Privacy Policy

Last updated March 2026

This Global Privacy Policy ("Privacy Policy") governs how Marketplace Technologies Inc. (Delaware, USA) and its operating subsidiary Momitnow Private Limited (Pune, India) (collectively, "MOM", "Company", "We", "Us", or "Our") collect, process, store, disclose, and safeguard personal information obtained through our software platforms, websites, APIs, artificial intelligence workflows, and mobile applications.

01 Introduction & Global Privacy Scope

At MOM, privacy and cryptographic data integrity are engineered into every layer of our platform. We operate a multi-tenant business operating system, artificial intelligence workspace, and marketplace of marketplaces spanning North America, the European Union, the United Kingdom, India, Southeast Asia, Australia, and the Middle East.

This Privacy Policy is designed to comply with global privacy standards, including Regulation (EU) 2016/679 (European Union General Data Protection Regulation - GDPR), UK Data Protection Act 2018, California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Digital Personal Data Protection Act, 2023 (DPDP Act, India), the Singapore Personal Data Protection Act (PDPA), and applicable state and regional data privacy enactments.

02 Corporate Identity, Data Controllers & Cross-Border Framework

Depending on your geographic location and how you interact with our services, your data is processed by the following entities:

  • Global Operations (Excluding India): Marketplace Technologies Inc., a Delaware corporation having its principal office at 651 N Broad St, Suite 201, Middletown, DE 19709, USA.
  • Indian Operations & Regional Processing: Momitnow Private Limited, an Indian corporation having its registered office at 403, Jai Ganesh Vishwa Complex, Pune, Maharashtra 411039, India.

B2B Controller vs. Processor Distinction: For individuals visiting our marketing websites, registering administrative accounts, or communicating directly with MOM, MOM acts as a Data Controller. When an enterprise Customer uses the MOM Platform to process information regarding its own end-customers, employees, suppliers, drivers, or orders, Customer acts as the Data Controller and MOM acts strictly as a Data Processor (or Service Provider) acting on Customer's instructions.

03 Categories of Information We Collect

We collect and process the following categories of information:

  • Identity & Corporate Contact Information: Name, professional title, company legal name, corporate business registration number, physical business address, email address, phone number, and tax identification numbers.
  • Authentication & Security Telemetry: Passwords (securely hashed via Argon2/Bcrypt), multi-factor authentication secrets, OAuth tokens, JSON Web Tokens (JWT), session fingerprints, IP addresses, browser user-agent strings, and security event logs.
  • Operational Business & Commerce Data: Product catalog listings, SKU identifiers, order histories, booking appointments, restaurant menu configurations, warehouse inventory balances, delivery manifests, and customer notes ingested during platform utilization.
  • Logistics, Geolocation & Telematics Data: Real-time GPS location coordinates of couriers and delivery vehicles (collected only during active duty / route tracking with express driver device permissions), route progression telemetry, speed, electronic signatures, and delivery photo captures (proof of delivery - e-POD).
  • AI Prompts, Input Payloads & Autonomous Agent Logs: Natural language prompts, system instructions, document embeddings, workflow triggers, automated action histories, and agent inferencing telemetry submitted through MOM AI services.
  • Billing & Transactional Metadata: Subscription plan records, invoice numbers, currency, transaction timestamps, payment status, and masked credit card fingerprints (e.g., last 4 digits) provided by licensed payment gateways.

04 Lawful Bases for Processing (GDPR, UK GDPR, DPDP & Regional Frameworks)

Under international data protection frameworks, we process personal data under the following legal bases:

  • Performance of a Contract (Art. 6(1)(b) GDPR): Processing necessary to provision customer accounts, authenticate sessions, maintain platform uptime, execute logistics dispatches, process transactions, and fulfill our contractual commitments under our Terms of Service.
  • Compliance with Legal Obligations (Art. 6(1)(c) GDPR): Retaining tax invoices, fulfilling statutory financial reporting, complying with anti-money laundering (AML) directives, and responding to lawful subpoenas or court orders.
  • Legitimate Interests (Art. 6(1)(f) GDPR): Protecting system integrity against cyber attacks, preventing fraudulent transactions, monitoring aggregated performance benchmarks, and improving user interface workflows.
  • Explicit Consent (Art. 6(1)(a) GDPR & Section 6 DPDP Act): Where required by law, such as for non-essential tracking cookies, marketing communications, or precise real-time mobile device background location tracking.

