TradeTrak Privacy Policy

1. Summary in plain words

This Privacy Policy explains how TradeTrak handles personal data when you visit tradetrak.in, create an account, buy or sell products, message another user, subscribe to our newsletter or contact us. It is written to follow the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and the rules made under it, and the Consumer Protection (E-Commerce) Rules, 2020. By using TradeTrak you agree to this policy together with our Terms of Use, Refund & Cancellation Policy, Shipping Policy and, for sellers, the Seller Terms.

2. Who we are and our role

TradeTrak operates the marketplace at tradetrak.in where verified sellers list rice, atta, dal, spices, oils, ghee, dry fruits, makhana, tea and packaged food, and buyers purchase them with online payment. For the personal data described in this policy, TradeTrak decides why and how the data is processed, so we act as the "Data Fiduciary" under the DPDP Act. You, as the person the data relates to, are the "Data Principal".

TradeTrak is an intermediary. When you place an order, the seller also becomes responsible for the order details they receive from us, and they must use them only to fulfil that order and meet legal duties such as GST invoicing.

3. Personal data we collect

3.1 Data you give us

3.2 Data created when you use TradeTrak

• Transaction records: payment status, amount, Razorpay order and payment reference, refunds and seller payout records.
• Notifications: in-app alerts and service emails about orders, payments, plan status, verification and disputes.
• Terms acceptance log: the version of the Seller Terms you accepted, the time, and a one-way hash of your IP address.
• Usage and security data: a one-way hash of your IP address (not the raw address) used for rate limiting, fraud prevention and counting a view once per visitor per day; listing views, cart adds and order counts used for seller analytics.
• Audit logs: a record of important account and admin actions, kept for security and accountability.

3.3 Data from third parties

If you sign in with Google, Google shares your name, email address and verification status with us. Razorpay confirms to us whether a payment succeeded. We do not buy personal data from data brokers.

4. Why we use your data

We process personal data only for specified purposes and on the basis of your consent or another legitimate use permitted by the DPDP Act.

We do not use your personal data for automated decisions that have legal effects on you without human review.

5. Who can see your data

5.1 Other users

• Seller sees buyer (paid orders only): name, delivery address, phone number, business details and order notes, so the order can be packed and shipped. Sellers cannot see a buyer's other orders or any payment instrument.
• Buyer sees seller: business name, address, city, state, GSTIN and FSSAI number on an order, as needed for invoices and Legal Metrology transparency.
• Public seller storefront and listings: business name, city, state, categories, description, Verified status, ratings and product information. Phone number, email address and GSTIN are never shown publicly.
• Reviews: shown with the reviewer's business name.
• Messages: visible only to the buyer and seller in that conversation and to authorised TradeTrak staff when needed to handle a report, dispute or legal request.

5.2 Service providers who process data for us

• Google (Firebase and Google Cloud): authentication, database, file storage, serverless functions and hosting.
• Razorpay: payment collection and refunds.
• Google Analytics: aggregated site usage statistics.
• Cloudflare Turnstile: bot protection on public forms, where enabled.
• Email delivery service: sending transactional and newsletter emails.

These providers may use data only to provide their service to us and under their own security and privacy commitments.

5.3 Couriers

Sellers choose and book their own couriers and share delivery details with them. Courier partners handle that data under the seller's arrangement and their own policies.

5.4 Legal and business reasons

We may disclose data when required by law, a court order or a competent authority, to protect rights, safety and property, to investigate fraud or a breach of our Terms, or to a successor if TradeTrak is merged or acquired, in which case this policy continues to apply to your data. We do not sell personal data.

6. Payments and financial data

• We verify each payment using a cryptographic signature before marking an order as paid.
• Refunds go back to the original payment method through Razorpay.
• Seller payout details are stored privately. Staff access to them is limited to authorised administrators and every access is logged.
• If statutory deductions such as GST TCS or income-tax TDS apply to seller payouts, they are recorded in the payout statement.

7. Cookies, local storage and analytics

TradeTrak uses a small number of cookies and browser storage technologies:

You can block or delete cookies and site data in your browser settings. If you do, parts of TradeTrak such as sign-in and cart may not work properly. You can also use the Google Analytics opt-out browser add-on. We do not use cookies to show third-party advertising.

8. How long we keep data

We keep personal data only as long as needed for the purpose it was collected, or as long as the law requires. Typical periods are:

9. Your rights under the DPDP Act

As a Data Principal you have the right to:

• Access: get a summary of the personal data we hold about you and how it is processed.
• Correction and updating: fix inaccurate or incomplete data. Most details can be edited yourself from your business profile and saved addresses.
• Erasure: ask us to delete your personal data when it is no longer needed for the purpose it was collected, unless the law requires us to keep it.
• Withdraw consent: at any time, as easily as you gave it. Withdrawal does not affect processing done before it. Some features may stop working if the data they need is withdrawn.
• Grievance redressal: raise a complaint with us and, if unresolved, with the Data Protection Board of India.
• Nominate: name another person to exercise your rights if you die or become unable to do so.

To use these rights, write to us through the Contact page from the email address registered on your account. We may ask you to verify your identity first, and we aim to respond within 30 days.

10. Deleting your account

1. Complete or cancel all active orders. An account with active orders cannot be deleted.
2. Open your account page and choose the delete account option.
3. Type DELETE to confirm.

After deletion we remove your business profile, product listings and photos, private verification documents, payout details, cart, saved addresses and notifications, and your sign-in account. Order records are kept as trade records, because the other party and tax law need them. To unsubscribe from the newsletter only, use the unsubscribe link in any email.

11. How we protect your data

• All traffic is encrypted in transit with HTTPS.
• Data is stored on Google Cloud infrastructure with database and storage security rules, so users can read only the records that belong to them.
• Verification documents and payout details are stored privately and are not publicly reachable.
• Passwords are handled by Firebase Authentication. We require email verification before account use.
• Administrative access is role-based, limited to what staff need, and important actions are logged.
• Rate limiting, bot checks and hashed IP addresses help prevent abuse.

No system is perfectly secure. If a personal data breach affects you, we will notify you and the Data Protection Board of India as required by law. Please protect your account: use a strong, unique password, never share your password or OTP, and log out on shared devices. TradeTrak staff will never ask for your password.

12. Where your data is stored

Our database and functions run in Google Cloud's Mumbai region (asia-south1). Some providers, such as Google Authentication, Google Analytics and email or bot-protection services, may process limited data on servers outside India. We transfer data outside India only to the extent permitted by the DPDP Act and any restrictions notified by the Government of India.

13. Children

TradeTrak is meant for adults aged 18 and above and for registered businesses. We do not knowingly collect personal data of children. If you believe a child has created an account, contact us and we will delete it.

14. Grievance officer and contact

For privacy questions, data requests or complaints, contact the TradeTrak Grievance Officer through the Contact page. Please mention "Privacy Request" in your message and write from your registered email so that we can verify you. We acknowledge complaints promptly and aim to resolve them within the time limits set by law.

If you are not satisfied with our response, you may complain to the Data Protection Board of India once it is operational under the DPDP Act.

15. Changes to this policy

We may update this policy when our features, providers or the law change. The "Last updated" date and version at the top show the current edition. For material changes we will notify you in the app or by email, and where the law requires, ask for your consent again. Continued use after the effective date means you accept the updated policy.

16. Frequently asked questions

Related pages