Privacy Policy
- Version
- 1.0
- Last updated
- 17 Oct 2026
- Effective
- 17 Oct 2026
This Privacy Policy explains how Madhuri Laundry and Linen Services ("CleanCart", "we", "us") and the laundries that use CleanCart collect, use, share, and protect personal data. It applies to the CleanCart web app, to laundry websites that run on CleanCart, and to the messages we send for laundries.
We follow the Digital Personal Data Protection Act, 2023 and the rules made under it, and the Information Technology Act, 2000 and its rules. In this policy, "personal data" means any data about you that identifies you, and "you" means anyone whose data we handle: customers, laundry staff, and laundry owners.
Summary
- We collect what is needed to run your account and your laundry orders: your name, mobile number or email, addresses, and order and billing details.
- Your laundry is responsible for its own customer records. CleanCart stores and processes them for the laundry, in a database kept separate from every other laundry's.
- We do not sell personal data. We do not show advertising, and the web app has no analytics or advertising trackers.
- You get order updates on WhatsApp. Promotional messages are sent only if you have agreed to receive them, and you can withdraw that at any time.
- Data is stored in India. Orders, invoices, and payment records are kept for 8 financial years because tax and accounting law requires it.
- You can ask to see, correct, or erase your data, and you can complain to our Grievance Officer. Details are in Your rights and Grievance Officer and contact.
Who is responsible for your data
Two parties handle your data, depending on what it is.
| Data | Responsible party (Data Fiduciary) | Role of CleanCart |
|---|---|---|
| Your CleanCart account: sign-in identity, password, saved addresses, and active sessions | CleanCart | Data Fiduciary |
| Your records at a laundry: customer profile, orders, invoices, payments, notes, and messaging preferences | The laundry you use | Data Processor, acting on the laundry's instructions |
| A laundry's staff records: role, store assignment, and activity history | The laundry that employs or engages the staff member | Data Processor |
Each laundry's data is stored in its own database. One laundry cannot see another laundry's customers or orders. If you use more than one laundry, each one sees only its own records about you.
Personal data we collect
Data you give us or your laundry
| Category | What it includes |
|---|---|
| Account | Your name, and the mobile number or email address you sign in with. Your password is never stored; we keep only a one-way Argon2id hash of it. |
| Saved addresses | Recipient name and phone number, address lines, landmark, city, PIN code, and an optional map pin (latitude and longitude) that you place. |
| Customer record at a laundry | Name, mobile number, email, billing address, delivery instructions, and notes the laundry's staff add. For business customers, the business or legal name and GSTIN. |
| Orders and billing | Garments and services, prices, discounts, taxes, order status, pickup and delivery tasks, invoices, credit notes, and the payments your laundry records. |
| Staff details | Name, contact details, role, the stores a staff member works at, and invitations. |
Data created when you use CleanCart
| Category | What it includes |
|---|---|
| Sign-in and security | Active sessions (the session token is stored only as a hash, with a hash of your browser's identifier), failed sign-in counts, one-time codes and password-reset codes (short-lived, stored only in hashed or encrypted form, and removed once used or expired). |
| Activity history | An audit trail of actions on business records, such as who created an order, changed a price, or recorded a payment, and when. |
| Messages | Which messages were sent to you, their delivery status, your message preferences, and records of any marketing consent you gave or withdrew. Phone numbers waiting in a message queue are stored encrypted. |
| Network data | Your IP address is used briefly to limit abuse, such as too many sign-in attempts. It is not stored in our databases. |
What we do not collect
- We do not collect card numbers, UPI PINs, or bank passwords. Online payments are not offered yet. Your laundry records payments you make to it by cash, UPI, card terminal, or bank transfer, with a reference number at most.
- We do not track your location. If you choose "use this device's location" while placing a map pin, your browser asks your permission first, and only the pin you save is stored.
- We do not use analytics, advertising, or social media trackers.
