Privacy Policy | Fourth Idly

1.1 Introduction

Fourth Idly (referred to herein as “we”, “us”, “our”, or “the Platform”) is a digital donation and social-impact logistics platform operating in India. We are committed to protecting the privacy, confidentiality, and security of personal information entrusted to us by users of the Platform, including Donors, NGOs, Volunteers, and authorised administrators.

This Privacy Policy explains how Fourth Idly collects, processes, stores, uses, shares, and protects personal data when you register for or use the Fourth Idly mobile application and related digital services, including the administrative web panel where applicable. It is intended to reflect the current implemented application flow, including account onboarding, NGO and Volunteer verification, donation coordination, delivery logistics, UPI-based Delivery Fee facilitation, notifications, chat, ratings, feedback, impact posts, and administrative dispute handling.

By registering for or using the Platform, you acknowledge that you have read and understood this Privacy Policy. This policy is intended to operate consistently with applicable Indian data-protection requirements, including the Digital Personal Data Protection Act, 2023 (“DPDP Act”), and other applicable laws and regulations. Where applicable law or future regulations require changes to our data practices, this Policy may be updated.

1.2 Definitions

Personal Data — any data about an individual who is identifiable by or in relation to such data, including information such as name, contact details, identifiers, location information, account information, or online/device identifiers, to the extent applicable under law.
Processing — any operation performed on personal data, including collection, recording, organisation, storage, use, disclosure, transmission, retrieval, alteration, restriction, or deletion.
Data Principal — the individual to whom personal data relates, where that terminology applies under applicable Indian data-protection law.
Data Fiduciary — the entity that determines the purpose and means of processing personal data, where that terminology applies under applicable law.
Consent — a freely given, specific, informed, and unambiguous indication of agreement to processing for a stated purpose, where consent is the applicable basis.
NGO — a non-governmental organisation or eligible charitable organisation using the Platform to create Need Requests and receive donated items.
Donor — a user who browses NGO Need Requests and offers food or product items through the Platform.
Volunteer — a user approved to undertake pickup, transport, and delivery tasks associated with donations.
Admin — an authorised Fourth Idly administrator who operates the administrative web panel and may review users, documents, donations, ratings, notifications, audit records, and disputes.
Need Request — an NGO-created request describing food or product items required, including quantity, description, required-by date/time, and applicable pickup/logistics information.
Donation — a donation arrangement created when a Donor offers items against an NGO Need Request.
Delivery Fee — an applicable logistics fee payable by a Donor to a Volunteer when Volunteer delivery is used.
UPI — the Unified Payments Interface used through supported UPI applications, deep links, or QR codes to facilitate an applicable Delivery Fee payment.
Third Party — an entity other than Fourth Idly and the relevant user, including infrastructure, authentication, cloud, notification, mapping, and payment service providers.
Platform — the Fourth Idly mobile application and related digital services, together with the authorised administrative web panel.

1.3 Scope of This Policy

Individuals who register for a Donor, NGO, or Volunteer account.
NGOs and charitable organisations that submit information and documents for administrative approval.
Donors who browse Need Requests and offer food or product items.
Volunteers who register, submit driving-licence documentation, accept tasks, and perform pickup/delivery activities.
Users who communicate through Platform chat, notifications, ratings, feedback, or impact-post features.
Individuals who contact Fourth Idly through available support, grievance, or communication channels.
Authorised administrators and personnel to the extent their personal information is processed in connection with Platform administration.

This Privacy Policy does not govern third-party websites, applications, UPI applications, or other services that you may access independently through links, payment deep links, QR codes, or other integrations. Those services are responsible for their own privacy practices and policies.

1.4 Information We Collect

1.4.1 Personal and Profile Information

Name and display/profile name.
Username or unique account handle.
Email address.
Mobile/phone number and phone OTP verification status.
Location information provided as text, city/area, or other location information entered by the user.
Optional profile photograph.
Role selected during onboarding, such as Donor, NGO, or Volunteer.
Account status, such as pending, approved, active, rejected, or blocked.
Ratings, review totals, and related profile information generated through Platform activity.

