1 Who we areहम कौन हैं
TradeTrak operates as a domestic Wholesale Commerce Network — "Connect. Quote. Close." — built for B2B sellers and buyers trading commodities such as makhana, wheat, rice, pulses, spices, dry fruits, edible oil, animal feed and packaging material. The platform runs on Company Profiles (seller, buyer, or both), a Product Catalog with stock management, an RFQ Marketplace where buyers post requirements and sellers quote, a Quotation Generator, an Order Tracker, a Customer CRM, Payment Reminders and an Affiliate Program. When this policy says "TradeTrak," "we," "us" or "our," it refers to all of these modules together, since they run on one account and one underlying data platform.
TradeTrak एक घरेलू Wholesale Commerce Network है — "Connect. Quote. Close." — जो makhana, wheat, rice, pulses, spices, dry fruits, edible oil, animal feed और packaging material जैसी वस्तुओं का व्यापार करने वाले B2B seller व buyer के लिए बनाया गया है। यह प्लेटफ़ॉर्म Company Profiles, Product Catalog, RFQ Marketplace, Quotation Generator, Order Tracker, Customer CRM, Payment Reminders और Affiliate Program पर चलता है — ये सभी एक ही अकाउंट और एक ही डेटा प्लेटफ़ॉर्म पर काम करते हैं।
We act as the Data Fiduciary (under India's DPDP Act, 2023) and, where GDPR applies, the Data Controller for the personal data described below. You can reach our team any time at support@tradetrak.in.
2 Data we collect
We collect only what is necessary to run your storefront, match RFQs with quotes, generate quotations, track orders, remind you of dues, and keep your account secure.
| Category | Examples | Collected when |
|---|---|---|
| Account & identity | Name, email, phone, password hash, Google sign-in ID, role (seller / buyer / both) | Sign-up, login, profile updates |
| Company profile data | Company name, GSTIN, city/state, address, bank details, contact person, categories traded | Completing your Company Profile |
| Product catalog data | Product name, category, unit, MOQ, price range, stock quantity, images, specs (moisture, purity, grade) | Adding or editing products |
| RFQ & quote data | Requirement details, target price, delivery city/deadline, submitted quotes, accepted quotes | Posting an RFQ or submitting a quote |
| Orders & CRM | Order line items, delivery city, order status, customer notes, payment reminders | Creating orders or managing customers |
| Messages | Buyer↔seller chat messages tied to a product enquiry | Using "Chat with Seller" |
| Payment data | Plan selected, billing cycle, payment status (card/UPI handled directly by Razorpay — we never store full card numbers) | Subscribing, unlocking a Premium Lead, or featuring a listing |
| Usage & device data | Pages visited, product views, search appearances, IP address, browser type, approximate location | Automatically, via Firebase & Google Analytics |
| Affiliate data | Referral code, click logs, referred users, commission ledger, PAN (for payout), bank/UPI details | Joining the Affiliate Program or requesting a payout |
| Support & disputes | Ticket messages, dispute reasons, review ratings and comments | Raising a ticket, dispute or review |
We never ask for or store your full bank card number. Card and UPI payments are processed entirely by Razorpay, our PCI-DSS-compliant partner; TradeTrak only receives a payment status and reference ID.
3 How we use your data
- To run your Company Profile, Product Catalog and public storefront on the marketplace.
- To match open RFQs with relevant sellers and route submitted quotes back to buyers.
- To generate professional, WhatsApp-shareable quotation PDFs on your behalf.
- To track orders end-to-end and send payment-due reminders.
- To run ComplyTrak's free GSTIN / IFSC / mobile-number validation.
- To process subscription payments (Starter / Growth / Pro), Premium Lead unlocks and Featured Listing purchases.
- To calculate and pay 5% recurring affiliate commissions.
- To send transactional emails — verification, receipts, RFQ alerts, quote notifications, due-payment digests.
- To detect fraud, abuse, fake listings and prevent unauthorized account access.
- To improve the product using aggregated, anonymized usage patterns — never to train shared public AI models.
- To respond to support requests, disputes, and legal obligations (e.g. GST, customs, or law-enforcement requests under Indian law).
4 Legal basis for processing
Under the DPDP Act, 2023, we process your personal data on the basis of your consent (given at sign-up and via in-product consent notices) and, for limited purposes, legitimate uses such as fraud prevention and compliance with statutory obligations (e.g. GST record-keeping). Where GDPR applies to you, our legal bases also include performance of a contract with you and our legitimate interests in operating and securing the service.
5 RFQ marketplace & contact masking
The RFQ Marketplace is built so that neither party's contact details are exposed by default. Here's exactly how your information flows through a typical RFQ:
- Buyer posts an RFQ — product, quantity, delivery city and target price only. No phone/email is shown publicly.
- Sellers submit quotes — price, lead time and a message; the seller's identity is visible, but direct contact details stay masked to the buyer.
- Contact stays masked until the buyer accepts a quote (which auto-creates an order and adds the buyer to that seller's CRM) or pays a small Premium Lead fee to unlock a seller's details early — either action notifies the other party.
- In-platform chat ("Chat with Seller") lets buyers message a seller about a specific product without exchanging phone numbers at all.
By design: your phone number and email are never included in an RFQ, a quote, or a product listing itself — they're only shared once you or the other party takes an explicit action to connect.
