1. Two roles — read this first
This policy covers our websites, shop dashboards, mobile applications and the white-label storefronts we host for bakeries ("Shops"). Frostique serves two kinds of people, and our role differs for each:
- Shop data — bakery owners and their team members who register and use Frostique; for example account details and billing information. Pronttera is the Data Fiduciary, deciding how and why that data is processed.
- End-Customer data — people who browse or order from a Shop's storefront; for example name, phone, delivery address and orders. The Shop is the Data Fiduciary and Pronttera is its Data Processor, processing on the Shop's instructions under our Data Processing Addendum.
If you are an End Customer, your primary privacy relationship is with the bakery you ordered from — please also read that Shop’s own privacy notice.
2. Personal data we collect
From Shops (account holders and team members):
- Identity and contact — name, email, phone, business or shop name.
- Billing — billing address (address line, pincode, city, state, country), GSTIN (optional) and invoices.
- Payment references — payment, order and mandate identifiers from our payment partner. We never collect or store full card numbers, CVVs or UPI credentials.
- Usage and device — log data, IP address, browser and device information, actions in the dashboard, and support communications.
About End Customers, processed for the Shop: contact and delivery details — name, phone or email, delivery address — and order data: items ordered, order value, order status, custom-cake requests including any details the customer submits, and wishlist or preferences where the Shop’s plan includes those features.
We do not knowingly collect data of children under 18 for account creation, and storefront purchases are intended for adults.
3. Why we process it
- To provide the service — accounts, storefront hosting, online ordering, subscription billing, renewals and invoices. Basis: performance of our contract with you.
- To meet legal obligations — tax and accounting records such as GST invoices, RBI e-mandate requirements such as pre-debit notifications, and responding to lawful requests.
- With your consent, or for legitimate uses permitted by law — service emails such as renewal reminders and payment alerts; product updates, which you can opt out of at any time; security, fraud and abuse prevention including enforcing one trial per Shop; and analytics to improve the platform.
- For End-Customer data — solely on the relevant Shop’s instructions to operate its storefront and orders. We do not use End-Customer data for our own marketing.
4. Sharing and disclosures
We share personal data only with:
- Payment processing — Razorpay and its banking partners, to process subscription payments and autopay mandates; and Cashfree Payments and its banking partners, to process online payments for storefront orders, their refunds, and the settlement of each Shop’s share to the Shop’s bank account (to do this we share the Shop’s payout bank details and PAN with Cashfree). When an End Customer pays a Shop online, Pronttera keeps only the Cashfree payment and refund references — never card numbers, UPI PINs or bank logins.
- Service providers and sub-processors — cloud hosting and storage, transactional email delivery and, in future, WhatsApp notification providers, all bound by confidentiality and data-protection obligations. The current sub-processor list appears in our Data Processing Addendum.
- The Shop you ordered from — for End Customers, your order and contact details are shared with, and controlled by, that Shop.
- Legal — where required by law, regulation or legal process, or to protect rights, safety and the integrity of the service.
- Business transfers — in connection with a merger, acquisition or asset sale, subject to this policy.
We do not sell personal data.
6. Data retention
- Active accounts — retained while your subscription or trial is active.
- After cancellation — Shop and storefront data is kept in archived form for 90 days, so you can reactivate or export it, and is then permanently deleted — or earlier upon a verified deletion request.
- Financial records — invoices, payment and tax records are retained for the period required by Indian tax law, even after account deletion.
- End-Customer data — retained per the Shop’s instructions and deleted on the same 90-day post-cancellation schedule, subject to legal retention duties.
7. Security
We use reasonable technical and organisational safeguards appropriate to the data we handle — including encryption in transit, access controls, payment processing delegated to an RBI-regulated gateway, and audit logging of billing events.
No system is perfectly secure. In the event of a personal-data breach we will notify affected users and the Data Protection Board of India as required under applicable law.
8. Your rights under the DPDP Act, 2023
Subject to law, you have the right to: access a summary of your personal data and our processing activities; correct, complete or update your data; erase data that is no longer necessary; nominate a person to exercise your rights in case of death or incapacity; and raise a grievance with us and, if unresolved, with the Data Protection Board of India. Where we rely on consent, it can be withdrawn at any time without affecting processing already carried out.
To exercise these rights, write to the Grievance Officer at [email protected]. End Customers should direct requests to the relevant Shop; where the Shop instructs us, we will assist in fulfilling the request.
9. International transfers
Our primary infrastructure is located in India. If data is transferred outside India, we do so in accordance with applicable law and with appropriate safeguards.
10. Changes to this policy
We may update this policy from time to time. Material changes will be notified by email or in-product notice, and the "last updated" date at the top of this page revised. Continued use after the effective date constitutes acceptance.
11. Grievance Officer and contact
Data-protection questions, requests and complaints go to our Grievance Officer — [email protected] · +91 98341 74885 — or by post to Pronttera, KPCT Mall, Fatima Nagar, Pune, Maharashtra, India.
We acknowledge complaints promptly and resolve them within the timelines prescribed under applicable Indian law.