Privacy policy

What we collect, and why.

Last updated 30 August 2026

Controller: ODOD LLC, 4301 Blalock Rd Ste 100, Houston, TX 77041, USA. Contact: hello@grmitra.com.

1. What we collect

Order data: name, delivery and billing address, e-mail, phone, items, prices, delivery choice and carrier quote. Payment: processed by Razorpay; we receive a payment reference and status, never your card number. Account data (when accounts launch): login e-mail, order history, saved addresses. Communications: e-mails, WhatsApp messages and the “Ask the kitchen” chat. Chat messages are processed by an AI assistant provided by Anthropic to answer cooking questions; please do not include personal data you do not want processed. Technical data: IP address, browser, device, pages viewed, and one region cookie (section 6). No advertising tracking is used.

2. Why, and on what legal basis

Fulfilling and delivering your order, customs declarations and invoices — contract. Payment processing and fraud prevention — contract and legitimate interest. Tax, accounting and food-traceability records — legal obligation. Customer service, complaints and returns — contract and legitimate interest. Marketing e-mails or WhatsApp — only with your opt-in, withdrawable any time — consent. Security, logging and site performance — legitimate interest.

3. Who receives your data

Carriers (DHL Express), Razorpay (payments), our hosting providers, our e-mail provider, Anthropic (chat assistant), and our affiliated group company that operates order fulfilment and customer service. Customs authorities receive the data required for import. We never sell personal data.

4. International transfers

Your data is processed in the United States, the European Union and India (our affiliated group company and hosting providers). For transfers out of the EU/UK we rely on Standard Contractual Clauses and the UK Addendum.

5. Retention

Order and invoice data: as long as tax and food-traceability law requires (typically 7–10 years, depending on jurisdiction). Marketing consent: until withdrawn. Chat logs: 90 days. Technical logs: 12 months.

6. Cookies

We use one strictly-necessary cookie to remember your selected region/currency and your cart session. We do not use analytics or advertising cookies. If that changes we will ask for your consent first where the law requires it.

7. Your rights

EU/UK: access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to your supervisory authority. US residents (including under the Texas TDPSA and California CCPA/CPRA where applicable): access, correction, deletion, and to opt out of sale or sharing — we do not sell or share personal data for targeted advertising. To exercise any right, e-mail hello@grmitra.com. We respond within one month (EU/UK) or 45 days (US).

8. Children

The Store is not directed at children under 16 and we do not knowingly collect their data.

9. Security

TLS on every page, access controls and encrypted backups; payment card data never touches our servers.

10. Changes

We post the current version here with its date.