Privacy Policy
Last updated: 11 October 2026
Ice Cream Wala ("we", "us", "our") operates icecreamwala.com (the "Platform"), a pan-India marketplace for bulk ice cream. This policy explains what personal data we collect, why, who receives it, how long we keep it, how we protect it and your choices and rights under applicable Indian law, including the Digital Personal Data Protection Act, 2023 ("DPDP Act") and its rules to the extent in force, and the Information Technology Act, 2000. For this purpose, Ice Cream Wala is the Data Fiduciary.
Read it with our Terms of Service, Cookie Policy and Marketplace & Listing Policy.
1. Who This Covers
- Visitors who browse the Platform.
- Buyers who submit quote requests or use a verified account to enquire about suppliers.
- Suppliers who register and manage business listings.
- Signed-in users who leave a city request for an event or business requirement.
2. What We Collect
2.1 Account data
Your full name, email address, required Indian mobile number (stored with +91), state and city. Email/password signup also requires a password and email verification. Passwords are processed on our application server and stored as salted hashes, rather than readable passwords. We store account creation and verification status, hashed sign-in session tokens, hashed verification codes and hashed password-reset tokens for their limited validity periods. Administration access is controlled on the server.
Google sign-in. If you choose Continue with Google, we receive a Google identity credential containing your Google account identifier, name, email address and email-verification information. We verify it on our server and retain the Google identifier linked to your account. We do not receive your Google password or request access to Gmail, Google Drive or your contacts. We do not use a Google profile photo for your listing. New Google users must provide the required mobile number, state, city and terms/privacy consent. Existing password accounts require password confirmation before linking. Some Google accounts using third-party email domains also need our email OTP verification. Temporary sign-in and onboarding records expire after ten minutes. Google handles its sign-in interface under its own Privacy Policy.
2.2 Quote requests
Your name, email, mobile number, preferred contact method, state and city, event or order type and date, guest count, flavours, preferred brand, requested quantity, delivery preference, serving essentials, consent and request status.
Profile autofill and location detection. We use your saved account name, email, phone, state and city to prefill quote fields. You can check and change the request details before submission. Quote and business-listing forms offer Use my current location. If you choose it and grant browser permission, coordinates are sent to our server and rounded to two decimal places before a city-level reverse-geocoding lookup with OpenStreetMap Nominatim, or the configured geocoding provider. Rounded lookup results may be cached in server memory for up to 24 hours. We do not add precise coordinates to your account or quote record. Detection is optional; you can select a state and city manually.
2.3 Enquiries and quotes
The supplier you enquire about, your account identifier, enquiry timestamp and status. Pricing and fulfilment arrangements are agreed directly with the supplier; the Platform does not currently provide a supplier messaging or quotation editor.
2.4 Supplier listing data
Business name, category, state and city, contact name, verified account email, business mobile number, primary brand, minimum order, delivery preference, FSSAI registration/licence status and an optional photo. We store listing status, uploaded-image identifiers and image-review decisions, including automated classification scores or a review reason. New listings from verified accounts publish immediately; their photos remain off public listing pages until approved. Additional supporting information may be requested separately during review.
2.5 City requests
Your name, email address, state and city, intended event or business purpose and consent. A signed-in, verified account is required to submit this form.
Locations where services have not started. Some places shown on the Platform are not currently served. A location appearing in a selector or page, or being detected automatically, does not guarantee supplier coverage or delivery. We may collect a city request or waitlist entry in an unsupported location to record your interest and notify you if relevant services become available. Submitting it does not guarantee a launch date, supplier match or order fulfilment. Please wait for further availability updates or explicit supplier confirmation. Coverage is explained further in the Terms of Service.
Service availability messages connected to a city waitlist you requested are separate from optional promotional campaigns. You can ask support@icecreamwala.com to remove your waitlist entry and stop its availability notifications; unsubscribing from optional promotions alone does not remove your account or stop security and submission confirmations.