1.4.2 Account and Authentication Information

Email/password authentication information needed to create and authenticate the account.
Phone OTP verification information and associated authentication events.
Account creation and update information.
Authentication/session information and relevant security records.
Firebase Authentication account identifiers or other technical identifiers generated by the authentication infrastructure.

Passwords and authentication secrets are handled through the applicable authentication service. Fourth Idly does not intend to store passwords in readable/plaintext form.

1.4.3 NGO Information

Organisation-related information submitted through the NGO onboarding process.
Licence or registration ID supplied for verification.
Uploaded NGO licence/registration PDF and the associated document URL or storage reference.
Organisation profile, contact, and location information supplied by the authorised representative.
Need Request information, including Food/Product type, quantity, unit, description, required-by date and time, and optional pickup map coordinates/address.
Information concerning the NGO’s donation requests, received donations, confirmations, ratings, feedback, and impact posts.

The current implemented onboarding flow specifically provides for NGO licence/registration information and a supporting PDF document. Additional information should only be collected where it is introduced through the Platform and is necessary for the stated purpose.

1.4.4 Volunteer Information

Name, username, phone number, email address, and location.
Driving Licence ID.
Uploaded driving licence PDF and its storage/document reference.
UPI ID used to facilitate applicable Delivery Fee payments.
Vehicle type, where the user provides it as an optional field.
Volunteer task, acceptance, pickup, delivery, and completion information.
Volunteer ratings, review totals, and feedback.

The Platform does not require or intend to collect a Volunteer’s UPI PIN, banking password, OTP, or other banking credentials for its delivery-fee workflow.

1.4.5 Donor Information

Name, username, email, phone number, and location.
Optional profile photograph.
Information concerning food or product items offered through donations, including type, quantity, and relevant description.
Donation history and associated NGO/Volunteer transaction information.
Payment-related status information concerning an applicable Delivery Fee, including the fact that a payment was indicated as made and any payment reference ID voluntarily provided for dispute handling.
Ratings and feedback given to Volunteers.

1.4.6 Donation and Need Request Information

When a Need Request or Donation is created, the Platform may process information necessary to operate the donation workflow, including NGO and Donor identifiers, item type, quantity, unit, description, request/donation status, fulfilled quantity, required-by date/time, pickup location information, Volunteer assignment, delivery status, payment status, rating flags, and timestamps.

Need Requests may be treated as expired after their live-until/required-by date and time or fulfilled when the requested quantity is satisfied. The associated records may be retained as necessary for operational history, safety, audit, ratings, disputes, and legal requirements.

1.4.7 Payment and UPI Information

Where Volunteer delivery requires a Delivery Fee, the Platform may store the applicable fee amount and the Volunteer’s UPI ID with the relevant donation. The Platform may generate a UPI deep link and QR code for the Donor to use in a supported UPI application.

UPI ID of the applicable Volunteer.
Delivery Fee amount associated with the donation.
Payment status, such as pending, paid/verified, rejected, disputed, or other operational status.
Payment reference ID when a Donor voluntarily provides one for a dispute or verification process.
Records of payment-verification actions by the Volunteer and relevant timestamps.

Fourth Idly does not store the Donor’s UPI PIN, bank account password, card PIN, banking OTP, or banking credentials through the Platform. The actual payment transaction is performed through the relevant UPI/payment infrastructure.

1.4.8 Ratings, Feedback and Impact Posts

Star ratings and written feedback submitted by Donors regarding Volunteers.
Ratings submitted by NGOs regarding Donors and, where applicable, Volunteers.
Average-rating and total-review values associated with user profiles.
Optional survey/feedback information where such a feature is available.
Impact posts, captions, photographs, and other community content submitted after donations or other Platform activities.

1.5 Account Registration Data

During onboarding, Fourth Idly collects information necessary to create and maintain an account. The current flow includes role selection, email/password account creation, name, unique username, location, phone number, phone OTP verification, optional profile photo, and role-specific information. NGO and Volunteer accounts may remain in a pending status until an Admin reviews the required documentation.

The Platform may maintain account identifiers, status, authentication records, notification tokens, and other account-management data necessary to provide the requested service.

