गोपनीयता नीति

This policy applies to personal data we process about the dealers, distributors, repair shops and their staff who hold accounts with us, and to the limited personal data Customers enter about their own end-customers.

For account holders we act as a Data Fiduciary under the DPDP Act; for records a Customer uploads about that Customer's end-customers, the Customer is the Data Fiduciary and we act as a Data Processor.

Account and contact data, business and KYC data (GSTIN, address), device and transaction records (IMEI, sales, invoices), payment/billing records, and usage/technical data including cookies.

Card and bank credentials are handled by our payment processor and are not stored on our servers.

To provide and support the Service, run checks you request, process billing, secure the platform, and meet legal obligations.

We do not sell your personal data and do not use it for advertising profiling.

We process personal data based on your consent and the certain legitimate uses permitted under the DPDP Act. You may withdraw consent at any time.

We share data with vetted processors, payment partners, and authorities where required by law. We do not sell personal data.

Error reports from our website and dealer app and from our operator console go to Sentry (error monitoring). They carry no user identity, cookies, headers, request bodies or query strings; long numbers and email addresses are masked; Sentry may add an approximate city and country worked out from the network address, without storing the address.

We aim to host and process data within India; any transfer outside India will follow the restrictions permitted under the DPDP Act. Error reports sent to Sentry are stored on its servers in the United States; section 5 describes what they leave out or mask.

We keep statutory records such as invoice and GST records for as long as the law requires — under section 36 of the CGST Act, 2017, 72 months from the due date of the annual return (about eight years) or, if an appeal, proceeding or investigation about them is pending, one year after it is finally decided, whichever is later. Security logs are kept for a rolling 180 days (CERT-In directions, 2022) and, once the relevant provisions of the DPDP Rules, 2025 come into force, personal data, traffic data and logs of processing for at least one year. All other personal data is erased or anonymised when its purpose ends.

We apply reasonable safeguards including encryption in transit, access control, tenant isolation and audit logging, and will notify breaches as required by the DPDP Act.

Subject to legal limits, you may request access, correction, completion, and erasure, withdraw consent, nominate another individual, and use our grievance process.

We use only strictly necessary cookies — no analytics or advertising cookies; a visitor who is not signed in gets none. Signing in sets three httpOnly, SameSite=Lax cookies: safeguard_session (30 minutes), safeguard_refresh (30 days) and sg_session (30 days, no personal data); signing out deletes them. NEXT_LOCALE (your chosen language, 1 year), sg_store (your selected shop, 1 year) and short-lived sign-up or re-confirmation cookies (up to 15 minutes) are set only when you use those features. Error reports sent to Sentry set no cookie.

We may update this policy and will post a new “Last updated” date, with extra notice for material changes.