Legal

Privacy policy

Last updated 20 September 2026.

This policy covers the Wholegrains website (wholegrains.pk), the Wholegrains customer app and the Wholegrains Driver app. "We" is Whole Grains Foods SMC-Pvt Ltd, DHA Phase 1, Islamabad. If you have a question about anything here, email info@wholegrains.pk.

What we collect, and why

If you order from us

• Name, phone number and delivery address - to deliver your order and contact you about it.
• Email address, if you give one - for order confirmations and password resets.
• Your orders - what you bought, when, and what it cost.
• Password - stored hashed; we cannot read it.

If you deliver for us (Wholegrains Driver app)

• Name, phone number and CNIC number - to identify you and verify your application.
• Photos of you and of your CNIC (front and back) - so we can check your identity before you deliver on our behalf. Stored privately; only Wholegrains staff can view them.
• Payout details - the bank account or mobile wallet (JazzCash, Easypaisa) you want to be paid into.
• Location - while you have switched yourself to "available for deliveries", the app sends your position to us every few seconds so we can offer you nearby orders and show customers where their delivery is. Location sharing stops as soon as you switch availability off or log out. We do not collect location while you are unavailable.
• Delivery history and payouts - which orders you delivered and what you were paid.

Everyone

• Server logs - IP address, device type and the pages or API calls requested, kept for a short period to keep the service running and to diagnose problems.

We do not collect anything from your contacts, messages, other apps, or advertising identifiers.

How we use it

Only to run the service: taking and delivering orders, paying drivers, sending you confirmations and codes by SMS or email, and dealing with problems. We do not use your information for advertising and we do not build profiles from it.

Who we share it with

• Drivers see the name, phone number and address on the orders they deliver - nothing else about you.
• Customers see their driver's first name and live position during a delivery.
• Service providers that host our servers, store files and send SMS and email, only as needed to do so on our behalf.
• The law, if we are required to.

We do not sell personal information, and we do not share it with advertisers.

How long we keep it

• Order and payout records are kept as long as we need them as financial records.
• Driver location pings are kept only for the current delivery session and are overwritten continuously.
• Identity photos are kept while you are a driver with us and deleted when your account is deleted.
• Server logs are kept for a few weeks.

Your choices

• Delete your driver account from inside the app (Profile → Delete my account), or by following the steps at wholegrains.pk/drivers/delete-account. Your photos, contact details and payout details are removed; delivery and payout records are kept without your name attached.
• Delete your customer account by emailing info@wholegrains.pk from the address or phone number on the account.
• Location can be switched off at any time by turning off "available for deliveries" in the driver app, or by revoking the app's location permission in Android settings (the app will not be able to receive deliveries while it is off).
• See or correct your information by emailing us. We will reply within 7 days.

Security

Everything travels over HTTPS. Passwords are hashed. Identity photos are kept in private storage that is never publicly accessible, and are served only through short-lived links to staff who are logged in.

Children

Our services are for adults. Drivers must be 18 or over. We do not knowingly collect information from anyone under 18.

Changes

If we change this policy we will update the date at the top. Significant changes will be announced in the apps.