2.6 Reviews, reports and favourites
Public reviews, saved favourites and a reporting form are not currently offered. You may contact our team by email about a listing or concern; that correspondence is handled as described below.
2.7 Activity log
A record of key marketplace events (requests created, matches, quotes, contacts, outcomes). It is used to run and improve the service and to resolve disputes.
2.8 Technical data
IP address, browser and device type and basic request metadata, used for rate limiting, bot checks (Cloudflare Turnstile), security and fault finding. Analytics services are described below.
2.9 Correspondence
Messages you send us by email, phone or WhatsApp.
Please do not send us payment card details, bank credentials, OTPs for other services, or government ID numbers. The listing form asks for your declared FSSAI status where relevant; additional business information may be requested separately for support or review.
3. Why We Use It
- Create and secure your account and verify your email.
- Match quote requests with suppliers in your city and category and notify them.
- Let signed-in users view supplier contact details and send enquiries.
- Let suppliers publish listings immediately and let buyers contact them; review uploaded photos before displaying them on public listings.
- Distinguish verified account access from any separate business checks. Account or image approval does not certify a business or its products.
- Moderate listings and photos and handle concerns reported to our team.
- Send service emails: verification codes, password resets, signup confirmations, quote acknowledgements, listing confirmations and relevant status updates. Optional news and promotional emails have separate unsubscribe controls.
- Detect and prevent spam, abuse, fraud and misuse; keep the Platform secure.
- Understand demand by city and improve the Platform.
- Comply with law and enforce our Terms.
We do not use your data for purposes incompatible with these without telling you, and seeking consent where the law requires.
4. Legal Basis
We rely on your consent, which we ask for when you create an account or submit a form, and on the legitimate uses the DPDP Act permits, including where you voluntarily give data for a purpose you requested, to comply with law, and to prevent fraud and protect security. You can withdraw consent at any time (section 9).
5. Who Receives Your Data
Suppliers. When you submit a quote request, we share it with matched suppliers, including your name and contact details, so they can reply. When you send an enquiry, the supplier sees your message and contact details. Suppliers use your data as independent businesses and are expected to use it only to respond to you.
Other users. Supplier contact details are visible only to signed-in users and only for published listings. Public pages show the business information in the listing but not contact details. Public reviews are not currently offered. Approved listing photos are publicly visible. Photos withheld from a listing are still processed and stored by Cloudinary; withholding them from the page is not a guarantee that a direct media URL is private.
Service providers that process data for us under agreements:
- Our hosting provider: MySQL database, application hosting and SMTP delivery of verification and notification emails.
- Cloudinary: supplier photo upload, storage, transformation and delivery. A background image classifier screens uploads for potentially inappropriate content; uncertain or flagged images require human review. This screening does not identify people and is not used to train our own model on your uploads.
- Google Identity Services: optional Google account authentication when you use Continue with Google. Its authentication script loads on login and signup pages independently of optional analytics consent.
- OpenStreetMap Nominatim or our configured geocoding provider: approximate city lookup only when you request location detection.
- Google Analytics: optional public-page analytics, loaded only with your analytics consent. Advertising features are disabled.
- PostHog: optional anonymous public-page analytics after consent. Automatic interaction capture, session recording, person profiles and account identification are disabled. Its browser identifier is held in memory.
- Cloudflare: Turnstile bot protection on forms and cookieless Web Analytics performance measurements on public pages. Web Analytics loads independently of the optional analytics consent choice.
- Our web hosting provider, which serves the site and may log requests.
They may use the data only to provide their service to us.
Admins. Authorised administrators can access the information needed to support accounts, handle requests, review listings and photos, and resolve complaints.
Legal and safety. We may disclose data if required by law or a competent authority, or to protect rights, safety or security, or to investigate fraud.
Business transfers. If our business is merged, acquired or sold, data may transfer to the successor, which must honour this policy.