1.6 Technical, Device and Application Information

The mobile application and supporting services may generate or receive technical information necessary to operate, secure, troubleshoot, and improve the Platform. Depending on the device and services in use, this may include:

Device type and operating-system information.
Application version and technical configuration information.
Network-related information and IP address where available to the relevant infrastructure.
Crash, error, diagnostic, and performance information.
Authentication and session events.
Notification token/device token information used for push notifications.
Cloud-service identifiers and timestamps associated with Platform activity.
Security, audit, and access logs.

The exact technical information available may depend on the device, operating system, Firebase services, and other infrastructure used by the Platform.

1.7 Cookies, Local Storage and Similar Technologies

The current Fourth Idly product is primarily implemented as a Flutter mobile application, with an administrative web panel. Accordingly, the mobile application may use local storage, session identifiers, secure device storage, or similar technologies rather than browser cookies for certain functions. The web-based administrative interface may use cookies or similar technologies where required for authentication, session management, security, or functionality.

Essential technologies required for authentication, security, and Platform operation.
Functional technologies used to remember settings or maintain sessions.
Diagnostic or analytics technologies where implemented to understand performance and Platform usage.
Any future marketing or tracking technologies requiring consent will be introduced in accordance with applicable law and the consent mechanism made available at the time.

1.8 Location Information

The Platform may process location information provided by users or used for logistics functionality. The current flow allows users to provide a location as profile information and allows an NGO to optionally provide a pickup map pin, including pickup latitude, longitude, and pickup address.

Location information may be used to:

Display or coordinate relevant Need Requests and delivery tasks.
Facilitate pickup and delivery logistics.
Help Volunteers understand the location associated with an assigned task.
Support Platform functionality involving geographically relevant information.
Maintain records necessary for donation, delivery, safety, support, or dispute resolution.

Where the device operating system requires permission to access precise location, the application will request the relevant permission. Users can manage device-level location permissions through their device settings, subject to the effect this may have on features requiring location.

1.9 Communications and Notification Data

When you contact Fourth Idly through support, grievance, or other communication channels, we may retain records of the correspondence, including contact details, message content, timestamps, and information needed to respond.

The Platform also processes notification information to provide operational alerts. The current notification system may include donation offers, volunteer acceptance, new messages, tags, donation cancellations, expired requests, delivery arrival, payment pending, payment verification, payment verification completion, new task availability, urgent tasks, payment rejection, and payment disputes.

A Firebase Cloud Messaging token or comparable device notification token may be stored with a user account to deliver push notifications. Users can control notification permissions through supported device settings. Transactional notifications may be necessary for core Platform workflows.

1.10 User-Generated Content

Content submitted through the Platform may include Need Requests, donation descriptions, profile information, photographs, chat messages, ratings, feedback, and impact posts. Such content may be stored and displayed to other users where necessary for the relevant Platform function.

For example, an NGO Need Request may be visible to Donors so that they can determine whether to donate. Delivery-related profile/contact information may be made available to relevant participants where necessary to coordinate pickup and delivery. Ratings and impact posts may be displayed according to the Platform’s current visibility rules.

You retain rights you may have in content you create, subject to applicable law and the rights granted to Fourth Idly under its Terms and Conditions. You are responsible for ensuring that content you upload does not infringe another person’s privacy, intellectual property, or other rights.

1.11 Information Received from Third Parties

The current Platform may receive or process information through third-party infrastructure and services used to operate the application. This may include authentication identifiers from Firebase Authentication, cloud-stored records and document references from Firebase services, notification delivery information from Firebase Cloud Messaging, and payment-related information or status arising from UPI applications or infrastructure.

Fourth Idly may also receive information from an NGO, Donor, Volunteer, or other participant when that person provides information about another participant in connection with a donation, delivery, rating, feedback, support request, or dispute.

Where information is received from third parties, it will be handled in accordance with this Privacy Policy and applicable law.

1.12 Legal Basis and Purpose of Processing

Depending on the nature of the processing and applicable law, Fourth Idly may process personal data on the basis of consent, performance of a requested service or contractual necessity, compliance with legal obligations, legitimate interests where recognised by applicable law, or other lawful grounds available under Indian law.

