Privacy policy

• Phone number, to sign you in with a one-time code and to contact you about orders.
• Name, which you provide when you create your account.
• Delivery addresses and PIN codes, to check which suppliers can serve your site and to deliver orders.
• Order details: products, quantities, prices, status history and payment method (cash on delivery).
• Reviews you choose to write about suppliers.
• Technical data such as IP address and browser type, used for security, abuse prevention and fixing errors.

We do not collect card or bank details. We do not store your precise GPS position: if you use “current location”, it is used once to suggest a PIN code and then discarded.

• To create and secure your account.
• To show products available at your location and to process, deliver and support your orders.
• To share the details a supplier or delivery partner needs to fulfil your order.
• To meet legal, tax and accounting obligations, and to prevent fraud.

Only with the parties needed to provide the service:

• The supplier fulfilling your order and any delivery partner assigned to it: your name, phone number and delivery address.
• Google Firebase for phone sign-in, and Google reCAPTCHA to block automated abuse of sign-in.
• Hosting and infrastructure providers that store and serve our app, database and product images (for example Vercel, Render, MongoDB Atlas and Cloudinary).
• Google Analytics, only if you choose "Allow analytics": which pages are visited and how, so we can improve the site. No advertising use. You can change this any time on the Cookie policy page.
• Authorities, where the law requires it.

Some of these providers may process data outside India, under their own security and privacy commitments.

We keep your account data while your account is active. Order records are kept for as long as tax and accounting laws require. When data is no longer needed, we delete or anonymise it.

Under India's Digital Personal Data Protection Act, 2023, you can ask us to:

• Tell you what personal data we hold about you.
• Correct or update inaccurate data.
• Delete your account and personal data, except records we must keep by law.
• Withdraw consent, which may mean we can no longer provide the service.

To make a request, contact us using the details below. We will respond within a reasonable time.

Sthiva is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

Data is sent over encrypted HTTPS connections. Sign-in uses one-time codes, so there are no passwords to steal. Access to personal data inside Sthiva is limited to staff who need it for their work.

If we change this policy in a meaningful way, we will update the date above and, where appropriate, tell you in the app.