05 How We Use and Process Collected Information

We process information strictly for legitimate commercial and operational purposes, including:

  • Operating, maintaining, optimizing, and securing the MOM Operating System and associated modules;
  • Executing automated scheduling, route dispatching, warehouse bin allocations, and delivery tracking;
  • Orchestrating autonomous AI agents, multi-step LLM workflows, and structured business summaries;
  • Facilitating seamless merchant-to-consumer marketplace interactions, order dispatches, and table reservations;
  • Detecting, preventing, and mitigating security breaches, unauthorized logins, fraud, and bot attacks;
  • Issuing transactional notifications, system alerts, operational invoices, and customer support responses.

06 Artificial Intelligence, Machine Learning & Autonomous Agent Data Processing Disclaimers

MOM integrates cutting-edge artificial intelligence, large language models, and autonomous software agents. We uphold strict data sovereignty covenants regarding AI data processing:

  • Zero Foundation Model Training on Customer Data: MOM does NOT utilize Customer's private enterprise records, proprietary database contents, confidential trade secrets, or personal data to train publicly accessible commercial foundation models for third parties without explicit, written opt-in authorization.
  • Ephemeral Inferencing: Prompts, context embeddings, and inferencing payloads submitted to AI models are processed transiently to generate algorithmic completions and are subject to zero-data-retention or strict administrative logging policies.
  • Synthetic & Non-Deterministic Disclaimers: AI-generated outputs, automated route suggestions, inventory forecasts, and agent action proposals are synthetic probabilistic computations. Customers maintain sole operational discretion to review, approve, and deploy AI recommendations.
  • Autonomous Agent Telemetry: All autonomous actions, tool invocations, API calls, and external webhooks executed by MOM AI Agents are logged in secure administrative audit trails accessible to authorized tenant administrators.

07 Payment Data, Financial Intermediaries & Non-Custody Architecture

MOM prioritizes PCI-DSS compliance and financial data security:

Non-Custody Architecture: MOM does not store, process, or transmit raw credit card numbers, CVV security codes, or full banking credentials on its servers. All payment transactions are tokenized and processed directly by Tier-1 PCI-DSS certified payment processors (such as Stripe, Razorpay, or banking gateway partners).

MOM receives only tokenized transaction identifiers, card network brands, expiration dates, and the last four digits of payment instruments to display account billing history.

08 Data Sharing, Disclosures to Sub-Processors & Marketplace Multi-Tenancy

We do not sell, rent, or trade your personal information. We disclose personal data solely under the following defined parameters:

  • Enterprise Sub-Processors: We engage certified third-party cloud infrastructure and platform service providers, including cloud hosting facilities (AWS, Google Cloud, DigitalOcean), managed database providers, SMS/telecom gateways (Twilio), email deliverability services, and mapping APIs (Google Maps). All sub-processors are bound by stringent Data Processing Agreements (DPAs) ensuring equivalent security safeguards.
  • Marketplace Counterparties: In multi-vendor marketplace scenarios (e.g., MOM Shop, MOM Food, MOM Booking), order details, delivery addresses, and customer contact names are shared with the designated merchant, restaurant, or courier solely to execute order fulfillment.
  • Corporate Restructuring: In the event of a merger, acquisition, divestiture, or asset sale, customer records may be transferred to the acquiring entity subject to continued compliance with this Privacy Policy.
  • Legal Disclosures: We may disclose information if required to comply with a valid court order, subpoena, government regulation, or to protect the vital safety, property, or legal rights of MOM, our users, or the general public.

09 International Data Transfers & Standard Contractual Clauses (SCCs)

As a global technology provider, your information may be transferred to, stored, and processed in cloud data centers located in the United States, the European Union, India, and other countries where our operating entities or sub-processors maintain facilities.

When transferring personal data originating in the European Economic Area (EEA), United Kingdom, or Switzerland to countries lacking an EU adequacy decision, MOM implements robust cross-border transfer mechanisms, including European Commission-approved Standard Contractual Clauses (SCCs) and UK International Data Transfer Addenda, supplemented by technical encryption and organizational audits.

10 Data Retention, Archival & Automatic Deletion Protocols

We retain personal data only for as long as necessary to fulfill the operational purposes for which it was gathered, provide active subscription services, resolve legal disputes, and satisfy statutory tax, accounting, and regulatory obligations.

  • Active Accounts: Account profiles and operational data are retained throughout the active life of your enterprise subscription.
  • Account Termination: Following account offboarding, Customer Data is placed into a dormant retention quarantine for thirty (30) days to allow for authorized data export, after which it is queued for permanent, non-recoverable cryptographic erasure from active production clusters.
  • Audit & Financial Records: Financial invoices, billing transaction records, and tax logs are retained for seven (7) years in compliance with statutory fiscal requirements.

