FoodLyft Privacy Policy
Effective date: 12 October 2026 Last updated: 12 October 2026
This Privacy Policy explains how FoodLyft ("we", "us", "our") collects, uses, shares, stores and protects personal data when you use:
- the FoodLyft customer app and website (www.foodlyft.app);
- the FoodLyft Partner app (for restaurants, marts and their staff);
- the FoodLyft Rider app (for delivery riders); and
- any related service, page, email or support channel that links to this Policy
(together, the "Platform").
This Policy forms part of, and should be read together with, our Terms & Conditions, Refund & Cancellation Policy, Partner Terms and Rider Terms.
By creating an account or using the Platform you confirm that you have read and understood this Policy. Where we rely on your consent (see section 4), you give that consent by accepting it in the app or by enabling the relevant permission on your device, and you may withdraw it at any time.
1. Our role
FoodLyft is a technology platform that connects customers with independent restaurants, marts and other vendors ("Vendors"). Vendors sell their own products, set their own prices, receive payment directly from customers, and engage their own delivery riders.
- For data we collect to run the Platform (accounts, app activity, support, safety and conduct records), FoodLyft decides how and why it is used.
- When a Vendor receives your order details to prepare and deliver your order, that Vendor is independently responsible for how it uses that data. Our Partner Terms restrict Vendors to using customer data only to fulfil the order and handle related complaints.
2. Personal data we collect
2.1 Customers
| Category | Examples | Source |
|---|---|---|
| Account details | Name, email address, mobile number, password (stored only as a one-way hash), profile picture | You |
| Sign-in with Google or Apple | Name, email address and a provider identifier supplied by Google or Apple (Apple may give us a private relay email) | Google / Apple, with your permission |
| Delivery addresses | Address label, street address, apartment, area, delivery instructions, map pin (latitude/longitude) | You |
| Device location | Your approximate or precise location once, while the app is open, to show Vendors that deliver to you and to sort them by distance. We do not track customer location in the background. | Your device, with your permission |
| Orders | Items, quantities, prices, fees, tax, tip, promo code, scheduled time, delivery address and pin, notes to the kitchen and rider, order status history | You and the Platform |
| Payment information | Payment method chosen (cash, bank transfer, Raast, JazzCash, Easypaisa) and any transaction reference you enter. We do not collect or store card numbers, bank passwords, PINs or wallet credentials. | You |
| Complaints, disputes and appeals | Complaint type, description, photos you upload, your answers to "Did you receive your order?", appeal text, refund confirmations | You |
| Reviews | Star rating and review text | You |
| Account standing | Delivered orders, missed deliveries, refused cash orders, payment confirmations, complaint outcomes, strikes, restrictions and appeals | The Platform, Vendors, riders and our support staff |
| Preferences | Notification choices, favourite Vendors and products, basket, recent searches and filters (some are stored only on your device) | You |
Health information you choose to share. Kitchen notes may include allergy or dietary information. Please share only what the Vendor needs to prepare your order. We pass these notes to the Vendor only to fulfil your order. FoodLyft does not verify allergen, dietary, halal or ingredient claims made by Vendors.
2.2 Vendors and Vendor staff (Partner app)
- Account details: name, email address, mobile number, password hash, profile picture, role (owner or kitchen staff).
- Business details: business name, address and map location, phone, email, logo, description, opening hours, delivery settings, tax rate, menu items, prices and photos.
- Payment account details you publish to customers: account holder name and account number, IBAN, wallet mobile number or Raast ID. These are intentionally shown to customers so that they can pay you. Do not add an account you do not want customers to see.
- Vendor application details: contact name, phone, email, cuisine and description.
- Business identity and compliance documents we may ask for during onboarding, such as CNIC, NTN/STRN and food authority licence.
- Order, complaint, refund-proof, strike, appeal and performance records linked to your business.
2.3 Riders (Rider app)
- Account details: name, email address, mobile number, password hash, profile picture, and the Vendor that added you.
- Precise location (including in the background) while you have an active delivery. Location is collected only while an order assigned to you is in "assigned", "picked up" or "arrived" status, including when the app is in the background or closed. On Android a persistent notification shows while this is happening. Outside an active delivery the app may read your last known location once, while open, to sort available orders by distance; it does not stream your location.
- Delivery evidence: GPS position when you mark arrival, delivery, no-show or offline handover; door-step photos you take for a no-show or a handover without a delivery code; cash amounts you record as collected.
- Conduct records: complaints about you, outcomes, strikes, blocks and appeals.
