Privacy

Last updated: 30 October 2026. This policy explains how Vyapar X (the website and the Android app), run by Gembomart Tradelink Pvt. Ltd. ("we"), handles personal data. We follow India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

What we hold

• Account: your name, email address and password (stored only as a one-way hash), and your mobile number if you add one.
• Activity you create: enquiries, messages, quotations, appointments, orders and delivery details, saved items, reviews and help requests.
• For businesses: the profile, listings, photographs, contact details and notes you enter. Photographs lose camera location data before upload.
• Approximate location: only if you press "Near me". Your phone's position is rounded to about 1 km, used for that search, and not saved to your profile. We never collect location in the background.
• Camera: only when you choose to take a photo for a listing or banner. The photo is uploaded only if you submit it.
• Notifications: if you allow push messages in the Android app, we store a device token so we can send them. You can switch this off in your phone's settings or by signing out.
• Security records: sign-in attempts, the network address they came from, and administrator actions.
• On your device: the app keeps a sign-in token in the phone's secure storage and a copy of recently viewed pages so it can work offline. Signing out clears them.

We do not collect payment card numbers, government ID numbers or your contacts, and we show no advertising or advertising trackers.

Why we use it

Only to run the service: show listings, let businesses and customers talk and trade, keep accounts safe, send the messages you asked for, prevent abuse and answer help requests. Our legal bases are your consent (for example location, camera, push and phone verification) and the need to provide the service you asked for. We do not sell your data.

Who else sees it

• A business sees the name, enquiry text, delivery details and phone number you choose to send it. Its private notes are never shown to you.
• Our staff can see accounts, enquiries and orders when handling moderation or help.
• Service providers that process data for us: Google Firebase (push delivery and phone number verification), our email and SMS providers (they receive the address or number and the message), and our hosting provider. The AI assistant, when used, sends only the text you ask it to work on to the AI provider.
• Authorities, when the law requires it. Nothing is shared with advertisers.

Our servers are in India unless we tell you otherwise; some providers (for example Google) may process data in other countries under their own safeguards.

How long we keep it

• Notifications: read ones 6 months, unread ones 1 year.
• Email delivery records and webhook records: 90 days.
• Sign-in and reset codes: 30 days at most; phone codes: 1 day.
• Personal details on completed orders (address, phone): 2 years, then removed.
• Security log: 2 years.
• Enquiries and listings stay while the business account exists.
• Encrypted backups may hold removed data for up to 35 days before they expire.

Your rights and choices

You may access, correct, download and erase your data, withdraw consent, and complain.

• Download: Profile → Account, privacy & security → Download my data.
• Correct: edit your name, number and business details in the app.
• Delete: Close my account in the same place, or see how to delete your account. Closing takes effect 24 hours after you ask, and you can undo it until then (we email you a link). It then removes your name, email, phone number and sign-in; enquiries you sent stay with the business they were sent to, without your details, because they are that business's record.
• Withdraw consent: turn off location, camera or notifications in your phone's settings at any time; the app keeps working.
• Complain: write to our Grievance Officer, Vishwas Raybole, at [email protected]. We aim to acknowledge within 48 hours and resolve within 15 days. If you are not satisfied you may approach the Data Protection Board of India.

Children

Vyapar X is for people aged 18 and over. We do not knowingly collect data from children; if we learn we have, we delete it.

Security

Passwords are hashed, traffic is encrypted, access is limited by role, and administrator accounts can use a second factor. No system is perfectly safe; if a breach affects you we will tell you and the authorities as the law requires.

Changes

We will show the new date above and tell signed-in users about important changes.