Where consent is required, Fourth Idly will seek consent through an appropriate notice or permission mechanism. Where processing is necessary to provide a core Platform function, refusing the relevant information or permission may prevent that function from operating.

1.13 How We Use Your Information

To create, authenticate, maintain, and secure user accounts.
To verify NGO registration/licence documents and Volunteer driving-licence documents as part of administrative approval.
To manage account status, including pending, approved, active, rejected, and blocked states.
To connect Donors with NGO Need Requests.
To create and manage donations and associated fulfilment information.
To identify, notify, and coordinate Volunteers for delivery tasks.
To facilitate pickup, delivery, and receipt confirmation.
To generate and display applicable UPI payment links and QR codes for Delivery Fees.
To record payment status and support Volunteer payment verification.
To investigate payment disputes and notify Admins where administrative review is required.
To provide chat, in-app notifications, and push notifications.
To support ratings, feedback, profile review information, and impact posts.
To detect and prevent fraud, abuse, account misuse, payment manipulation, and other prohibited conduct.
To maintain audit records and investigate disputes or security incidents.
To troubleshoot, improve, and maintain the performance and functionality of the Platform.
To respond to support requests and grievances.
To comply with applicable laws, lawful requests, and regulatory requirements.
To generate anonymised or aggregated information about Platform use and social impact where reasonably possible.

1.13.1 AI Processing

The current application-flow document does not identify an implemented AI processing feature. Fourth Idly may introduce AI-assisted features in the future, such as recommendations, matching assistance, moderation, or content-processing tools. If such processing materially changes how personal data is used, this Privacy Policy will be updated as appropriate and any legally required notice, consent, objection, or human-review mechanism will be provided.

1.14 Data Sharing and Disclosure

1.14.1 Sharing Between Platform Participants

Certain information must be shared with other Platform participants to make the requested service possible. For example, an NGO’s Need Request must be made available to relevant Donors; donation and delivery information may be shared with the relevant NGO, Donor, and Volunteer; and information necessary to coordinate a delivery may be shown to the participants involved in that task.

Sharing is intended to be limited to information reasonably necessary for the relevant workflow, subject to the Platform’s design and applicable law.

1.14.2 Third-Party Service Providers

Fourth Idly may use trusted third-party providers to host, authenticate, store, secure, analyse, communicate, or otherwise operate Platform services. The current technical implementation includes Firebase Authentication, Cloud Firestore, Firebase Cloud Messaging, and Firebase Storage. Firebase Storage may be used for profile photographs and licence PDF documents, while Firestore may store user, listing, donation, notification, post, feedback, and related operational records.

Third-party providers may process information on Fourth Idly’s behalf and may be subject to their own technical, contractual, and legal requirements. Fourth Idly will take reasonable steps appropriate to the relationship and applicable law to protect information shared with service providers.

1.14.3 Payment and UPI Services

Fourth Idly facilitates applicable Delivery Fee payments through UPI deep links and QR codes. When a Donor chooses to pay, the Donor may be redirected to or interact with a third-party UPI/payment application. Fourth Idly may process the payment amount, Volunteer UPI ID, payment status, and voluntarily supplied reference information necessary for the Platform workflow and dispute handling.

Fourth Idly does not intend to receive or store UPI PINs, banking passwords, OTPs, or other banking credentials. The privacy practices of the selected UPI/payment application are governed by that provider’s own policies.

1.14.4 Government, Legal and Safety Requests

Fourth Idly may disclose personal data to government authorities, courts, law-enforcement agencies, regulators, or other lawful authorities where required or permitted by applicable law, legal process, court order, or valid request. We may also disclose information where reasonably necessary to protect the safety, rights, property, or security of Users, Fourth Idly, or the public, subject to applicable law.

1.14.5 Business Transfers

If Fourth Idly undergoes a merger, acquisition, restructuring, financing, transfer of assets, or similar business transaction, personal data may be transferred as part of that transaction, subject to applicable law and appropriate privacy protections. Where required, affected Users will be provided with appropriate notice.

1.15 Security Measures

1.15.1 Transport and Storage Security

Fourth Idly uses security measures appropriate to the Platform and the services it relies upon. Data transmitted between the application and supporting services may be protected through industry-standard encrypted communications such as TLS. Firebase and other infrastructure may provide additional security controls for stored information.

