against CSRF.
• Preferences — theme (light/dark/system) and locale choices.
• PWA — cache assets for faster load when you install the app to your home screen.
• Analytics — understand how the Platform is used (often with consent where required).

You can control cookies through browser settings; blocking essential cookies may affect login and checkout. We will update this section if we add non-essential tracking that requires explicit consent.

We implement reasonable technical and organisational measures aligned with Indian law, including:

• Encryption in transit (HTTPS/TLS) for data sent between your device and our servers.
• Access controls and role-based permissions for staff and systems.
• Secure password hashing and JWT-based authentication with refresh tokens.
• Payment card/UPI data handled by PCI-compliant payment partners — not stored in full on our side.
• Monitoring, logging, and incident response procedures.

No method of transmission or storage is 100% secure. Please use a strong device lock, do not share OTPs, and report suspected breaches promptly via contact.

The Platform is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a minor has provided data to us, contact us and we will take steps to delete it.

We may update this Privacy Policy for new features, legal requirements, or business practices. Material changes will be communicated via the Platform, email, or SMS where appropriate. The "Last updated" date at the top shows the current version.

Continued use after the effective date means you accept the updated policy, except where explicit consent is required by law.

For privacy questions, data requests, or complaints under Indian law, contact our Grievance Officer:

Name: Data Protection Team
Email: grievance@washhouse.in
Address:
The WashHouse Laundry & Dryclean, Navratan near seven-eleven in front of The cross road school, Udaipur, Rajasthan 313001, India

You may also reach us through our general contact page. Include your registered phone number and a clear description of your request.

If your concern is not resolved satisfactorily, you may have the right to escalate to the Data Protection Board of India or other remedies under applicable law once available.