Privacy Policy

1. Scope

This policy explains how [to be set] (“shoclop”) handles personal data under the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the Reasonable Security Practices Rules, 2011. It covers merchants and their team members. When you buy from a merchant’s store, the merchant is the data fiduciary for your order data and shoclop acts as its processor; read that store’s own privacy policy too.

2. Data we collect

• Account data: name, email address, password (stored only as a salted hash by our authentication provider).
• Store data: store name, legal and tax details you enter (such as GSTIN and address), products, orders, customers of your store.
• Billing data: subscription status and invoices. Card or UPI details are entered with Razorpay and never reach our servers.
• Technical data: IP address, device and browser type, pages visited, security and audit logs.
• Support communications you send us.

3. Why we use it (purposes)

• To create and run your account and store, and to provide the service you asked for.
• To take payments, issue invoices and comply with tax and accounting law.
• To keep the platform secure, prevent fraud and abuse, and fix errors.
• To send service messages (receipts, security alerts, order and team notifications). We send marketing only with your consent, which you can withdraw at any time.

4. Legal basis and consent

We process data to perform our contract with you, to meet legal obligations, for legitimate uses permitted by the DPDP Act, and where needed with your consent. Where we rely on consent you may withdraw it; this does not affect earlier lawful processing.

5. Who we share it with

We do not sell personal data.

• Processors that help us run the service: Supabase (database and authentication), our hosting provider, Razorpay (payments), our email provider, Delhivery (shipping, for stores that enable it).
• Authorities, when required by law or valid legal process.
• A buyer or successor if we are restructured or sold, with the same protections.

6. Where data is stored

Data is stored with our infrastructure providers, which may be located outside India. We use providers that apply appropriate safeguards and we transfer data only to countries not restricted by the Government of India under the DPDP Act.

7. Retention

We keep data while your account is active and afterwards only as long as needed: tax and accounting records are retained as required by law (generally up to eight years), security logs for up to 12 months, and other data is deleted or anonymised after account closure unless a legal obligation says otherwise.

8. Your rights

• Access a summary of the data we hold about you, and download it from your dashboard (Account → Download my data).
• Correct or update inaccurate data.
• Erase your data and close your account (Account → Delete account), subject to legal retention.
• Withdraw consent and nominate a person to exercise your rights in the event of death or incapacity.
• Raise a grievance with our Grievance Officer (below). If unresolved you may complain to the Data Protection Board of India.

9. Security

We use encryption in transit, access controls with row-level isolation between merchants, audit logging and regular review. No system is perfectly secure; we will notify you and the Board of a personal data breach as the law requires.

10. Children

The platform is not meant for people under 18 and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.

11. Cookies

See the Cookie Policy.

12. Grievance Officer

[to be set], [to be set], [to be set]. Email [to be set], phone [to be set]. We acknowledge complaints within 24 hours and resolve them within 15 days.

13. Changes

We will post any change here and, for material changes, notify you. The effective date is 1 January 2026.