Privacy Policy

This policy explains how Ujjwal Technolabs Private Limited ("Company", "we", "us"), operator of FlexiCommerce, handles personal data.

1. Information We Collect

We collect information you provide during registration and use of our platform:

• Account Data: Name, email, phone number, business name, password
• Business Data: GSTIN, PAN, bank details, store settings, product listings
• Compliance Data: Copies of licences and registrations (for example drug licence, FSSAI) where we request them under our Terms of Service
• Transaction Data: Orders, payments, refunds, shipping details
• Customer Data: Your store's customer data (managed by you, stored on our servers)
• Usage Data: Login history, IP address, device type, analytics, and the date, time and IP address at which you accepted our Terms of Service

2. How We Use Your Data

• Provide and maintain the FlexiCommerce platform
• Process subscriptions and billing
• Send transactional notifications (order updates, account alerts)
• Improve platform features and user experience
• Generate aggregated, anonymised analytics
• Verify compliance with our Terms of Service, including licences for regulated products
• Comply with legal obligations (GST, taxation, lawful requests from authorities)

3. Data Storage & Security

Your data is stored on secured servers in India. We use industry-standard security measures including:

• Encrypted connections (HTTPS/TLS)
• Hashed passwords (bcrypt)
• Rate limiting (120 req/min authenticated, 60 req/min guests)
• Role-based access control (RBAC) with 49 permissions
• Activity logging with Spatie Activity Log

If a personal data breach affects your data, we will notify you and the Data Protection Board of India as required by law.

4. Third-Party Data Sharing

We share data with third-party services only as necessary for platform functionality:

• Payment Gateways: Razorpay, Cashfree, PayU, PhonePe (for payment processing)
• Shipping: Shiprocket, Shipway (for order fulfilment)
• SMS/WhatsApp: MSG91, Twilio (for notifications)
• AI: OpenAI (for product descriptions and search, text only — no personal data)
• Analytics: Google Analytics, Microsoft Clarity (anonymised usage data)

We do not sell your personal data to any third party.

5. Disclosure to Authorities

We may disclose account, store, listing and transaction information to courts, law-enforcement agencies, regulators (including drug control and food safety authorities) and tax authorities where required by law, a court order or a lawful government request, or where needed to investigate a complaint about a store or listing.

6. Your Store's Customer Data

For your store's customer data, you are the Data Fiduciary and we act only as your Data Processor under the Digital Personal Data Protection Act, 2023. You are responsible for:

• Obtaining customer consent for data collection
• Displaying your own privacy policy on your store
• Handling customer data access, correction and deletion requests
• Any sensitive data your store collects, such as prescriptions, health information or age/identity proof for regulated products, including obtaining explicit consent and limiting access to authorised persons (for example a registered pharmacist)

On marketplace stores, you are also responsible for how your vendors access and use customer data.

7. Cookies

We set one necessary cookie for session management and protection against cross-site request forgery. Without it a form submission cannot be verified, so it is not optional.

Analytics and advertising cookies — Google Analytics, Google Ads and Microsoft Clarity — are set only if you accept them. A banner asks on your first visit. Until you accept, the Google tags run with storage denied and Clarity is not loaded at all. You can change your choice at any time from "Cookie settings" at the foot of any page, and nothing on this site behaves differently if you decline.

8. Data Retention

Account data is retained for the duration of your subscription. Upon termination, data is available for export for 30 days, after which it is permanently deleted. Transaction records may be retained for 7 years as required by Indian tax law. Terms-acceptance logs, licence copies and records relating to complaints or legal notices may be retained for as long as needed to establish or defend legal claims.

9. Your Rights (DPDPA 2023)

Under the Digital Personal Data Protection Act, 2023 (India), you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Withdraw consent for optional data processing
• Nominate another person to exercise your rights in case of death or incapacity
• Raise a grievance with us and, if unresolved, complain to the Data Protection Board of India

10. Children's Privacy

Our platform is not intended for users under 18 years of age. We do not knowingly collect data from minors.

11. Grievance Officer

Deepak Nagar
Ujjwal Technolabs Private Limited, Indore, Madhya Pradesh
Email: [email protected]

We acknowledge complaints within 24 hours and resolve them within 15 days.

12. Changes to This Policy

We may update this policy from time to time. We will notify you via email of significant changes. Continued use constitutes acceptance.

13. Contact

For privacy concerns, contact us at [email protected] or WhatsApp +91 99770 28207.