Privacy Policy

FoodLoot Ventures
Version: 2.1
Effective Date: 22 September 2026
Replaces: the Privacy Policy dated 21 September 2026

How we handle personal data for customers, vendors and home chefs, job and internship applicants, and visitors to this website. What this website stores in your browser is set out separately in the Cookie Policy.

The short version

We collect what we need to run FoodLoot: your account and contact details, your orders and payments, where you are (if you allow it), where you want food delivered, and what you send to support.
Vendors see your name and order. Delivery partners and riders get your name, phone number and address for that delivery only, and must delete them within 30 days.
We use location, device and payment signals to stop fraud, for example one person running many accounts to buy up a vendor's bags.
We use payment, messaging, maps, hosting and crash-reporting companies to run the service. We do not sell your data.
The app tells Meta (Facebook and Instagram) when it is installed and opened, when you sign up and when you pay, with your phone's advertising ID, so we can see which of our ads work. On iPhone, we share the advertising ID only if you tap Allow. We never send Meta your name, email, phone number or address.
You can see, correct or delete your data, and turn off location and promotional messages.

1. Who we are

FoodLoot Ventures ("FoodLoot", "we") runs the FoodLoot app and the website foodlootpk.com. Our office is at Plot No. 15, Sector B-VI, Phase 1, Export Processing Zone, Korangi, Landhi Town, Karachi, Pakistan.

For anything about your personal data, contact support@foodlootpk.com.

This policy covers:

customers;
vendors and their staff, including home chefs;
people who apply to work or intern with us;
visitors to our website.

2. What we collect

2.1 Customers

What	Examples	Where it comes from
Account	Name, email, phone number, login method (email, Google or Apple), and whether your phone number is verified	You, Google or Apple
Preferences	Food preferences and goals you choose at sign-up, notification settings, vendors you follow, favourites, drop alerts	You
Location	Your precise location, if you allow it; drop-alert locations	Your device
Addresses	Saved delivery addresses: address line, map pin, directions, and an extra contact number if you add one	You
Orders	Bags ordered, vendor, pickup or delivery, times, pickup code, order status, no-shows	Your use of the app
Delivery	Delivery address used for each order; rider name and phone; delivery status and times; proof-of-delivery photo	You, the vendor, the delivery partner
Payments	Amount, method, payment reference and result. For saved cards: a token, card type, last four digits, the first six and last four digits of the card number, and the name on the card. For mobile wallets: your wallet number. We never see or store your full card number or PIN.	You, our payment partners
LootWallet	Top-ups, refunds, credits, spending, balance	Your use of the app
Rewards	Promo codes used, referral and ambassador records, stamps and rewards	Your use of the app
Reviews	Ratings, review text and photos	You
Support	Chat messages, emails, photos you send, call notes, complaint reports and outcomes	You, our support team
Device and security	Device model, operating system, app version, push token, a device identifier that stays the same if you reinstall the app, IP address, browser details, crash reports	Your device
Advertising	Your phone's advertising ID (on iPhone, only if you allow tracking); when the app is installed and opened; when you sign up; the amount and number of bags of each paid order (section 6.5)	Your device, your use of the app
Fraud-prevention signals	Location, IP address and device identifiers at sign-in, checkout, top-up and pickup; links between accounts that share a device, phone number or payment card	Your device, our systems

2.2 Vendors, staff and home chefs

Business and contact details: business and branch names, owner and staff names, phone numbers and emails, CNIC or NTN, food-safety registration numbers.
Bank and tax details for payouts: bank name, account title, IBAN, and sales-tax registration.
Branch information: branch addresses and map locations, opening hours, logo, photos, listings, pickup windows and auto-posting schedules.
Orders and payouts: orders, payouts, statements, deductions and ratings.
Handover photos: photos of packed orders and receipts, with who took them and when.
Staff location: for staff who confirm pickups, the location and device used when confirming.
Home chefs: also your home address, map location, gate photo and pickup instructions.

2.3 Job and internship applicants

We collect:

your name, email and WhatsApp or phone number, and your city;
your university or work history, your CV, and your portfolio or social links;
your expected salary and start date;
your answers to application questions and tests, and how you took the timed test (time used, time to first keystroke, and blocked paste attempts);
the IP address and browser used to apply.

2.4 Website visitors

Our website uses first-party analytics that we run ourselves. It is not linked to your FoodLoot account. We record:

pages viewed;
the referring page and campaign tags;
your browser details, language, time zone and device type;
clicks on app-store links and on our short links, including the tags in those links.

We estimate your country from your time zone. Your IP address is used briefly to stop abuse and is not stored.

We keep five small values in your browser's local storage, and no cookies. They hold a random visitor ID and visit ID, and remember how you first and most recently arrived (campaign, referring site and landing page). See the Cookie Policy.

If you join a waitlist or sign up for updates on the website, your email address is sent to Loops, our email-list provider.

2.5 We do not collect

We do not collect your date of birth, gender, contacts list, or health information. The exception is anything you choose to tell support, for example about an allergic reaction.

3. How we use it

Purpose	What that involves
Run your account and orders	Create your account, take payment, pass the order to the vendor, verify pickup codes, send order updates
Deliver your order	Book a rider, share delivery details with the delivery partner, show you rider details and progress, confirm delivery
Payments, LootWallet and payouts	Process payments and refunds, keep the wallet ledger, pay vendors, keep accounting and tax records
Show you what's nearby	Sort and filter deals by distance, and send alerts about bags near you or from vendors you follow
Support and complaints	Answer chats and emails, review photos, decide refunds and credits, and report food-safety problems to vendors
Prevent fraud and abuse	Detect one person using many accounts, bulk buying, promo and referral abuse, false claims and fake pickups (section 4)
Keep FoodLoot safe and working	Security, crash reports, performance monitoring, fixing bugs
Improve FoodLoot	Understand how the app and website are used, mostly in aggregate
Marketing	Tell you about bags, offers and FoodLoot news by push notification, email, in-app message or phone call. You can opt out (section 8).
Measure our ads	Tell Meta which of our Facebook and Instagram ads led to an install, a sign-up or an order, so we stop paying for ads that don't work and show FoodLoot ads to people likely to use it (section 6.5)
Hiring	Review applications and contact applicants (section 5)
Legal	Meet tax, accounting and legal obligations; deal with disputes; respond to lawful requests

4. Fraud checks and automated decisions

4.1 Why we do this. Some people use many accounts, phones or cards to buy up a vendor's discounted bags, or to claim promotions and referral rewards more than once. This takes food away from other customers and costs vendors money.

4.2 What we look at. We look at:

device identifiers;
IP address and location at sign-in, checkout, top-up and pickup;
phone numbers and payment cards (stored as one-way scrambled codes, plus the last four digits);
order, refund and no-show patterns;
how quickly bags are collected.

From these we work out which accounts are probably linked.

4.3 What can happen.

Limits: we may limit how many bags an account or a group of linked accounts can buy from a vendor, or stop an order before payment.
Reviews: a FoodLoot team member reviews suspected fraud before any account is suspended.
Reports to vendors: we may tell a vendor that orders at their branch look suspicious. We do not give them customers' names, phone numbers or card details.

4.4 Support decisions. Our support team sees a summary of your past orders, refunds and missed pickups. They use it to decide whether a refund can be approved straight away or needs a manager.

4.5 If you think a limit or decision is wrong, contact support and a person will review it.

5. Job and internship applications

We use your application to assess you for the role and to contact you. For job applications, we use an AI tool provided by Anthropic (Claude) to help score written answers and tests. The tool may also flag answers that look AI-written. We do not send it your name, contact details or CV. The score only decides the order in which our team reviews applications; a person makes every decision. Applications are emailed to our hiring team with the CV attached. We keep unsuccessful applications for 12 months so we can consider you for other roles, then delete them.

6. Who we share it with

We do not sell your personal data. We share it only as follows.

6.1 Vendors. When you order, the vendor (its owner, branch staff and accountants) sees your name, your order and the pickup code status. They may export their orders. Vendors do not see your phone number, email or payment details. For delivery orders, vendors see only that the order is for delivery, not your address. If you report a problem, we may send the vendor your complaint, our notes and your photos (through links that expire), but not your name or contact details. Vendors must use customer information only to fulfil orders (Vendor Agreement §12).

6.2 Delivery partners and riders. For delivery orders, we give our delivery partner (currently FoodGo) and its rider:

your name, phone number, delivery address, map pin and delivery notes;
the order reference and code;
the vendor's pickup address, which for a home chef is their home address.

Until our system connects directly to FoodGo, bookings are sent to FoodGo through a WhatsApp group. Our contract with FoodGo requires it to:

use this data only for that delivery;
not market to you, contact you for anything else, or share your data;
use masked phone numbers where available;
delete your personal data within 30 days of delivery;
keep proof-of-delivery photos for 90 days and order status records for 24 months, only to evidence the delivery;
keep the data secure, and tell us within 24 hours of any breach.

We share the rider's name, phone number and delivery progress with you. Please use them only for that delivery.

6.3 Other customers and the public.

Reviews: your ratings, review text, review photos and first name may be shown publicly on the Platform.
Vendors' public details: business name, logo, photos, branch location, listings and ratings are public.
Home chefs: exact addresses are shown only to customers who have ordered.

6.4 Service providers who process data for us:

Provider	What for	Data involved
Supabase	Database, login, file storage, server functions (servers in Mumbai, India)	All data described in this policy
Vercel	Hosting our website and web portals	Website requests and IP addresses
Google	Sign in with Google; Maps, Places and address lookup; Android push notifications	Identity from Google; address searches and map pins; push token and message
Apple	Sign in with Apple; iPhone push notifications; address lookup on iPhone	Identity from Apple; push token and message; map pins
Expo	Sending push notifications	Push token, message text, order references
Resend	Sending email	Name, email, email content
ITS (SMS provider)	Sending phone verification codes	Phone number, code
AbhiPay	Card payments and saved cards	Amount, reference, card token; returns masked card number and name on card
DialogPay	Easypaisa and JazzCash payments	Wallet number, amount, order reference
Neem	Instalment (buy now, pay later) payments	Name, email, customer ID, amount, vendor name
FoodGo	Delivery	See 6.2
WhatsApp (Meta)	Booking deliveries with FoodGo; internal team coordination	Delivery details and photos
Meta (Facebook, Instagram)	Measuring our ads	See 6.5
Sentry	Crash and error reports	Device details, app version, error information
Anthropic	AI-assisted scoring of job applications	Written application answers (no name, contact details or CV)
OpenStreetMap (Nominatim)	Looking up vendor addresses	Vendor addresses and coordinates
Loops	Website waitlist and update sign-ups	Email address, sign-up source
Google Fonts, unpkg, jsDelivr	Fonts, icons and code libraries on our web pages	Your IP address and browser details when a page loads

6.5 Advertising (Meta). We advertise FoodLoot on Facebook and Instagram. To see which ads work, the app includes Meta's software development kit (SDK), which sends Meta:

your phone's advertising ID: on iPhone, only if you tap Allow when the app asks to track you; on Android, unless you have deleted it (section 8);
when the app is installed and opened;
when you create an account;
when you pay for an order: the amount, the currency, the number of bags and an order reference;
basic device details, such as model, operating system, language and app version, and your IP address.

We never send Meta your name, email, phone number, address or payment details. Meta may link this information with what it knows about you from other apps and websites, to measure our ads and to decide who sees them. Apple calls this "tracking". Meta handles this information under its own Privacy Policy.

6.6 Professional advisers. Our accountants, auditors and lawyers receive the records they need for accounting, tax and legal work, under a duty of confidentiality.

6.7 Legal and safety. We may share information:

when the law requires it or a court or government authority lawfully asks;
to investigate fraud or a food-safety incident, including with food authorities;
to protect the safety of customers, vendors, riders or our team.