How we use your data
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and secure your account, and sign you in | Account, sign-in and security data | You give it to us to use the service, and you can withdraw by closing your account |
| Run laundry orders: intake, processing, pickup, delivery, invoices, and payments | Customer record, addresses, orders and billing | Provided by you for your order, processed for the laundry |
| Send order updates and security codes | Mobile number or email, order number and status | Needed to provide the service you asked for |
| Send promotional offers from your laundry | Mobile number, consent record | Your explicit consent only |
| Keep the service safe: prevent fraud, abuse, and unauthorised access | Sign-in and security data, activity history, network data | Legitimate uses permitted by law, and to protect you and the laundry |
| Keep business and tax records | Orders, invoices, payments, activity history | Required by tax and accounting law |
| Provide support when you or your laundry ask for it | Only the records needed for that request | Your or your laundry's request |
We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not build advertising profiles.
Messages we send
Order updates. When your laundry takes an order, when it is ready, and when it is completed, we may send you a WhatsApp message. It contains only the laundry's name, your order number, the order status, and the laundry's support contact. It never contains your address, the items in your order, notes, or payment details. You can ask your laundry to stop these messages; your orders are not affected.
Security codes. One-time codes for signing in or resetting your password go to the mobile number (by WhatsApp) or email address you used.
Promotional offers. A laundry may send you offers on WhatsApp only after you have explicitly agreed to receive them from that laundry. We record when and how you agreed, and which version of the notice you saw. Without that record, promotional messages are blocked. You can withdraw your consent at any time by telling the laundry or writing to us, and it takes effect for future messages straight away.
Who we share data with
Your laundry. The laundry sees your customer record, orders, and billing. Its staff see only what their role and store allow.
Service providers. These companies process data for us under contract, only to provide the service:
| Provider | What they do | Data involved |
|---|---|---|
| Amazon Web Services (Mumbai region, India) | Hosting, databases, storage, backups, and email delivery (Amazon SES) | All data we store; email address and message for emails |
| Meta Platforms (WhatsApp Business Platform) | Delivering WhatsApp messages | Mobile number and message content |
| An SMS provider, if your laundry uses SMS | Delivering text messages | Mobile number and message content |
| OpenStreetMap map tiles | Showing maps in the web app | Your browser requests map images directly, so the map service sees your IP address |
| An address search (geocoding) service | Finding a map pin from an address you type | The address text you search for, sent from our server, not from your browser |
Links you choose to open. The "Open in Google Maps" links take you to Google Maps, which handles your data under Google's own policy.
Legal reasons. We may disclose data when the law requires it, such as a valid order from a court or a government authority, or when needed to protect someone's safety or to establish or defend a legal claim.
Business changes. If CleanCart is merged, acquired, or reorganised, data may move to the new owner, who must continue to protect it as this policy describes.
We do not sell or rent personal data to anyone.
Where your data is stored
Our databases and backups are stored in India, in the Amazon Web Services Mumbai region. Some service providers, such as Meta for WhatsApp messages, may process data outside India. Those transfers are allowed under the Digital Personal Data Protection Act, 2023, unless the Government of India restricts transfers to a particular country, in which case we will stop them.
How long we keep data
| Data | How long |
|---|---|
| Your CleanCart account | While your account is open. After you ask us to close it, it is removed within 30 days, except data we must keep by law. |
| Orders, pickup and delivery history, invoices, credit notes, payments, expenses, and related activity history | 8 financial years after the end of the financial year they belong to, as tax and accounting law requires, or longer only while a legal hold applies |
| Sign-in, security, and support-access records | 2 years |
| Message delivery records | 1 year |
| Message content | 90 days |
| Marketing consent and withdrawal records | While you are a customer, plus 5 years after you withdraw or stop being a customer |
| One-time codes and password-reset codes | Minutes; removed once used or expired |
Backups. Databases are backed up continuously in encrypted form so they can be restored for up to 35 days, and an encrypted monthly snapshot is kept for 12 months. Data deleted from the live system disappears from backups as they expire. If a backup is ever restored, we apply all deletions made since that backup before the restored data is used.
Your rights
Under the Digital Personal Data Protection Act, 2023, you have the right to:
- Access. Get a summary of the personal data we or your laundry hold about you, how it is used, and who it has been shared with.
