Privacy policy

This policy explains what personal data we collect to run Storefronts, why, and the choices you have. It covers merchants who run shops and shoppers who visit them.

Two roles

• For merchants, we decide how your account data is used, and this policy applies directly
• For shoppers, the merchant you order from decides how your order details are used; we store and process them on the merchant's behalf to run their shop. Each shop can publish its own privacy page

What we collect

Merchants: your name, email, password (stored only as a secure hash), shop name, WhatsApp number, payment details you choose to show shoppers (UPI ID, bank details), and the products, photos and pages you add.

Shoppers: the name, phone number, delivery address and order notes you give at checkout, your order history with that shop, and — if you create an account — your email or phone and a hashed password.

Everyone: basic technical data such as IP address, browser type and pages visited, used for security (for example, rate-limiting sign-in attempts) and to keep the service working.

How we use it

• To run shops, place orders, and show merchants the orders they receive
• To keep accounts secure and prevent abuse
• To provide support, and to send service messages about your account or plan
• To meet legal obligations

We don't sell personal data, and we don't use shoppers' data to advertise to them.

Who we share it with

• The merchant you order from (for shoppers)
• Service providers that host our servers, store files and send email, bound to protect the data
• Authorities, when the law requires it

How long we keep it

Account data is kept while your account is open. Order records are kept for as long as the merchant needs them for their business and legal records. When a merchant closes their shop, its data is deleted or anonymised within a reasonable period, except where we must keep it by law.

Your rights

You can ask to access, correct or delete your personal data, or withdraw consent where we rely on it. Shoppers should contact the shop first; merchants can update most details in the dashboard. We respond to requests within 30 days (see Contact and grievances below). If you're in India, this policy is intended to meet the Digital Personal Data Protection Act, 2023.

Security

Passwords are hashed, connections are encrypted (HTTPS), and access to data is limited to what's needed to run the service. No system is perfectly secure, and we'll notify affected users of a breach as the law requires.

Cookies

We use only the cookies needed to keep you signed in and remember your cart. See our Cookie policy.

Changes

We'll post updates here with a new date, and tell merchants about material changes.

Contact and grievances

Shop owners can reach us from Help & support in their dashboard; anyone else can use our Contact page.