1. Introduction
Storeva ("we", "our", "us") operates a digital catalog platform for local business owners. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our platform, in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India.
2. Information We Collect
2.1 Information You Provide
- Account Data: Email address, password (encrypted), WhatsApp phone number
- Shop Data: Shop name, address, tagline, logo, product details, prices, images
- Billing Data: Payment history, subscription plan (payment card details are NOT stored on our servers — they're handled by Razorpay)
- Support Data: Messages you send via help tickets or feedback forms
2.2 Information Automatically Collected
- Usage Data: Product views, WhatsApp clicks, page visits
- Device Data: Browser type, operating system, IP address
- Cookies: Session tokens stored in your browser's localStorage (not third-party tracking)
2.3 Customer Data (Submitted to Your Shop)
- Customer names, phone numbers, and messages submitted through your shop's WhatsApp integration
- Product ratings and reviews submitted by your customers
- This data is stored on behalf of the shop owner. Shop owners are the data controllers for their customer data.
3. How We Use Your Information
| Purpose | Legal Basis (DPDP) |
|---|
| Provide the platform service | Contract performance |
| Send account notifications (password reset, subscription expiry) | Contract performance |
| Process payments and generate invoices | Legal obligation |
| Send product/offer notifications to your customers (opt-in) | Consent |
| Prevent fraud, abuse, and secure the platform | Legitimate interest |
| Improve features based on usage analytics | Legitimate interest |
4. Data Sharing
We do NOT sell your data. We share it only with:
- Razorpay: Payment processing (RBI-authorised Payment Aggregator)
- Cloudflare: Hosting and infrastructure (data stored in India)
- Resend: Transactional email delivery (password reset, reminders)
- Legal authorities: Only when required by Indian law (with valid legal order)
🔒 Important: We never share customer data between shops. Each shop owner only sees data submitted to their own shop.
5. Data Retention
| Data Type | Retention |
|---|
| Active account data | Until account deletion |
| Deleted account data | 30 days (recoverable), then permanently deleted |
| Payment records | 7 years (IT Act requirement) |
| Password reset tokens | 1 hour |
| Session tokens | 30 days |
| Usage analytics | 12 months |
6. Your Rights (Under DPDP Act)
As a data principal, you have the right to:
- Access: Request a copy of your personal data
- Correction: Update inaccurate data (available directly in your admin dashboard)
- Erasure: Delete your account and data (Settings → Danger Zone)
- Withdraw Consent: Unsubscribe from optional communications at any time
- Grievance Redressal: File a complaint with our Grievance Officer
- Nominate: Nominate someone to exercise your rights in case of death or incapacity
To exercise any of these rights, email us at [email protected]. We respond within 30 days.
7. Data Security
- All connections use HTTPS/TLS encryption
- Passwords hashed with SHA-256 (never stored in plain text)
- Data stored on Cloudflare's global edge network with enterprise security
- Payment data handled by PCI-DSS compliant Razorpay
- Regular security monitoring and session invalidation on password change
8. Children's Privacy
Our service is not intended for use by children under 18. We do not knowingly collect data from minors. If we become aware of such data, we will delete it promptly.
9. Cookies & Local Storage
We use browser localStorage (not third-party tracking cookies) to store:
- Login session token (to keep you signed in)
- User preferences (dismissed banners, viewed products)
You can clear this anytime via browser settings.
10. Changes to This Policy
We may update this Privacy Policy periodically. Significant changes will be communicated via email or platform notification. Continued use after updates constitutes acceptance.
11. Grievance Officer
In compliance with the DPDP Act, 2023 and IT Rules, 2021:
Grievance Officer: Support Team
Email: [email protected]
Response Time: Within 30 days