1. Introduction
This Privacy Policy explains how MandiSpot Pvt. Ltd. ("we", "us") collects, uses, discloses and safeguards your personal data when you use our Platform. It complies with India's Digital Personal Data Protection Act, 2023 (DPDP Act), the IT Act 2000 and its Reasonable Security Practices rules.
2. Data We Collect
You provide us:
- Name, mobile number, delivery address, email (optional)
- Store name, GSTIN, PAN, FSSAI licence (for shop owners only)
- Photographs and descriptions of products you list
- Order history, saved carts, product reviews
Collected automatically: device / browser type, IP address, coarse geolocation (for the 5-km nearest-shop feature — never fine-grained), pages visited, timestamps, referring URL.
From third parties: KYC verification results (Aadhaar/PAN authentication providers), payment status from Razorpay / Stripe / PayPal.
3. Purpose of Processing
- To create your account, authenticate you and let you shop or sell
- To route orders, coordinate delivery and process payments
- To send order updates, price-drop alerts, delivery OTPs and account notifications via SMS / WhatsApp / email
- To personalise product recommendations and nearest-shop discovery
- To detect fraud, prevent abuse, comply with tax and legal obligations
- Improving the Platform via anonymised analytics
4. Legal Basis (DPDP Act §7)
We process your data on the basis of (i) your consent given at signup and at each specific opt-in (e.g. price-drop SMS/WhatsApp), (ii) the necessity to perform a contract (delivering the order you placed), and (iii) our legitimate uses such as fraud prevention and record-keeping under Indian tax law.
6. Storage, Security & Retention
Data is stored in secure, encrypted-at-rest MongoDB instances hosted in India. Passwords are never stored; we use OTP-only authentication. Card data never touches MandiSpot servers.
We retain personal data only for as long as your account is active plus the period required by law (typically 8 years for GST-invoice records). You may request earlier deletion — see "Your Rights" below.
7. Your Rights (DPDP Act §11–14)
You have the right to:
- Access a copy of the data we hold about you
- Correct or update inaccurate data
- Withdraw consent (this will stop marketing but may limit service)
- Nominate another person to exercise your rights in case of incapacity
- Erasure of your data (subject to legal retention obligations)
- Grievance redressal — see contact below
To exercise any of these, email dpo@mandispot.in. We respond within 30 days.
9. Children's Data
MandiSpot is not directed at children under 18. If you believe a child has provided us data, contact dpo@mandispot.in and we will erase it.
10. Grievance Officer
Under Rule 5(9) of the IT (Reasonable Security Practices) Rules, our Grievance Officer is:
Ms. R. Sharma
MandiSpot Pvt. Ltd.
Hyderabad, Telangana, 500034, India
Email: grievance@mandispot.in
Phone: +91 1800-000-000
11. Changes
We will notify you of material changes via in-app banner and email at least 15 days before they take effect.