We do not sell personal data.
6. Cookies and Similar Technologies
We use essential cookies and local storage for sign-in, security and your consent choice. Google Analytics and PostHog load only after analytics consent. Cloudflare Web Analytics is cookieless and loads independently. Google sign-in uses separate short-lived security cookies and, after successful authentication, the same account session cookie as email login. See the Cookie Policy.
7. Security
We use safeguards appropriate to the data we hold, including encrypted connections, server-side access checks and parameterized database queries so users can read only what they are permitted to, role checks for admin actions, rate limiting and bot checks on public forms, escaped output so user content cannot inject code into pages, storage of secrets only on the server, and restricted internal access. We test these access rules. No system is perfectly secure. If a personal data breach affects you, we will notify you and the Data Protection Board of India as the law requires.
8. Where Data Is Stored and Transfers
Our database is hosted with our web hosting provider. Supplier photos are stored with Cloudinary. Some providers, including Google, Cloudinary, geocoding, email delivery and bot protection, may process data outside India. We only use providers we consider reputable and transfer data only where the DPDP Act permits.
9. Your Rights
You may:
- access a summary of the personal data we process and who it is shared with;
- correct or update your name and mobile number in account settings, and contact our team for other corrections;
- erase your data or close your account, including removing a listing, unless we must keep it by law;
- withdraw consent for further processing;
- seek grievance redressal, first from our Grievance Officer and, if not resolved, the Data Protection Board of India; and
- nominate another person to exercise these rights if you die or become incapacitated.
Send requests from your account email to our Grievance Officer (section 14). We may verify your identity first. We will acknowledge and act on your request without unnecessary delay.
If you delete your account, enquiries and quotes shared with other parties may remain in their records. Closing your Ice Cream Wala account is separate from removing its connection in your Google Account. Removing Google access does not itself erase records already held by us; contact us to request account deletion.
10. Retention
We keep data only as long as needed for the purposes above, and then delete or anonymise it. In practice:
| Data | Retention |
|---|---|
| Account data | While your account is active, then deleted or anonymised after you close it |
| Quote requests, enquiries, quotes | As long as needed to handle the request and any follow-up or dispute |
| Supplier listings and contacts | While the listing is active, then removed after closure |
| City requests | As long as needed to understand demand in that city |
| Google account link | While linked to your active account; removal can be requested from support |
| Google sign-in / onboarding records | Ten-minute validity; expired records are removed by scheduled maintenance |
| Photo-review records | While needed to manage the listing, investigate misuse and handle appeals |
| Optional email preference | While needed to honour your subscription or unsubscribe choice |
| Activity log | As long as needed to run the service and resolve disputes, then aggregated or deleted |
| Technical logs | Short-term, for security and abuse prevention |
| Correspondence | As long as needed to deal with your query and for record-keeping |
We may keep data longer where the law requires or to establish or defend legal claims.
10.1 Email Preferences
Service emails support account security and actions you request. Unsubscribing from optional news or promotions does not stop OTPs, password resets, signup confirmations, quote acknowledgements or listing confirmations. Use the email-preference link in our emails, or the mail client's unsubscribe control when it is shown for an optional promotional message. We retain a preference record so we can honour the choice. A mail client decides whether it displays native unsubscribe or copy-code controls.
11. Children
The Platform is for adults and businesses. We do not knowingly collect data from anyone under 18. Tell us if you believe a child has given us data and we will delete it.
12. Third-Party Links
Links to WhatsApp, phone dialling and external websites are governed by those parties' policies.
13. Changes
We will update the date above when we change this policy and give notice of material changes on the Platform or by email before they take effect, seeking fresh consent where required.
14. Grievance Officer
For privacy queries, rights requests and grievances under the DPDP Act:
Grievance Officer: Avinaash Upadhyay Ice Cream Wala Email: sales@icecreamwala.com Phone: +91 81042 20220