Privacy Policy
Effective Date: 1 July 2026 · Platform: OneShop™ · Jurisdiction: India
1 · What We Collect
When you use OneShop as a buyer or seller, we collect the following information:
- Buyers: Name, phone number, delivery address (collected at checkout)
- Sellers: Full name, shop name, phone, email, Aadhaar last 4 digits, PAN, bank account last 4 digits, IFSC, account holder name, shop photo
- Orders: Items ordered, total amount, payment ID (from Razorpay), delivery status, courier tracking number
- Usage: IP address (for rate limiting and security), browser type (from request headers)
We do NOT store full Aadhaar numbers or full bank account numbers. Only the last 4 digits are kept for reference.
2 · How We Use Your Data
- Processing and delivering your orders
- Sending order status alerts via WhatsApp (Interakt)
- Calculating and transferring seller payouts via Razorpay
- Verifying seller identity during onboarding
- Preventing fraud, abuse, and platform manipulation
- Responding to complaints and support requests
We do not use your data for advertising, profiling, or selling to third parties.
3 · Who We Share Data With
- Razorpay — payment processing and seller payouts (RBI-licensed)
- Interakt / WhatsApp Business API — order notification messages
- Cloudflare R2 — product image and seller photo storage
- Railway / MongoDB Atlas — hosting and database
- TrackCourier API — automated delivery status polling
All third-party services are bound by their own privacy policies and applicable data protection laws. We do not share personal data with sellers beyond what is operationally necessary (e.g., a seller sees the buyer's name and delivery address for shipping).
4 · Data Retention
- Order data: Retained for 3 years for accounting and dispute resolution
- Seller applications: Retained for 2 years after approval or rejection
- Session data: Expires after 7 days of inactivity
- Failed payment logs: Retained for 1 year
5 · Cookies & Sessions
OneShop uses server-side sessions (stored in Redis or memory) to keep you logged in as a seller/admin. A session cookie is set in your browser. We do not use advertising or tracking cookies. No third-party analytics (Google Analytics, Facebook Pixel) are used.
6 · Your Rights
- Access: Request a copy of the personal data we hold about you
- Correction: Ask us to correct inaccurate information
- Deletion: Request deletion of your account and personal data (subject to legal retention requirements)
- Portability: Receive your order and account data in a readable format
To exercise any of these rights, email [email protected] with your request and registered phone number. We will respond within 30 days.
7 · Security
- All data is transmitted over HTTPS (TLS)
- Passwords are hashed using bcrypt
- CSRF tokens protect all state-changing requests
- Rate limiting protects all public endpoints
- Sensitive fields (Aadhaar, bank account) are never stored in full
- Product images are stored on Cloudflare R2 with no public directory listing
8 · Children's Privacy
OneShop is not intended for use by persons under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal data, contact us immediately.
9 · Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified via WhatsApp or email at least 7 days before taking effect. The "Effective Date" at the top of this page will always reflect the latest version.
10 · Contact
For privacy-related questions or data requests:
This policy is governed by the Information Technology Act, 2000 and the IT (Amendment) Act, 2008, applicable to India.