Privacy Policy

Shop is operated by [Registered business name], [Registered business address, India] ("we"). Shop helps small businesses ("sellers") publish an online catalogue, receive enquiries from buyers, and — if they choose — run Facebook and Instagram ads. This policy explains what personal data we collect, why, and the choices you have. We follow India's Digital Personal Data Protection Act, 2023.

1. Data we collect

• Sellers: email address, password (stored only as a secure hash by our login provider), business name, city, category, WhatsApp number, logo, product photos, names, prices and descriptions.
• Buyers who send an enquiry: name, phone/WhatsApp number, optional question, the product and price, the time, your consent to be contacted, and the ad campaign the link came from (if any). We store a one-way scrambled version of your IP address only to block spam; we do not store the IP address itself.
• Facebook / Meta (sellers who connect it): your Facebook user ID and name, an access token, the list of permissions you granted, and the Facebook Page and ad account you choose. When you create ads, we store the ad settings and the IDs and results Meta returns.

2. How we use it

• To show sellers' catalogues and deliver buyer enquiries to the right seller.
• To create, show the status of, and report on ads — only when the seller presses “Publish” and only on the Page and ad account they selected.
• To keep the service secure, prevent spam and fix problems.

We do not sell personal data. We do not use buyers' contact details for our own marketing.

3. Who can see it

• A buyer's enquiry is visible only to the seller it was sent to.
• A seller's catalogue (business name, city, WhatsApp number, products and prices) is public, because that is its purpose.
• Service providers that run Shop for us: database and file hosting (Supabase) and website hosting. They process data only on our instructions.
• Meta Platforms, when a seller creates ads through Shop. Meta's own policy applies to data Meta holds.

4. Facebook data and how to delete it

Facebook access tokens are encrypted and are never shown in the browser. A seller can disconnect Facebook at any time from the Ads page; we then delete the token and ask Facebook to remove our access. You can also remove Shop in your Facebook settings, or follow our data deletion instructions.

5. How long we keep data

• Seller accounts, products and enquiries: until the seller deletes them or closes their account.
• Facebook tokens: until you disconnect, the token expires, or you ask for deletion.

6. Your rights

You can ask to see, correct or delete your personal data, or withdraw consent, by writing to [support email]. Buyers can also ask the seller they contacted to delete their enquiry. We reply within 30 days.

7. Security

We use encrypted connections (HTTPS), database rules that keep each seller's data separate, and encryption for Facebook tokens. No system is perfectly secure; we will inform affected people and authorities of a breach as required by law.

8. Grievance officer and contact

[Name of grievance officer], [Registered business name], [Registered business address, India]. Email: [support email].

9. Changes

We will update the date above when this policy changes and tell sellers about important changes by email.