No security measure can guarantee absolute security. Users should protect their account credentials, verification codes, devices, and information shared through chat or other Platform features.

1.15.2 Authentication and Access Controls

The Platform uses Firebase Authentication and the onboarding process may include email/password authentication and phone OTP verification. Access to Platform data is intended to be controlled according to user role and administrative permissions. NGO and Volunteer verification documents are intended to be accessible to authorised personnel for the relevant verification and administrative purposes.

1.15.3 Administrative and Audit Controls

The administrative panel may maintain information concerning user approvals, blocks, donations, deliveries, feedback, notifications, and audit records. Such information may be reviewed by authorised Admins for Platform administration, fraud prevention, dispute resolution, security, and compliance.

1.16 Data Retention

Fourth Idly retains personal data for as long as reasonably necessary for the purposes described in this Policy, to provide the requested services, maintain transaction and operational history, resolve disputes, prevent fraud, comply with legal obligations, and protect the Platform.

Active account and profile data may be retained while the account remains active and for a reasonable period thereafter where necessary.
NGO and Volunteer verification information and uploaded licence documents may be retained for the verification, security, audit, dispute, and legal purposes for which they were collected, subject to applicable retention requirements.
Donation, Need Request, delivery, payment-status, rating, and dispute records may be retained as necessary to maintain transaction history, resolve disputes, prevent abuse, and comply with law.
Notification, chat, support, and communications records may be retained for operational, security, support, and dispute-resolution purposes for as long as reasonably necessary.
Technical and diagnostic records may be retained according to the needs of security, troubleshooting, analytics, and service operation.
Information that is no longer required may be deleted, anonymised, or otherwise handled in accordance with applicable law and operational requirements.

Where a user requests deletion, certain information may need to be retained for legal compliance, fraud prevention, security, accounting, dispute resolution, or other lawful purposes.

1.17 User Rights

Subject to applicable Indian data-protection law and any applicable conditions or exemptions, Users may have rights concerning their personal data, including:

Right to access or obtain information about personal data processed about you, where provided by law.
Right to correction of inaccurate or incomplete personal data.
Right to erasure/deletion where legally available and where retention is not required by law or another lawful purpose.
Right to withdraw consent where processing is based on consent, without affecting the lawfulness of processing performed before withdrawal.
Right to grievance redressal through the designated contact or mechanism.
Other rights that may become applicable under the DPDP Act or rules/regulations issued under it.

The exact scope and manner of exercising these rights may depend on applicable law and the nature of the request.

1.17.1 Data Access and Correction Requests

To request access, correction, deletion, withdrawal of consent, or other privacy assistance, use the privacy/grievance contact details made available by Fourth Idly through the Platform or its official privacy notices. We may require reasonable verification of identity before acting on a request in order to prevent unauthorised disclosure or deletion.

We will handle verified requests within the period required by applicable law and will communicate where additional information or verification is necessary.

1.17.2 Account Deletion

Users may request deletion of their account through any account-deletion functionality provided in the Platform or by contacting the designated support/privacy channel. Account deletion may result in removal or deactivation of profile information and access to Platform features.

Deletion may not immediately remove information that must be retained for legal compliance, security, fraud prevention, unresolved payment disputes, transaction records, audit, or other lawful purposes. Where appropriate, retained information will be restricted to the purpose for which it is required.

1.18 Children’s Privacy

The Platform is intended for users who are legally eligible to use the service and, where the applicable Terms require it, for individuals aged 18 or above. We do not knowingly seek to collect personal data from children in violation of applicable law. If we become aware that personal data has been collected from a child contrary to applicable requirements, we will take reasonable steps to address and delete or otherwise handle the data as required by law.

1.19 International Data Transfers and Processing

Fourth Idly’s operations are intended to serve users in India, but third-party infrastructure providers used by the Platform may process or store information in locations outside India depending on their architecture, service configuration, and applicable terms. Where personal data is transferred or processed across jurisdictions, Fourth Idly will apply safeguards required by applicable law and the relevant contractual/service arrangements.

