Privacy Policy

We collect information you provide directly to us, including:

• Account Information: Name, email address, phone number, delivery address, and account credentials when you create an account.
• Profile Information: Profile picture, preferences, favorite restaurants, and saved addresses.
• Order Information: Order history, delivery instructions, payment method details, and order preferences.
• Communication: Messages, reviews, feedback, and support inquiries you send to us.
• Payment Information: When you make a purchase, our payment processors collect payment card details, billing address, and transaction data. We do not store full payment card numbers on our servers.

We also automatically collect certain information when you use our Platform:

• Device Information: IP address, browser type, operating system, device identifiers, and mobile network information.
• Usage Data: Pages visited, features used, time spent, referring URLs, and interaction data.
• Location Data: Mitho Map collects and uses your device's precise location to find restaurants and deliveries near you, provide accurate delivery tracking and ETAs, and show nearby deals and personalized recommendations. Your location is used only while the app is open. You can change this permission anytime in your device settings.
• Cookies & Similar Technologies: As described in our Cookie Policy.

We use the collected information for the following purposes:

• To process and deliver orders, including sharing information with restaurants and delivery partners.
• To create and manage your account, provide customer support, and communicate with you about your orders.
• To improve our Platform, develop new features, and personalize your experience.
• To send transactional communications (order confirmations, delivery updates) and, with your consent, marketing communications.
• To detect, prevent, and address fraud, security issues, and violations of our Terms of Service.
• To comply with legal obligations and enforce our rights.

If you are located in the European Economic Area (EEA), we process your personal data under the following legal bases:

• Contractual Necessity: To fulfill our contract with you when you use our Platform to place orders.
• Consent: For marketing communications, location data collection, and cookie usage where required.
• Legitimate Interests: For fraud prevention, network security, analytics, and service improvement, where our interests do not override your fundamental rights.
• Legal Obligation: To comply with applicable laws and regulations.

We may share your information with:

• Restaurants & Delivery Partners: To fulfill your orders, including your name, delivery address, phone number, and order details.
• Service Providers: Payment processors, cloud hosting (e.g., AWS), analytics providers, customer support tools, and email delivery services.
• Legal Authorities: When required by law, court order, or to protect our rights and safety.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice to you.

We do not sell your personal information to third parties for their own marketing purposes.

We retain your personal data for as long as your account is active or as needed to provide you with our services. After account deletion, we retain certain data for legitimate business purposes (fraud prevention, legal compliance, dispute resolution) for up to 90 days, or longer where required by law.

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data (subject to legal obligations).
• Portability: Request a machine-readable copy of your data (GDPR right).
• Restriction: Request restriction of processing in certain circumstances.
• Objection: Object to processing based on legitimate interests or direct marketing.
• Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise your rights, contact us at [email protected]. We will respond within 30 days. If you are in the EEA, you also have the right to lodge a complaint with your local data protection authority.

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions.
• Right to Opt-Out: We do not sell your personal information. You have the right to opt out of any future sale of your personal information.
• Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise your CCPA rights, contact us at [email protected]. We will verify your identity before processing your request.

Your information may be transferred to and processed in countries other than your own, including Nepal and the United States. We ensure appropriate safeguards are in place through Standard Contractual Clauses (SCCs) or other approved transfer mechanisms to protect your data.

Our Platform may contain links to third-party websites or services (e.g., payment processors, social media). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and, where appropriate, via email or in-app notification. Your continued use of the Platform after changes constitutes acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection Officer: