Privacy Policy

What we collect

When you create an account:

• Your name, username, email address and mobile number. The username is public. The email and mobile are not shown to other users.
• Your date of birth and gender. Date of birth is used only to confirm you are 18 or older, which Indian law requires for entering a contract and for us to process your data without a guardian’s consent. Neither is shown on your profile.
• A profile photo, if you upload one. Public.

When you buy:

• Delivery addresses, including a map location if you choose to share one, so couriers can find you.
• Your orders — what you bought, from whom, for how much, and every status change. Sellers see the orders placed with them.
• Wallet transactions. Every balance change has a matching record explaining it.

When you sell:

• Business name, bank account details, and identity documents.
• We never store your full Aadhaar number. It is checked and discarded; only the last four digits are kept, so we can say which document was used without holding the document. Uploaded photographs of ID are stored in a private area that no other user can read.

What we do not collect

• Your password. It goes straight to our authentication provider, which stores only a cryptographic hash. Nobody at SHYRAM can read it.
• Your card, UPI or netbanking details. Payments are handled by a licensed payment gateway. Those details never reach our servers.
• Tracking or advertising cookies. The only cookies we set keep you signed in.

Who else sees your data

• Sellers you buy from see your name, delivery address and phone number — they have to, to send you the thing.
• Supabase hosts our database, authentication and file storage.
• Vercel hosts and serves the site.
• Google, if you choose to sign in with Google. We receive your name, email address and profile picture; Google receives no information about what you do here.
• A payment gateway, once payments are live, to take payment and pay sellers.
• Courier partners, to deliver orders.

We do not sell your data, and we do not share it for advertising.

How long we keep it

Order, payment and wallet records are kept for as long as Indian tax and accounting law requires, currently eight years. This is not optional for us and applies even after an account is closed — a financial record you can no longer see is still a record we are obliged to hold.

Everything else — profile, photos, addresses — is deleted when you ask.

Your rights

Under India’s Digital Personal Data Protection Act you can ask us to:

• show you what we hold about you
• correct anything wrong
• delete your account and everything not covered by the retention rule above
• withdraw consent for anything you previously agreed to

Write to rishabhraj481@gmail.com and we will respond within 30 days.

Security

All traffic is encrypted in transit. Access to data is enforced by the database itself rather than only by application code, so a bug in a page cannot expose another user’s files. Identity documents are stored privately and separately from everything public.

No system is perfectly secure. If you find a problem, please tell us at the address above rather than publishing it.

Changes

If this policy changes in a way that affects you, we will say so on the site rather than quietly updating the date at the top.