1.Who we are
SmartLinks is a delivery management platform operated by Softblend Technologies Private Limited (“Softblend”, “we”, “us”), a company incorporated in India. This policy covers the SmartLinks website at softblend.in/smartlinks, the web app at smartlinks.softblend.in, the SmartLinks Android and iOS apps, customer tracking pages, and the SmartLinks API (together, the “Service”).
We process personal data in line with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000 and the rules made under them. If you have a question about this policy, write to privacy@softblend.in.
2.Our role: fiduciary or processor
Who decides how your data is used depends on how you use SmartLinks.
- Merchants and their riders and customers. A business (“Merchant”) uses SmartLinks to run its own deliveries. The Merchant decides which riders to add and which customers’ orders to enter, so the Merchant is the Data Fiduciary for that data and Softblend processes it on the Merchant’s behalf, as a Data Processor, under our Terms of Service.
- Softblend’s own data. Softblend is the Data Fiduciary for Merchant account and billing data, for riders who join Softblend’s own partner rider programme, for website visitors and for anyone who contacts us.
If you are a customer or a rider working for a Merchant, the Merchant’s own privacy notice also applies, and the Merchant is usually the right first contact for requests about your data. We will help them answer you.
3.What we collect
We collect only what the Service needs to work. Most of it is entered by Merchants or generated while a delivery is in progress.
| Who | Data | Where it comes from |
|---|---|---|
| Merchants and staff | Name, phone number, email, company name, address, store location, logo, business category, login PIN or password (stored only as a one-way hash), team roles, subscription, usage and invoice records, API keys (stored hashed) | You, at sign-up and in workspace settings |
| Riders | Name, phone number, age, home address, profile photo, government ID number where the Merchant records it (such as Aadhaar), delivery zone, shift schedule, login credentials (hashed), push notification token, device model and OS version | The Merchant who adds you, and you in the rider app |
| Riders (on shift) | Precise GPS location with accuracy, heading and speed; pickup and delivery confirmations; proof of delivery (photos, signatures, voice notes); chat messages with the Merchant | The rider app while you are on shift (see section 4) |
| Softblend partner riders | In addition to the rider data above: PAN, Aadhaar, bank account number and IFSC or UPI ID, used to verify you and pay you | You, during partner onboarding |
| Customers | Name, phone number, delivery address and map coordinates, delivery notes and instructions, order details, address confirmations and change requests, delivery ratings and comments, WhatsApp opt-in status | The Merchant, and you on the tracking page |
| Customers (tracking page) | Device type, operating system, browser, time spent on the page and the actions taken on it (for example opening the map or calling the rider) | Your browser, when you open a tracking link |
| Website visitors | Whatever you choose to send through the contact form (name, company, email, phone, message), plus standard server logs (IP address, browser, pages requested, time) | You, and your browser |
Lab diagnostics
For diagnostic labs using the lab diagnostics workflow, orders include the patient’s sample collection details, and the lab may upload the patient’s test report to share it with them through a private link. Test reports are health data. They are kept in private, encrypted storage and are only ever opened through links that expire: the patient’s tracking page creates a new 15-minute link each time it is viewed, and a link the lab copies to send by hand lasts at most 7 days. Reports are processed only on the lab’s instructions. We do not use them for any other purpose. Apart from this, we do not ask for sensitive data such as health, religion or caste.
4.Rider location: prominent disclosure
The SmartLinks rider app collects precise location data in the background, even when the app is closed or not in use, while a rider is logged in and on shift.
We use background location only to:
- show the rider’s live position to the Merchant and to the customer whose order the rider is carrying;
- calculate ETAs and routes, and detect arrival at pickup and drop-off points so the rider can confirm with one tap;
- resume tracking automatically if the phone restarts during a shift; and
- keep a record of the delivery route for distance, earnings and dispute resolution.
Location is collected only while you are logged in and on shift. It stops when you end your shift or log out. On Android 10 and later the app shows an in-app disclosure first and asks for background location (“Allow all the time”) separately. You can refuse it, or withdraw it later in your phone’s settings; live tracking will then work only while the app is open.
Location data is never sold and is not used for advertising.
5.Camera, microphone and notifications
- Camera and photos. Riders use the camera to capture proof-of-delivery photos. The camera is used only when you start that step; we never access it in the background.
- Microphone. Riders may record a short voice note as proof of delivery. Recording happens only when you start it.
