Log inSign up
Draft — not yet reviewed by a lawyer and not in force. This text is a working draft prepared for legal review. Bracketed items like [Operator legal name] are still to be filled in.

Privacy Policy

Last updated: [date]. EcomPaisa is operated by [Operator legal name], [registered address] (“we”, “us”).

1. What this policy covers

How we collect, use, store and share personal data when you use EcomPaisa, a hosted service that reconciles Amazon India fees and computes profit for sellers. It is intended to meet the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and rules under it. [Lawyer to confirm applicable law and wording.]

2. Data we collect

  • Account data: your email address, a bcrypt hash of your password (never the password itself), your company name, and whether and when your email was verified.
  • Business profile: company legal name, GSTIN, financial-year start, tagline, owner name and role, fulfilment modes, STEP level, ship-from state, targets and objectives you enter.
  • Files you upload: Amazon settlement reports, dispatch logs, campaign reports, returns reports, fee invoices, COGS sheets, courier rates and rate cards. Settlement and returns reports contain Amazon order IDs and your buyers’ city, state and postal code.
  • Session data: one essential cookie holding a random session token (stored by us only as a hash), valid for up to 7 days. We use no advertising or analytics cookies. [Update if analytics are added.]
  • Billing data: which months you’ve unlocked and your credit packs. Card or UPI details will be handled by our payment provider, [name — not yet chosen], not stored by us.

3. Buyer data in your uploads

For buyer details contained in reports you upload, you are the data fiduciary and we process that data only on your instructions, to provide the service to you. [Lawyer: confirm the fiduciary/processor framing and whether a data processing agreement is needed.]

4. How we use data

  • To run the service: compute reconciliations, claims, claim deadlines and profit from your own files.
  • To operate your account: sign-in, email verification, password reset and service emails.
  • To bill for unlocked months and credit packs, and issue GST invoices.
  • To support you and run the service: authorised EcomPaisa staff can view your account and all its data, including your uploaded files and results. Every such access is recorded in an audit log.

We do not sell personal data, and we do not share seller data with third parties for their own purposes.

5. Who processes data for us

  • Hosting: [provider, region].
  • Email delivery: [provider — not yet chosen].
  • Payments: [provider — not yet chosen].

6. Storage and isolation

Data is stored in a database shared by all EcomPaisa accounts. Every record of seller data is tied to its account, and the service limits every query to the signed-in account. Data is stored in [country/region].

7. Retention and deletion

We keep your data while your account exists. You can download all of it, or delete your account, yourself at any time from Your account & data in the app. When you delete your account it is closed at once, and its data is kept for 30 days so it can be restored if you ask, then erased for good. [Backup retention to be set.] Tax and invoice records may be kept as long as the law requires.

8. Your rights

You can ask to access, correct or erase your personal data, withdraw consent, and nominate someone to exercise your rights. Contact our Grievance Officer: Mr. OP, [email on the EcomPaisa domain], [address]. We will respond within [period]. You may also complain to the Data Protection Board of India.

9. Security

Passwords are stored as salted bcrypt hashes; sessions and emailed links are random tokens stored only as hashes; emailed links expire and work once; accounts can’t be used until the email is verified. No system is perfectly secure; we will notify you and the authorities of a personal data breach as the law requires.

10. Changes

We’ll post changes here and, for material changes, tell you by email before they take effect.