1.20 Marketing Communications

The current Platform flow is primarily focused on transactional and operational communications related to donations, deliveries, payments, account verification, notifications, ratings, and other Platform activities.

Where Fourth Idly introduces marketing communications, promotional messages, newsletters, or similar communications that require consent under applicable law, appropriate consent and preference-management mechanisms will be provided. Users may withdraw marketing consent where applicable without affecting the processing required for core Platform operations.

1.21 Push Notifications

The Fourth Idly mobile application uses push notifications to support the current donation and logistics workflow. Notifications may relate to donation offers, volunteer acceptance, new messages, tags, cancellations, expired requests, delivery arrival, payment pending, payment verification, payment verification completion, new task availability, urgent tasks, payment rejection, and payment disputes.

The application may store a Firebase Cloud Messaging token or similar device identifier associated with the account to deliver such notifications. Users can grant, deny, or revoke notification permissions through their device settings where supported. Disabling notifications may prevent timely receipt of operational alerts and may affect the user experience, but it does not by itself delete the account.

1.22 Chat, Ratings and Community Privacy

Information shared through chat may be visible to the participants involved in the relevant donation or delivery conversation and may be retained for support, security, moderation, and dispute resolution. Users should avoid sharing passwords, OTPs, UPI PINs, banking credentials, or unnecessary sensitive information through chat.

Ratings and feedback may be associated with the relevant donation and user profiles and may be accessible to authorised administrators. Impact posts and other community content may be displayed according to Platform functionality. Users are responsible for obtaining appropriate permission before publishing identifiable photographs or personal information about another person.

1.23 Data Minimisation and Accuracy

Fourth Idly seeks to collect information that is reasonably necessary for the functions described in this Privacy Policy. Users are responsible for providing accurate information and updating material changes where the Platform provides the ability to do so. Incorrect information may affect account verification, task matching, delivery, notifications, payment verification, or support.

1.24 Changes to This Policy

Fourth Idly may update or amend this Privacy Policy from time to time to reflect changes in the Platform, data practices, security measures, third-party services, legal requirements, or application functionality. Material changes may be communicated through the Platform or other appropriate means where required. The effective date and last-updated date will be revised when the Policy is materially changed.

Users are encouraged to review this Privacy Policy periodically, particularly when new features such as payment, location, communication, analytics, AI, or other data-processing functionality are introduced.

1.25 Governing Law

This Privacy Policy is intended to be governed by the laws of India, including applicable provisions of the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and regulations or rules applicable to the processing of personal data. Any disputes concerning this Privacy Policy shall be subject to the jurisdiction of the courts or authorities having lawful jurisdiction over the matter.

1.26 Contact Details

For privacy requests, grievances, account-related concerns, or questions about processing of personal data, Users should use the official privacy, grievance, and support contact details published by Fourth Idly through the Platform or its official communications.

The contact email addresses and registered postal address should be inserted here once Fourth Idly’s final official legal/contact details are confirmed. Placeholder contact details from the earlier Charitey document have intentionally not been carried over.

1.27 Consent and Acknowledgement

By creating an account, granting applicable permissions, submitting information, creating a Need Request or Donation, accepting a delivery task, using chat or notification features, or otherwise using the Fourth Idly Platform, you acknowledge that you have read and understood this Privacy Policy.

Where consent is the applicable legal basis, Fourth Idly will seek consent through an appropriate mechanism and you may withdraw consent in accordance with applicable law. Withdrawal of consent may affect the availability of a feature where the processing is necessary to provide that feature. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

1.28 Current Platform Data Flow Reference

The current implemented application flow involves: user role selection → email/password account creation → profile information → phone OTP verification → optional profile photo → NGO or Volunteer verification information where applicable → account activation/approval → NGO Need Request creation → Donor browsing and donation → optional Volunteer task matching → acceptance → pickup → delivery → NGO delivery-arrival notification and receipt flow → applicable UPI Delivery Fee payment → Volunteer payment verification or dispute → completion → ratings, feedback, and impact-post flow.

Personal data may be processed at each stage only as reasonably necessary to provide, secure, administer, audit, support, or legally operate the relevant workflow. This section is intended to help users understand how the current application flow relates to the categories of information described in this Policy.