2.4 Collected automatically from all users
- Device data: a device identifier generated by the app, device name, platform, operating system version, app version and push-notification token.
- Security and log data: IP address, browser or app user agent, sign-in times, failed sign-in attempts, and records of security-relevant actions (for example password resets, account deletion).
- Technical data from photos: photos you upload may contain embedded information such as the time or location they were taken. You can remove this information on your device before uploading.
2.5 What we do not collect
We do not use advertising identifiers, cross-app tracking, third-party analytics or crash-reporting SDKs, and we do not access your contacts, microphone, call logs or SMS messages. If this changes, we will update this Policy and ask for consent where required.
3. How we use personal data
| Purpose | Data used |
|---|---|
| Create and secure your account; verify your email; let you sign in with Google or Apple; prevent unauthorised access | Account, device, security data |
| Show Vendors that deliver to you, calculate delivery fees and estimated times | Addresses, device location |
| Pass your order to the Vendor and the rider, and let you track it | Order, address, contact and location data |
| Show you the Vendor's payment account and let the Vendor or rider confirm your payment | Payment method, transaction reference |
| Confirm delivery using a delivery code, and handle no-shows, disputes and missing orders | Order, rider GPS, photos |
| Handle complaints, refunds, disputes and appeals | Complaints, photos, order records |
| Keep the Platform safe and fair: detect fraud, false complaints, missed deliveries and misuse, and apply account standing rules (section 5) | Account standing and order records |
| Review listings and customer reviews before or after they appear (section 5) | Listing content, review text |
| Send service messages (order updates, security notices, account standing notices) | Contact details, push token |
| Send offers and news, only if you have opted in | Contact details, push token |
| Provide support and respond to your requests | Anything you send us |
| Comply with law, court orders and lawful requests; establish, exercise or defend legal claims | Any relevant data |
| Improve and maintain the Platform | Aggregated or de-identified data where possible |
4. Legal grounds
We process personal data on the following grounds, as recognised under the laws of Pakistan:
- Contract: to provide the Platform under our Terms (accounts, orders, delivery, support).
- Consent: for device location, background location for riders, push notifications, marketing messages and optional photos. You can withdraw consent in your device settings or in the app; this will not affect processing that took place before withdrawal, but some features may stop working.
- Legal obligation: to comply with the Prevention of Electronic Crimes Act, 2016, tax laws, food safety laws, consumer protection laws, court orders and lawful directions of authorities.
- Legitimate interests: to keep the Platform safe, prevent fraud and abuse, enforce our Terms and defend legal claims, where those interests are not overridden by your rights.
5. Automated decisions and moderation
Account standing rules. The Platform applies published rules automatically. For example: limits on open cash orders for new accounts; switching off cash on delivery after repeated missed deliveries or refused cash orders; requiring payment before cooking; pausing ordering after false complaints; and strikes and restrictions for Vendors and riders. These rules are explained in our Terms. You can appeal any strike once, within 7 days, and the appeal is decided by a member of our staff.
AI-assisted moderation. Vendor listings (names, descriptions, menu text and images), Vendor applications and customer review text may be checked by an automated AI moderation service to detect prohibited, unsafe or abusive content. Content flagged by the service may be held, rejected or sent for human review. If your content is rejected and you believe this is wrong, contact us at support@foodlyft.app and a member of staff will review it.
6. Who we share personal data with
We do not sell personal data. We share it only as follows:
(a) With other users, to complete an order
- The Vendor receives your name, email address, order details, delivery address and map pin, and your notes. Your phone number is not shown to the Vendor by default.
- The rider delivering your order receives your name, delivery address and map pin, rider notes, the amount to collect, and the contact details needed to reach you about the delivery.
- You receive the Vendor's business details and published payment account, and the rider's name, phone number and live location while your order is on its way.
- Riders' locations are shared with the customer and the Vendor while the delivery is active.
- Reviews you post are shown publicly with your first name or display name and profile picture.
(b) With our service providers, who process data on our instructions and under confidentiality obligations:
| Provider | Purpose | Location |
|---|---|---|
| Contabo GmbH (or our then-current hosting provider) | Servers, databases and caches that run the Platform | Germany (EU) |
| Amazon Web Services (S3) | Storage of uploaded images and photos | United States |
| Google (Firebase Authentication, Firebase Cloud Messaging, Google Sign-In, Google Maps, Google Places) | Sign-in, push notifications, maps and address search | Global |
| Apple (Sign in with Apple, Apple Push Notification service) | Sign-in and push notifications on iOS | Global |
| Our email delivery provider | Verification codes and service emails | Outside Pakistan |
| OpenRouter and the AI model providers it routes to | Automated checks on listings and reviews (section 5) | Outside Pakistan |
| Stripe (only if card payments are enabled) | Card payment processing | Global |
| Cloudflare and Vercel | Website hosting and content delivery | Global |
(c) For legal reasons: to courts, the Federal Investigation Agency, the Pakistan Telecommunication Authority, tax authorities, food authorities, police or other authorities where required by law or a valid order, or where needed to protect the safety of any person, prevent fraud, or establish, exercise or defend legal claims.
