Your data, simply.

OneLife by Flax is operated by Flax Healthy Living Pvt Ltd ("we", "us"). We run the meal-plan and à-la-carte service available at onelife.flaxitup.com and via our iOS and Android apps. This page explains, in plain language, what we collect, why, and what we do with it.

What we collect

• Phone number or email — to sign you in via one-time password. Required.
• Name + delivery address(es) — to deliver your food. You provide these; we never harvest contacts.
• Approximate location (mobile app only) — to suggest the nearest outlet. Asked for explicitly the first time; you can deny without losing functionality.
• Order + subscription history — to show your past orders and let you re-order or manage subscriptions.
• Payment details — handled entirely by Razorpay. We never see or store your card or UPI ID; only Razorpay's encrypted transaction reference.
• Push notification token (mobile app only) — to send you order-status updates ("kitchen ready", "out for delivery"). Stored encrypted; can be revoked any time from the OS settings.
• Device crash logs — anonymous, aggregated, used only to fix bugs.

What we don't do

• We don't sell your data to third parties. Ever.
• We don't run ad tracking. There is no Google Analytics, Facebook Pixel, or similar embedded in our apps.
• We don't share your phone number outside Flax except with our courier (Borzo) and our kitchen partner (Petpooja) — and only for the specific order they're fulfilling.

Who we share with

To get your food to you, the following partners receive the minimum data required:

• Razorpay — payment processing. Receives the order amount + your contact for receipts.
• Petpooja — our kitchen + billing system. Receives the order items + your delivery address + phone for kitchen call-back.
• Borzo — last-mile rider partner. Receives the pickup outlet and your drop address + phone.
• Msg91 — sends our WhatsApp + SMS notifications. Receives your phone number + the message body.
• Supabase — our database hosting. All your data lives in their Singapore region.

Each partner has signed a data-processing agreement with us. None of them have permission to use your data for their own marketing.

How long we keep your data

• Account + profile: as long as your account exists. Delete the account → we delete the data within 30 days.
• Order history: 7 years (required by Indian tax law).
• Push tokens: deleted automatically when you uninstall the app.
• Crash logs: 90 days.

Your rights

You can:

• See everything we have about you — email us at privacy@flaxitup.com and we'll send a copy within 30 days.
• Correct anything that's wrong — just edit your profile or addresses in the app.
• Delete your account — tap Account → Sign out → "Delete my data" (mobile app) or email us.
• Opt out of marketing notifications — toggle them off in the OS notification settings; or reply STOP to any WhatsApp message.

Changes to this policy

If we materially change what we collect or who we share with, we'll notify you in-app and via email at least 30 days before the change takes effect.

Children

OneLife is not for children under 13. We do not knowingly collect data from anyone under 13. If you believe we have, contact us and we'll delete it within 7 days.