6.8 Business changes. If FoodLoot is reorganised, merged or sold, personal data may pass to the new owner, and this policy will continue to protect it.

7. Where your data is stored

Our main database is hosted by Supabase in Mumbai, India. Some of our service providers process data in other countries, including the United States and Europe. By using FoodLoot you understand that your data is processed outside Pakistan. We choose providers with appropriate security.

8. Your choices

Location: you can turn location off in your phone settings. You can still use FoodLoot, but distances and nearby alerts will not work, and you will need to enter an address for delivery.
Push notifications: turn off all or some types in Profile → Notifications, or in your phone settings.
Promotional emails: every promotional email has an unsubscribe link.
Promotional calls: tell our team, or email support, and we will stop.
Ad tracking: on iPhone, tap Ask App Not to Track when asked, or turn it off later in Settings → Privacy & Security → Tracking. On Android, delete or reset your advertising ID in Settings → Google → Ads (on some phones, Settings → Privacy → Ads). If you do, we do not share your advertising ID, and FoodLoot works the same.
Order and account messages (confirmations, pickup reminders, delivery updates, refunds) are part of the service and cannot be turned off while you have an active order.

9. Your rights

You can ask us to:

give you a copy of your personal data;
correct data that is wrong;
delete your data (section 10);
stop using your data for marketing;
explain or review a decision made using fraud checks (section 4).

Email support@foodlootpk.com from your account's email address or phone number. We may need to verify your identity. We will respond within 30 days.

10. How long we keep data, and deleting your account

10.1 Deleting your account. Go to Profile → Account settings → Delete account, or email us. Before you delete, spend your LootWallet or ask us to return your own money (Customer Terms §6.5).

10.2 What happens when you delete your account:

Data	What happens
Profile, login, phone, email, saved addresses, preferences, favourites, follows, push tokens, saved cards	Deleted
Support chats and photos	Deleted after 12 months, unless needed for an open dispute
Review photos	Deleted
Reviews (rating and text)	Kept, with your name removed
Order records, including delivery addresses	Kept for accounting, with your name, contact details and delivery address removed
Payment, LootWallet and payout records	Kept as long as tax and company law require, with your contact details removed
Fraud-prevention records (scrambled device, phone and card codes, and account links)	Kept for up to 24 months after your last activity, then deleted, so a deleted account cannot be used to reset limits

10.3 Retention while your account is open:

Data	How long
Precise location, IP and device records from sign-in, checkout, top-up and pickup	12 months
Your last known location, used for nearby alerts	Until it is updated or you delete your account
Handover photos (vendor)	12 months
Proof-of-delivery photos (FoodGo)	90 days
Customer data held by FoodGo	Deleted within 30 days of delivery
Payment gateway logs	24 months
Phone verification codes	30 days
Deal views	30 days
Promotional notifications	7 days
Order, refund and account notifications	Kept with your order records
Rejected vendor applications	12 months
Job applications	12 months
Crash reports (Sentry)	90 days

11. Security

We protect data with:

encryption in transit (HTTPS);
login controls and database access rules;
restricted staff access;
logs of sensitive staff actions.

Payment cards are handled by our payment partners, and we store only tokens and masked numbers. No system is perfectly secure. If we become aware of a breach that puts you at risk, we will tell you without undue delay.

12. Children

FoodLoot is not for children under 13. Users aged 13 to 17 may use FoodLoot only with a parent's or guardian's permission (Customer Terms §3.1). If you believe a child under 13 has given us personal data, contact us and we will delete it.

13. Changes to this policy

We will update the "Effective date" when this policy changes. For important changes, we will tell you in the app or by email before they take effect.

14. Law

We handle personal data in line with the laws of Pakistan, including the Prevention of Electronic Crimes Act 2016 and the Electronic Transactions Ordinance 2002. We will also comply with any data-protection law that comes into force.

15. Contact

FoodLoot Ventures, Plot No. 15, Sector B-VI, Phase 1, Export Processing Zone, Korangi, Landhi Town, Karachi · support@foodlootpk.com