Privacy Policy
Effective Date: 1 July 2026 · Platform: OneShop™ · Jurisdiction: India
1 · What We Collect
When you shop on OneShop, we collect the following information:
- Your details: Name, phone number, delivery address (collected at checkout only)
- Orders: Items ordered, total amount, payment ID (from Razorpay), delivery status, courier tracking number
- Usage: IP address (for rate limiting and security only)
We do NOT store your card details, full bank account numbers, or passwords in readable form.
2 · How We Use Your Data
- Processing and delivering your orders
- Sending order status alerts via WhatsApp
- Preventing fraud and platform abuse
- Responding to complaints and support requests
We do not use your data for advertising, profiling, or selling to third parties.
3 · Who We Share Data With
- Razorpay — secure payment processing (RBI-licensed)
- Interakt / WhatsApp Business API — order notification messages
- TrackCourier API — automated delivery status tracking
- Cloudflare R2 — product image storage
Your name and delivery address are shared with the seller only for the purpose of shipping your order. We do not share your data with anyone else.
4 · Data Retention
- Order data: Retained for 3 years for accounting and dispute resolution
- Session data: Expires after 7 days of inactivity
- Failed payment logs: Retained for 1 year
5 · Cookies & Sessions
OneShop uses a session cookie only to remember your cart and order status. We do not use advertising or tracking cookies. No third-party analytics (Google Analytics, Facebook Pixel) are used on this site.
6 · Your Rights
- Access: Request a copy of the personal data we hold about you
- Correction: Ask us to correct inaccurate information
- Deletion: Request deletion of your account and personal data (subject to legal retention requirements)
- Portability: Receive your order and account data in a readable format
To exercise any of these rights, email [email protected] with your request and registered phone number. We will respond within 30 days.
7 · Security
- All data is transmitted over HTTPS (TLS)
- Passwords are hashed using bcrypt
- CSRF tokens protect all state-changing requests
- Rate limiting protects all public endpoints
- Sensitive fields (Aadhaar, bank account) are never stored in full
- Product images are stored on Cloudflare R2 with no public directory listing
8 · Children's Privacy
OneShop is not intended for use by persons under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal data, contact us immediately.
9 · Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified via WhatsApp or email at least 7 days before taking effect. The "Effective Date" at the top of this page will always reflect the latest version.
10 · Contact
For privacy-related questions or data requests:
This policy is governed by the Information Technology Act, 2000 and the IT (Amendment) Act, 2008, applicable to India.