- Notifications. We use a push notification token to send order alerts, assignments and proximity reminders. You can turn notifications off in your phone’s settings.
6.How we use personal data
- To provide the Service: creating and assigning orders, routing and batching deliveries, live tracking, customer tracking pages, proof of delivery, schedules, subscriptions, chat and rider earnings.
- To communicate: one-time passwords by SMS, order updates by SMS or WhatsApp (WhatsApp only where the customer has opted in), push notifications, and service or billing emails.
- To give Merchants insight: delivery, rider performance and customer engagement dashboards for that Merchant’s own workspace.
- To pay partner riders: verifying identity and bank details and making payouts.
- To keep the Service safe: authentication, rate limiting, fraud and abuse prevention, debugging and audit logs.
- To improve SmartLinks: using de-identified, aggregated statistics (for example average delivery times in a city) that cannot be linked back to a person or a Merchant.
- To meet legal obligations: tax, accounting, and responding to lawful requests from authorities.
Where the DPDP Act requires consent, we (or the Merchant) ask for it, and you can withdraw it at any time. Withdrawing consent does not affect processing that happened before, and some features (for example live tracking) may stop working. Other processing relies on the legitimate uses the Act allows, such as providing a service you asked for or meeting a legal obligation.
We do not sell personal data, and we do not use it for third-party advertising.
8.Where data is stored
SmartLinks data is stored and processed on servers located in India. A few providers listed above (for example Typeform and WhatsApp) may process data outside India. We only transfer data to countries the Government of India has not restricted under the DPDP Act, and we require those providers to protect it to the standard of this policy.
9.How long we keep it
| Data | Kept for |
|---|---|
| Rider location history | 90 days after the delivery session ends, then permanently deleted |
| Account and profile data | While the account is active; deleted within 7 days of a verified deletion request, and from backups within a further 30 days |
| Orders, proof of delivery, lab reports and tracking-page analytics | While the Merchant’s workspace is active, unless the Merchant deletes them sooner; removed within 30 days after the workspace is closed |
| Partner rider KYC and payout records | While you are a partner, then as long as tax and anti-money-laundering laws require |
| Invoices and billing records | 8 years, as required by Indian accounting and tax law |
| One-time passwords | A few minutes, until used or expired |
| Server and security logs | Up to 180 days |
We may keep data longer where it is needed for an open dispute, a legal claim or an investigation, and only for as long as that lasts.
10.How we protect it
- All traffic between apps, browsers and our servers is encrypted with HTTPS and secure WebSockets (TLS).
- Data is encrypted at rest. Identity and bank details for partner riders are additionally encrypted field by field using keys held in a managed key service.
- Passwords, PINs and API keys are stored only as one-way hashes.
- Each Merchant’s operational data is held in its own isolated database, and access inside a workspace is role based.
- Softblend staff can access personal data only when their job needs it, and access is logged.
No system is perfectly secure. If a personal data breach happens, we will inform the Data Protection Board of India and affected people as the DPDP Act requires, and tell Merchants without undue delay about any breach affecting their data.
11.Your rights
Under the DPDP Act you have the right to:
- access a summary of the personal data we hold about you and how it is processed;
- correct, complete or update inaccurate or incomplete data;
- erase data that is no longer needed (see Account deletion);
- withdraw consent you gave earlier, as easily as you gave it;
- nominate someone to exercise your rights if you die or become unable to; and
- have your grievance resolved, first by us and then, if you are not satisfied, by the Data Protection Board of India.
Email privacy@softblend.in from your registered email address or include your registered phone number so we can verify you. We respond within 30 days. If the data belongs to a Merchant’s workspace, we pass your request to that Merchant and support them in responding.
Customers can stop WhatsApp updates at any time by asking the Merchant or writing to us.
12.Children
SmartLinks is a business service and is not meant for anyone under 18. Merchants must not add riders who are under 18. We do not knowingly collect children’s data; if we learn we have, we delete it.
14.Grievance Officer
In line with the Information Technology Act, 2000 and the DPDP Act, 2023, you can raise any complaint about how your data is handled with our Grievance Officer:
Grievance Officer, Softblend Technologies Private Limited
Email: privacy@softblend.in
We acknowledge complaints within 48 hours and aim to resolve them within 30 days.
15.Changes to this policy
We will update this policy when the Service or the law changes. The effective date at the top shows the latest version. If a change is material, we will tell you through the app or by email before it takes effect. For general support, contact info@softblend.in.