Privacy Policy

What we collect, why, how long we keep it, and the control you have — under India's Digital Personal Data Protection Act, 2023.

Last updated: 28 August 2026

Draft — not yet in force

This document is a draft awaiting the operator’s registration details and review by a qualified lawyer. Bracketed placeholders are unfilled. Please do not rely on it as a final statement of terms.

In short: we collect what we need to run your account and connect buyers with sellers. We do not sell your personal data and we do not resell leads. Your GST and PAN numbers are encrypted, and your identity documents are never publicly reachable. You can export or delete your account yourself at any time.

1. Who is responsible for your data

For your own account and marketplace activity, the data fiduciary is [REGISTERED COMPANY NAME], [REGISTERED OFFICE ADDRESS, CITY, STATE, PIN].

Different rule for the CRM and invoicing tools: when you upload information about your customers, you are the data fiduciary for that information and we act as a data processor on your instructions. We process it only to provide the service to you, and we do not use it for our own purposes. You are responsible for having a lawful basis to hold it and for its accuracy.

2. What we collect

Information you give us

Account: name, email address, password (stored only as a cryptographic hash — we never see it), and your consent record.
Profile: phone number, company name, city, state, industry, and a short description.
Seller business details: business name, address, PIN, website, logo, year established, team size.
Verification: GST number, PAN number, and the supporting documents you upload.
Activity: product listings, enquiries you send (including the contact details and message in them), quotes, reviews you write, and saved suppliers.
Business records you enter into the CRM and invoicing tools, which may include information about your own customers.

Information collected automatically

A visit counter. A random identifier stored in your browser lets us count unique visitors and how many people are on the site. It is not linked to your account and contains nothing about you.
Search terms. We keep a count of what people search for, to show popular searches. Search text is stored without any link to the person who typed it.
The time you last signed in.

What we do not collect

We do not log your IP address in ordinary use, do not fingerprint your device, and do not set advertising or cross-site tracking cookies. The only cookie required to use the platform is the one that keeps you signed in. The single exception on IP addresses is in section 6.

3. Why we use it, and on what basis

Purpose	Basis
Create and secure your account; sign you in	Performing our contract with you
Show your listings and connect you with counterparties	Performing our contract with you
Check seller GST/PAN documents and award the Verified badge	Your consent, and our legitimate interest in a trustworthy marketplace
Send transactional email (verification codes, password resets, notices)	Performing our contract with you
Count visitors and popular searches	Legitimate interest — the data is not linked to a person
Prevent fraud, abuse and spam	Legitimate interest and legal obligation
Keep registration records after an account closes	Legal obligation — IT Rules 2021

4. What other people can see

Your public storefront — business name, description, city, listings, logo, website and Verified status — is visible to anyone, including search engines.

When you send an enquiry, the seller receives your name, email address, phone number and message, and your address if you provided one. That is the point of an enquiry: they need it to reply to you. Only that seller receives it.

Your GST and PAN numbers are never shown publicly. They are encrypted, and only a masked form is displayed. Your uploaded verification documents are stored outside the public website and can only be opened by our verification staff, whose every access is recorded.

Reviews you write are public and shown against the seller you reviewed.

5. Who we share it with

We do not sell your personal data, and we do not resell leads. We share only with:

The counterparty you contact — as described above.
Service providers who help us operate: an email delivery provider for transactional mail, and a payment gateway if you generate a payment link. They act on our instructions and may not use your data for their own purposes.
Authorities, where we are required to by law or a valid legal order.
A successor, if the business is sold or reorganised — we will tell you first.

Error-monitoring and product-analytics tools may be enabled in future; if they are, this section will be updated before they are switched on.

6. Security

Passwords are stored only as salted cryptographic hashes. GST and PAN numbers are encrypted at rest with AES-256-GCM. Verification documents are stored outside the public web directory, and every staff member who opens one is recorded — that record includes the staff member’s IP address, and is the only place we store an IP address at all. Access to production data is limited to staff who need it.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the Data Protection Board as the law requires.

7. How long we keep it

We keep your data while your account is open. When you delete your account:

your account goes dark immediately and your storefront disappears from the marketplace;
there is a 14-day grace period in which you can cancel — you keep control of the decision the whole time;
after that, your personal data is permanently erased from our live systems;
a sealed, encrypted archive of your registration information is kept for 180 days and then destroyed automatically. We are required to keep this by rule 3(1)(g) of the IT Rules, 2021. It contains your registration details and your own activity — not other people’s data, and no product images.

Some things deliberately survive, because they are not only about you: enquiries other buyers sent to you stay with those buyers, and reviews you wrote stay with the seller they describe, because other buyers rely on them. Both stop showing any link to you.

8. Your rights

Under the DPDP Act you may:

ask what personal data we hold about you and get a copy;
correct or complete anything inaccurate — most of it you can edit yourself in your profile;
erase your account and data — do it yourself from Account settings, or start from the data deletion page;
withdraw consent you previously gave;
nominate someone to exercise your rights if you die or become incapacitated;
complain to us and, if unsatisfied, to the Data Protection Board of India. Please give us the chance to fix it first — tell us through the support page.

We do not charge for these requests and will respond within the timelines the law requires. We may need to confirm your identity before acting.

9. Children

SupaBuyer is a business platform and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, tell us through the support page and we will delete it.

10. Where your data is held

Our database is hosted on infrastructure we control. Some service providers — for example our email provider — may process data outside India in the course of delivering a message. We only use providers who commit to appropriate safeguards, and only for the purposes in section 5.

11. Changes

If we change how we use your data in a way that affects you, we will tell you by email or in the app before the change takes effect. The date at the top shows the current version.

Questions about this document? Get in touch with our support team.