7 Payments & Razorpay
Every payment on TradeTrak — subscription plans (₹499 / ₹999 / ₹1499 per month), Premium Lead unlocks (₹49) and Featured Listing purchases (₹15/day) — is processed through Razorpay order + signature verification (HMAC-SHA256), and confirmed again via Razorpay's signed webhook. TradeTrak's servers never see or store your card number, CVV, or UPI PIN.
8 Affiliate program data
If you join the Affiliate Program, we additionally process your unique referral code, click and conversion logs, the list of users you referred (only their plan tier and subscription amount — never their private business data), your running commission ledger, and — only once you request a payout — your PAN (for verification) and bank/UPI details.
Commissions are held in an "in review" state for 15 days before becoming withdrawable, to protect against fraudulent or reversed transactions. Payout requests below ₹500 are not processed, and PAN verification is required before your first payout.
10 Data retention
| Data type | Retention period |
|---|---|
| Account data | While active, plus up to 90 days after deletion (recovery window) |
| Orders, quotations & payment records | Minimum 8 years, per Indian GST & tax record-keeping rules — even after account deletion |
| RFQs & quotes | 3 years from closure, for dispute-resolution purposes |
| Chat messages | 3 years from the last message in a conversation |
| Support tickets & disputes | 3 years, for quality and dispute-resolution purposes |
| Affiliate & commission records | 8 years, aligned with financial record-keeping requirements |
| Analytics data | Aggregated form indefinitely; raw device-level data up to 14 months |
11 How we protect your data
- Encryption in transit (TLS/HTTPS) for all traffic and at rest via Google Cloud/Firebase infrastructure, pinned to the asia-south1 region.
- Role-based Firestore security rules so one user's data is never readable by another user's account.
- Razorpay payment signature verification (HMAC-SHA256) on every transaction and webhook — no client-supplied payment data is ever trusted blindly.
- Firebase Authentication with Google sign-in and email/password support.
- RFQ contact-masking by default — see Section 5.
- All internal admin actions are logged to an immutable audit trail (adminLogs).
- Regular review of third-party processor security practices.
No system is 100% immune to risk. If we ever become aware of a data breach affecting your personal data, we will notify affected users and the relevant authority as required under applicable law, without undue delay.
12 Your rights
As a Data Principal under the DPDP Act (and, where applicable, under GDPR), you have the following rights over your personal data:
To exercise any of these rights, email support@tradetrak.in with the subject line matching the request (e.g. "Data Access Request," "Data Deletion Request"). We verify your identity before actioning any request and respond within 30 days.
13 International data transfers
TradeTrak's infrastructure runs primarily in Google Cloud's asia-south1 (Mumbai) region. Some processors we use (e.g. SendGrid) may process data on servers outside India. Where this happens, we rely on our processors' standard contractual data-protection safeguards, consistent with DPDP Act and GDPR requirements for cross-border transfer.
14 Children's privacy
TradeTrak is a business-to-business platform intended for users who are at least 18 years old and authorized to act on behalf of a business entity. We do not knowingly collect personal data from children. If we learn that a child's data has been collected without appropriate consent, we will delete it promptly.
15 Accessibility statement
We want this policy — and the platform it describes — to be usable by everyone. This page supports keyboard navigation, visible focus states, screen-reader-friendly headings, a reduced-motion mode, and a light/dark theme toggle for visual comfort.
- ✅ Semantic headings & landmarks
- ✅ Visible focus outlines
- ✅ Respects prefers-reduced-motion
- ✅ Skip-to-content link
- ✅ Colour contrast checked in both themes
- ✅ Resizable text without layout breakage
If you encounter an accessibility barrier anywhere on TradeTrak, email support@tradetrak.in with "Accessibility" in the subject line and we'll prioritize a fix.
16 Changes to this policy
We may update this Privacy Policy to reflect changes in our practices, products, or legal requirements. Material changes will be notified via email or an in-product notice. The "Last updated" date at the top of this page always reflects the most current version.
Version history
17 Frequently asked questions
No. We never sell personal data. We only share it with processors — Firebase, Razorpay and SendGrid — strictly to run the marketplace, under written data-processing terms.
Yes. We process personal data as a Data Fiduciary with purpose-limited collection, consent-based processing, and the full set of Data Principal rights described in Section 12.
Email support@tradetrak.in with subject "Data Deletion Request", or use Delete Account in Settings. We action verified requests within 30 days, subject to statutory GST/tax retention.
No. Your contact details stay masked until you accept a quote (auto-creating an order) or a buyer pays to unlock a Premium Lead — see Section 5 for the exact flow.
Never. Razorpay, our PCI-DSS-compliant partner, handles all payment credentials directly. TradeTrak only ever sees a payment status and reference ID.
A minimum of 8 years, as required by Indian GST and tax record-keeping rules — this applies even if you delete your account.
Our Grievance Officer is reachable at support@tradetrak.in with subject "Grievance". We acknowledge within 48 hours and resolve within 30 days.
No. Any product improvement work uses aggregated, anonymized usage patterns only — your business data is never used to train shared or public AI models.
18 Contact our Data Protection team
Questions about your data?
Our support team doubles as your first point of contact for privacy requests. For formal grievances, address your email to our Grievance Officer using the same inbox.
Was this privacy policy clear and helpful?
Thanks — your feedback helps us write clearer policies. 🙏