(d) In a business transfer: to a buyer, investor or successor in a merger, acquisition, financing or sale of assets, who must protect your data in line with this Policy.
(e) With your consent or at your direction.
7. International transfers
Some of our service providers store or process data outside Pakistan (see the table above). When we transfer data abroad, we use providers that maintain recognised security standards and contractual protections. By using the Platform you acknowledge these transfers. Where Pakistani law requires a particular safeguard or approval for a transfer, we will comply with it.
8. How long we keep data
| Data | How long |
|---|---|
| Account details | While your account is active. On deletion, see section 10. |
| Order and transaction records | Up to 6 years after the order, to meet tax, accounting and legal obligations and to defend claims. After account deletion they are kept without your name, email, phone or photo. |
| Delivery addresses and favourites | Until you remove them or delete your account |
| Rider location trail | 90 days after the delivery, or longer if needed for an open complaint, dispute or legal claim |
| Complaint, dispute, refund and evidence photos | 1 year after the matter is closed, or longer if needed for a legal claim |
| Account standing and strike records | While your account is active and for 2 years after, to prevent abuse by repeat offenders |
| Push tokens | Until you sign out, or 60 days of inactivity |
| Security logs (IP address, user agent) | 12 months |
| Backups | Overwritten on a rolling cycle of up to 90 days |
We may keep data longer where required by law or a court order, or while a legal claim is pending.
9. Security
We use reasonable technical and organisational measures to protect personal data, including encrypted connections (HTTPS/TLS), hashed passwords, short-lived access tokens, access controls and account lockout after repeated failed sign-ins. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password and devices secure and for telling us immediately at support@foodlyft.app if you suspect unauthorised use of your account.
If we become aware of a personal data breach that is likely to harm you, we will notify you and any authority as required by applicable law.
10. Your rights and choices
Subject to applicable law, you may:
- access the personal data we hold about you;
- correct inaccurate data (most details can be edited in the app);
- delete your account and personal data;
- withdraw consent (for example location, notifications or marketing);
- object to marketing at any time; and
- complain to us and, where a data protection authority exists under Pakistani law, to that authority.
Deleting your account
- Customers: in the app go to Profile → Privacy → Delete account, or visit www.foodlyft.app/delete-account. You cannot delete your account while an order is in progress.
- Vendors and riders: email privacy@foodlyft.app from the email address on your account. Vendor accounts with open orders, complaints or refund obligations will be closed once those are resolved.
When you delete your account, we delete or permanently de-identify your name, email, phone, photo, addresses, favourites and device tokens, and sign you out everywhere. We keep order, complaint and account standing records without your identifying details for the periods in section 8, because Vendors, tax authorities and fraud prevention need them. Reviews you posted remain but are shown as "Deleted user".
To exercise any other right, email privacy@foodlyft.app. We will verify your identity and respond within 30 days. We may refuse requests that are unlawful, manifestly unfounded or excessive, or that would affect other people's rights.
11. Children
The Platform is intended only for people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, contact privacy@foodlyft.app and we will delete it.
12. Notifications and marketing
We send service notifications about your orders, account security and account standing. These are part of the service, and you cannot switch off account security or account standing notices while your account is active. Marketing notifications (offers and deals) are sent only if you have turned them on, and you can turn them off at any time in Profile → Notifications or in your device settings.
13. Third-party sites and services
The Platform links to or uses services operated by others (for example Google Maps, your bank or wallet app, and Vendors' own channels). Their own privacy policies govern how they use your data. We are not responsible for their practices.
14. Changes to this Policy
We may update this Policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, notify you in the app or by email before the change takes effect. Your continued use of the Platform after the effective date means you accept the updated Policy.
15. Contact and grievance officer
Grievance / Data Protection Officer: FoodLyft Privacy Team Email: privacy@foodlyft.app Phone: +92 321 7098094
We aim to acknowledge complaints within 3 working days and resolve them within 30 days.
This Policy is written in English. Any translation is provided for convenience only; if there is any conflict, the English version prevails.