Review before you launch. This page is a starting template written
to match how this marketplace actually works. It is not legal advice. Have it reviewed
by someone qualified in your jurisdiction, replace every [BRACKETED] value,
then delete this banner from Admin → CMS → Pages.
Last updated: [DATE]. This policy explains what we collect, why, how long we keep it, and what you can ask us to do about it.
1. Who is responsible for your data
[LEGAL ENTITY NAME], [ADDRESS], is the data fiduciary for the personal data described here. Our grievance officer under the Digital Personal Data Protection Act, 2023 and the IT Rules, 2021 is [NAME], reachable at [EMAIL].
2. What we collect
| Category | Examples | Why |
|---|---|---|
| Account | Name, email, username, password hash, avatar | To create and secure your account |
| Billing | Billing name, address, state, GSTIN, phone | To determine the correct tax and issue a compliant invoice |
| Transactions | Orders, invoices, licences, wallet ledger, refunds | To deliver purchases and meet accounting and tax obligations |
| Author details | KYC documents, PAN, bank or UPI payout details | To verify identity and pay earnings out lawfully |
| Technical | IP address, browser and device, login times, download and licence-activation records | To secure accounts, prevent fraud and enforce licences |
| Support | Tickets, messages and attachments you send us | To answer you and keep a record of what was agreed |
We never store raw card numbers, CVVs or bank credentials. Card data goes directly to our payment partners; we receive only a token and the result. Payout details and two-factor secrets are stored encrypted.
3. Why we are allowed to process it
- To perform our contract with you — account, orders, downloads, licences, support.
- To comply with law — GST invoices, tax records, financial records, responses to lawful requests.
- Our legitimate interests — fraud prevention, licence enforcement, platform security, and improving the service.
- Your consent — marketing email, which you can withdraw at any time from your notification preferences without affecting anything else.
4. Who we share it with
Only where necessary, and never sold:
- Authors — when you buy an item or open a support ticket, its author sees your name and the details you put in the ticket. They do not see your card, address or payment details.
- Payment gateways — to take payment and issue refunds.
- Infrastructure and email providers — hosting, storage, transactional email, under contract and confidentiality.
- Authorities — where we are legally compelled.
- An acquirer — if the business is sold, subject to this policy continuing to apply.
5. How long we keep it
- Financial records (orders, invoices, tax, ledger): [EIGHT] years, as required by Indian tax and companies law.
- Account data: while your account is open, then [DAYS] days.
- KYC documents: [PERIOD] after the author relationship ends.
- Security logs (logins, licence checks, downloads): [PERIOD].
- Support tickets: [PERIOD] after closure.
Deleting your account does not delete financial records we are legally required to retain; those are kept in a restricted form and are not used for anything else.
6. Your rights
You can ask us to give you a copy of your data, correct it, delete it where we are not required to keep it, or stop using it for marketing. Write to [PRIVACY EMAIL]. We respond within [30] days. If you are not satisfied, you may complain to the Data Protection Board of India.
7. Security
Passwords are hashed, not stored. Sensitive fields are encrypted at rest. Downloads are served only through signed, expiring, permission-checked links. Administrative access requires two-factor authentication and every privileged action is written to an audit log. No system is perfectly secure; if a breach affects you we will tell you and the regulator as the law requires.
8. Cookies
We use cookies that are necessary for the site to work — your session, your cart, your CSRF token, your light/dark preference — and, where you have agreed, cookies for analytics and affiliate attribution. Blocking necessary cookies will break sign-in and checkout.
9. Children
The marketplace is not intended for anyone under 18 and we do not knowingly collect their data. If you believe a child has given us data, contact [PRIVACY EMAIL] and we will delete it.
10. Changes
We will post any change here and, if it is material, notify you before it takes effect.