GetBanayaGetBanaya
DRAFT — NEEDS LAWYER REVIEW BEFORE GOING LIVE. Not legally binding until reviewed and approved by counsel and the founder.

Privacy Policy

Last updated: [DRAFT — date to be set on legal sign-off]

1. What we collect

  • Account details: name, email, WhatsApp/phone number, city.
  • Creator verification data: Aadhaar-linked identity information obtained via DigiLocker.
  • Order data: products ordered, order status, delivery address.
  • Payment metadata: order amounts and payment status. GetBanaya does not store raw card, UPI, or bank account details — these are handled directly by our payment processor, Razorpay.

2. How we use your data

We use your data to fulfil orders, send WhatsApp and email order updates, verify Creator identity, and operate the marketplace. We only send marketing communications with your consent.

3. Who we share data with

  • Supabase — our database and authentication infrastructure.
  • Razorpay — our payment and escrow processor.
  • WhatsApp/Meta — for order notification delivery.

We do not sell personal data to third parties.

4. Data retention

We retain account and order data for as long as your account is active and as required to meet legal, accounting, or dispute- resolution obligations.

5. Your rights

You may request access to, correction of, or deletion of your personal data, subject to our legal recordkeeping obligations.

6. Cookies

[OPEN QUESTION — pending audit]

This section will list the specific cookies/local storage used (e.g. authentication session cookies) once an audit of the live site confirms what is actually set, so this policy does not over- or under-claim.

7. Children's privacy

The Platform is not directed at children under 18. We do not knowingly collect data from minors.

8. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified to users.

9. Grievance Officer

[OPEN QUESTION — required before launch]

Under India's Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, platforms processing personal data at scale must designate a named Grievance Officer with published contact details. A real name and contact cannot be placeholder-filled — this must be supplied before this policy goes live.

10. Contact

[DRAFT — legal entity name, address, and contact email to be added.]