- Correction. Have inaccurate or incomplete data corrected or completed, and out-of-date data updated.
- Erasure. Have your data erased when it is no longer needed for the purpose it was collected for, or when you withdraw consent, unless the law requires us to keep it.
- Withdraw consent. Withdraw any consent you gave, such as for promotional messages, as easily as you gave it. Withdrawal does not affect anything done before it.
- Grievance redressal. Complain to us and get a response, and then to the Data Protection Board of India if you are not satisfied.
- Nominate. Name a person to exercise your rights if you die or become unable to do so.
How to use your rights
- In the web app, you can update your name and saved addresses, change your password, and see and sign out of your active sessions at any time.
- For your records at a laundry, ask the laundry. It can correct your details, stop or start messages, and erase your customer record. You can also write to us and we will pass the request to the laundry.
- To close your CleanCart account, or for any other request, write to support@madhurilaundry.com. Account closure is handled by request for now.
We may ask you to confirm your identity before acting on a request, so that no one else can see or change your data. We respond within 30 days.
What erasure means for business records
When a laundry erases a customer, the name is replaced with "Removed customer", and contact details, tax number, notes, addresses, and map pins are removed. Invoices and payment records stay, in that minimised form, for the 8 years tax law requires. A legal hold, such as an open dispute or a legal claim, can delay erasure for the records it covers.
Children
CleanCart accounts are for people aged 18 or over. We do not knowingly create accounts for, or collect personal data from, anyone under 18. A parent or guardian may use a laundry for a child's clothes from their own account. If you believe a child has given us personal data, write to support@madhurilaundry.com and we will delete it.
How we protect your data
- All connections to CleanCart use HTTPS encryption.
- Data is kept on encrypted storage, and backups are encrypted.
- Passwords are stored only as Argon2id hashes. Session tokens and one-time codes are stored hashed, and phone numbers waiting in message queues are encrypted.
- Each laundry has a separate database. Staff access is limited by role and store.
- Five failed sign-ins within 15 minutes lock the account until its password is reset, and request rates are limited to stop abuse.
- Important actions on business records are logged with who did them and when.
- CleanCart support staff have no standing access to a laundry's data. Access needs a support case, the laundry's approval, and our security team's approval. It lasts at most 60 minutes, is read-only unless separately approved, and every access is logged. In a genuine security or availability emergency, a designated security manager may approve access without waiting for the laundry; the laundry is told as soon as it is safe, and the access is reviewed within one business day.
No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the law requires, explain what happened, and tell you what you can do.
Browser storage and cookies
The CleanCart web app does not set cookies and does not use tracking technologies. It stores a few items in your browser:
| Item | Where | Why | How long |
|---|---|---|---|
cleancart.session | Session storage | Keeps you signed in while the tab is open | Until you sign out or close the tab |
cleancart.theme | Local storage | Remembers light or dark mode | Until you clear it |
cleancart.lastWorkspace | Local storage | Remembers the last laundry you opened (staff) | Until you clear it |
cleancart.storeScope.* | Local storage | Remembers the store you selected (staff) | Until you clear it |
You can clear these in your browser's settings at any time. Clearing the session item signs you out.
Links to other websites
Laundry websites and the web app may link to other websites, such as Google Maps or WhatsApp. Those websites have their own privacy policies, and we are not responsible for how they handle your data.
Changes to this policy
We may update this policy when the service or the law changes. The version number and date at the top show the current version. If a change materially affects how we use your data, we will tell you in the web app or by message before it takes effect, and ask for your consent again where the law requires it.
Grievance Officer and contact
If you have a question, a request, or a complaint about your personal data, contact our Grievance Officer:
- Name: Madhuri Sarode
- Email: m.sarode@madhurilaundry.com
- Address: Swami Samarth Nagar, Adgaon, Nashik, Maharashtra, 422003
We acknowledge complaints within 7 days and resolve them within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
Madhuri Laundry and Linen Services, Swami Samarth Nagar, Adgaon, Nashik, Maharashtra, 422003. General support: support@madhurilaundry.com.