Privacy Policy

Effective date: [[EFFECTIVE DATE]]

This policy explains how [[COMPANY NAME]] ([[COMPANY REGISTRATION DETAILS]]), registered office [[REGISTERED ADDRESS]] ("Grind Shop", "we", "us"), handles personal data. It follows the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the rules made under it, and the Information Technology Act, 2000, as they apply to us.

1. The two roles we play

Grind Shop plays one of two roles, and this policy is about the first one.

• We are the data fiduciary for data about merchants and their staff (people who create a Grind Shop account), visitors to our website and admin, people who contact us, and people who report a store. We decide why and how that data is used. This policy applies to it.
• We are a data processor for the personal data of shoppers that passes through a store. The merchant who runs the store decides why and how its shoppers' data is used, and is the data fiduciary for it. We process it only on the merchant's behalf, under our Data Processing Terms. If you bought something from a store, read that store's own privacy notice and send your request to the store first. We help the store to answer it.

2. What we collect and why

We collect only what we need for these purposes. We do not sell personal data, and we do not use it for advertising.

On what ground

We process this data on the basis of the consent you give when you sign up or send us something, or where the DPDP Act allows processing without consent for certain legitimate uses, for example to comply with a law or an order, to respond to a medical or safety emergency, or to prevent and investigate fraud and abuse.

3. Cookies and similar technologies

We use a small number of cookies, all strictly needed for the Service to work:

• Merchant sign-in (on the admin address only): a session cookie that keeps you signed in; a short-lived cookie while you finish two-step verification; an optional cookie if you choose to trust a device for 30 days; and a short-lived cookie that carries a one-time message after a form.
• Stores: a cart cookie that remembers a shopper's cart on that store.

These cookies are not used for advertising or to track you across websites. The Grind Shop website itself sets no analytics or advertising cookies at this time. If that changes we will update this policy first and, where the law requires, ask for your consent.

4. Who we share data with

• Service providers who process data for us under contract: our hosting provider ([[HOSTING PROVIDER]]), our e-mail delivery provider ([[EMAIL PROVIDER]]) and [[OTHER SERVICE PROVIDERS]].
• Services a merchant connects. If you connect a payment gateway, a courier, a messaging tool or another app to your store, data flows to it because you chose it. It is then covered by that provider's terms.
• Authorities. We share data when a law, a court or a competent government authority requires it, and when needed to protect people, to investigate fraud or abuse, or to enforce our terms.
• Business changes. If we merge with or are bought by another business, personal data may transfer to it, and we will tell you before it is covered by a different policy.
• Reporters. We do not tell a reported store who reported it, unless the law requires it or you ask us to.

5. Where data is stored

Our servers are in [[HOSTING REGION]]. If personal data is transferred outside India, we do so only where the DPDP Act and its rules allow it.

6. How long we keep data

• Account data: while your account is open, and for [[ACCOUNT DATA RETENTION PERIOD]] after it is closed, unless the law requires us to keep it longer.
• Server and security logs: for as long as needed for security and as the law requires.
• Reports: for [[REPORT RETENTION PERIOD]] after the report is closed.
• Backups: until the backup is replaced, within [[BACKUP RETENTION PERIOD]].

We then delete the data or make it anonymous.

7. Security

We protect personal data with measures that fit the risk. Today they include:

• encrypted connections (HTTPS) for the website, the admin, the checkout and the stores;
• passwords stored only as salted one-way hashes, and mandatory two-step verification (an authenticator app) for store owners and admins;
• keys and secrets that merchants give us for integrations stored encrypted;
• every store's data kept apart from other stores' data by the application and by database row-level security;
• an isolated checkout on its own web address, with no third-party scripts, and strict browser security headers on every part of the Service;
• limits on repeated sign-in attempts, and checks against forged form submissions.

No system is perfectly secure. If a personal data breach affects you, we will notify the affected people and the authorities as the law requires.

8. Your rights

Under the DPDP Act you have the right to:

• get a summary of the personal data we process about you and the people we share it with;
• ask us to correct, complete or update it;
• ask us to erase it, unless we must keep it by law;
• have your grievance answered (see section 11);
• nominate another person to exercise these rights if you die or cannot do so yourself;
• withdraw your consent at any time. This is as easy as giving it. We then stop the processing that relied on it, but processing already done stays lawful.

To use these rights write to our grievance officer (section 11). We may need to confirm who you are. We reply within [[RIGHTS RESPONSE PERIOD]]. If our answer does not resolve the matter, you may complain to the Data Protection Board of India.

9. Children

Grind Shop is for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to us and we will delete it. Merchants must not collect a child's personal data except as the law allows.

10. Changes to this policy

We may change this policy. We will post the new version here with its effective date, and tell merchants by e-mail or in the admin before a material change takes effect.

11. Grievance officer and contact

For any question, request or complaint about personal data, or to report content, write to our grievance officer:

We acknowledge a complaint within [[GRIEVANCE ACKNOWLEDGEMENT PERIOD]] and aim to resolve it within [[GRIEVANCE RESOLUTION PERIOD]] of receiving it. Our general contact details are on the Contact page.