Privacy Policy

This matters for understanding everything below. We handle information about shop owners, who subscribe to us directly — and information about shoppers, who use a shop’s storefront and have no relationship with us at all.

For shop owners, we decide how the information is used, so we answer to you for it. For shoppers, the shop decides and we only act on its instructions — we store that information so the shop’s website can work. If you are a shopper wanting your details changed or removed, ask the shop first; if you cannot reach them, write to us and we will pass it on.

The details you give us when registering and running your shop: your name, the shop name, email address, phone number, shop address, logo and the content you publish. Your password is never stored — only an irreversible hash of it.

For security we also record the time of sign-in attempts and one-time codes sent to your email, and when you choose to trust a device we store a random token — not your IP address, and nothing that identifies the machine itself.

When a shopper places an enquiry or creates an account on a shop’s storefront, the shop collects their name, phone number, email if given, delivery address, order contents, and — for shops running an instalment programme — the record of their contributions.

We store this so the shop can serve them. We do not use it for our own purposes, do not market to shoppers, and do not combine it across shops.

To run your storefront and dashboard; to sign you in and keep the account secure; to send transactional email such as one-time codes, order notifications and receipts; to take your subscription payment; to answer support requests; and to keep records we are required by law to keep.

We do not use any of it to build advertising profiles, and we do not sell or rent it to anyone.

We use four cookies and no advertising or third-party trackers whatsoever:

• cb_session — keeps a shop owner signed in.
• cb_customer_session — keeps a shopper signed in to a shop’s storefront.
• cb_device — remembers a device you marked as trusted, so you are not asked for a one-time code every visit.
• cb_last_email — pre-fills your email on the login screen.

All four are strictly necessary for the service to work as you asked it to. Your browser’s light or dark preference is kept in local storage on your own device and never sent to us.

Visit counts. So that shop owners can see how many people visit their website, and we can see the same for ours, we count page views and a few taps (opening a product, adding to cart, downloading a price list, calling or messaging the shop). To tell one visitor from another, a random code is kept in your browser’s local storage; it is not a cookie and says nothing about who you are. We also keep a scrambled form of your IP address that cannot be turned back into the address, along with the page, the kind of device and the website that linked you. If you are signed in to a shop, that shop can see your name next to your visits. These counts are made by us, not by any outside analytics company, are shown only to the shop you visited, and are deleted after about 13 months.

Only the suppliers needed to run the service, and only for that purpose: our hosting and database provider, the email provider that delivers one-time codes and notifications, and our payment gateway, which processes subscription payments.

We never see or store your card or bank details. Those go directly to the payment gateway; we only receive confirmation that a payment succeeded, its reference, and the amount.

We may also disclose information where the law requires it, or to protect our rights or someone’s safety.

Account and shop information is kept while your subscription is live and for a reasonable period afterwards, so you can come back and so we can meet tax and accounting obligations. One-time codes expire within minutes. Sign-in records are kept only as long as they are useful for security.

Ask us to delete your account and we will remove your data within 30 days, except anything we must legally retain, such as payment records.

Traffic is encrypted in transit. Passwords are hashed and never recoverable. Sign-in uses one-time codes sent to your registered email, and trusted-device tokens are stored only as a hash, so a copy of our database does not let anyone sign in as you.

No system is perfectly secure. If a breach ever affects your information we will tell you and the relevant authority without undue delay.

You can ask us for a copy of your information, to correct it, to delete it, or to stop a particular use of it. Shop owners can export their own shop and customer data from the dashboard at any time without asking. Write to [email protected] and we will respond within 30 days.

The service is for business use and is not directed at children. We do not knowingly collect information from anyone under 18. If you believe a child’s information has reached us, tell us and we will remove it.

As required under Indian law, complaints about how your information has been handled can be addressed to our Grievance Officer:

Pay Vasool
14-21-92/5, Shanmukha Sai Cloth Shop, Opp. Girls High School, Chirala, Bapatla District, Andhra Pradesh, 523155, India
[email protected] · +91 62625 62622

We acknowledge complaints within 48 hours and aim to resolve them within 30 days.

If we change this policy we will update the date at the top of the page, and tell you directly where the change is significant. See also our Terms of Service.