11 Security Safeguards, Encryption & Organizational Measures

We implement industry-leading technical and organizational security measures to protect personal data against accidental loss, unauthorized access, destruction, alteration, or disclosure:

  • Cryptographic Encryption: Data in transit across public networks is encrypted using Transport Layer Security (TLS 1.3). Data at rest in production databases, backups, and object storage is encrypted using Advanced Encryption Standard with 256-bit keys (AES-256).
  • Tenant Isolation: Logical multi-tenant separation enforces strict database query boundaries, preventing cross-tenant data leakage across accounts.
  • Access Governance: Access to production infrastructure is restricted to authorized personnel via zero-trust VPNs, hardware security keys, and audited role-based access controls (RBAC).
  • Continuous Vulnerability Auditing: Regular automated dependency scanning, code analysis, container vulnerability scanning, and third-party penetration testing.

12 Your Global Privacy Rights & Jurisdiction-Specific Protections

Depending on your geographic residency, you possess statutory rights regarding your personal information:

  • European Union & United Kingdom (GDPR / UK GDPR): You have the right to access your personal data, rectify inaccurate records, request erasure ("Right to be Forgotten"), restrict processing, demand data portability, object to processing on legitimate interest grounds, and lodge a complaint with your national Supervisory Authority.
  • California Residents (CCPA / CPRA): You have the right to know what personal information we collect, disclose, or sell; the right to delete personal information; the right to correct inaccurate personal information; the right to opt-out of the sale or sharing of personal information (MOM does not sell personal data); and the right to freedom from discrimination for exercising your privacy rights.
  • India (Digital Personal Data Protection Act, 2023): You have the right to obtain a summary of personal data being processed, the right to correction and erasure of personal data, the right to register a grievance with our designated Grievance Officer, and the right to nominate an authorized representative.
  • Exercising Your Rights: To exercise any statutory privacy right, submit a verifiable written request to our global privacy team at [email protected]. We verify all requests against authenticated account credentials and respond within statutory timeframes (30 days or less).

13 Cookies, Telemetry, Tracking Technologies & Do-Not-Track

We utilize essential, functional, and analytical cookies and local storage tokens:

  • Essential Cookies: Required to maintain secure authenticated user sessions, CSRF protection tokens, and multi-tenant routing. These cannot be disabled.
  • Functional & Preference Cookies: Used to remember your interface preferences, selected language locale, and UI theme states.
  • Analytical Telemetry: Aggregated, privacy-preserving performance telemetry used to evaluate server latency and error rates.

We honor Global Privacy Control (GPC) signals and standard browser Do-Not-Track headers for non-essential web analytics.

14 Children's Privacy (COPPA, GDPR Art. 8 & Global Minors Protections)

The MOM Platform is strictly an enterprise business Operating System and commercial marketplace designed exclusively for business operators, merchants, drivers, and adult consumers aged 18 and older (or the applicable age of legal majority in your jurisdiction).

We do not knowingly solicit, collect, or process personal data from children under the age of 16 (or under 18 where required by regional law). If we become aware that personal information of a child has been collected without verified parental consent, we will take immediate steps to permanently delete such information from our databases.

15 Third-Party Integrations, External Links & Connected Platforms

The Platform may provide links to external websites, third-party software plugins, or connected applications (such as social networks, payment gateways, and shipping carrier portals).

MOM exercises no operational control over external websites and disclaims responsibility for the privacy practices, tracking scripts, or data security standards of third-party platforms. We strongly encourage you to review the privacy policies of any connected third-party service before disclosing credentials or personal data.

16 Updates, Material Revisions & Notification Protocols

We reserve the right to revise this Privacy Policy periodically to reflect technological changes, product updates, or evolving regulatory mandates.

When material modifications are enacted, we will update the "Last Updated" timestamp at the top of this page and deliver prominent notice via administrative dashboard banners, email notifications to primary account contacts, or in-app modals prior to the effective date. Your continued utilization of the Platform following the effective date constitutes acknowledgment and acceptance of the revised Privacy Policy.

17 Contact Information, Data Protection Officer & Grievance Redressal

If you have questions, comments, requests to exercise your statutory rights, or compliance concerns regarding this Privacy Policy, please contact our global privacy team and official Grievance Officer:

Corporate Controllers:

Marketplace Technologies Inc. (Delaware, USA)
Momitnow Private Limited (Pune, India)

Designated Privacy & Grievance Email:

[email protected]

Mailing & Office Addresses:

United States Office: 651 N Broad St, Suite 201, Middletown, DE 19709, USA
India Office & Grievance Redressal: 403, Jai Ganesh Vishwa Complex, Pune, Maharashtra 411039, India

All statutory inquiries, CCPA/GDPR requests, and DPDP grievance complaints directed to [email protected] are acknowledged within 48 business hours and formally resolved within statutory timelines.