Privacy Policy

DropnShop (“we”, “us”) helps sellers launch and run their own online store. This policy explains what information we collect, how we use and protect it, and the choices and rights you have. It applies to store owners (“merchants”) who use our dashboard and to the buyers who shop on stores built with DropnShop.

We aim to comply with India’s Digital Personal Data Protection Act, 2023 (DPDP) and the Information Technology Act and rules, as applicable.

For a merchant’s own account and store data, DropnShop acts as the data fiduciary/controller. For a buyer’s personal data, the merchant whose store the buyer purchases from is the primary data fiduciary/controller, and DropnShop acts as a data processor — we handle that data on the merchant’s behalf and on their instructions to run the store, payments, and orders.

• Account & store details — your name, email, phone/WhatsApp number, store name, address, category, and store settings.
• Product & order data — the products you list and the orders placed on your store.
• Buyer information — a buyer’s name, contact, shipping address, and order details, which we process so the merchant can fulfil the order.
• Payment information — payments are processed by Razorpay using the merchant’s own account. Card, UPI, and bank details are handled by Razorpay; DropnShop does not store full payment credentials.
• Usage & device data — basic analytics such as pages visited, device/browser type, and IP address, used to keep the service secure and improve it.

We process personal data based on your consent and for legitimate, lawful purposes — to provide the service you asked for, to meet legal and tax obligations, to keep the platform secure, and to prevent fraud and misuse. Where we rely on consent, you can withdraw it at any time (see “Your rights”); withdrawing consent may limit features that depend on that data.

• To create, run, and secure your store, dashboard, and account.
• To process orders and enable payments through Razorpay.
• To send transactional messages (order confirmations, security and service updates).
• To screen store and product content for prohibited or illegal items, as required by law and our payment partners.
• To provide support and to improve and develop the platform.

DropnShop uses a “bring-your-own-keys” model: each merchant connects their own Razorpay account, and customer payments are collected and settled directly through it. Sensitive payment data (card numbers, UPI credentials, bank details) is handled by Razorpay under its own security standards and privacy policy. We only receive payment status and order metadata needed to update your dashboard.

We do not sell your personal data. We share information only with service providers that help us run DropnShop, under appropriate confidentiality and data-protection obligations:

• Razorpay — payment processing and settlements.
• Cloud hosting & storage — to host the app and store images and files (e.g. object storage / CDN).
• Email delivery — to send OTPs, receipts, and notifications.
• AI content screening — listing and store text may be sent to an AI provider to detect prohibited goods.
• Legal & safety — where required by law, or to protect our users, our platform, or the public.

Some of our service providers may store or process data outside India. Where that happens, we take steps to ensure your data continues to be protected consistent with this policy and applicable law.

We use essential cookies to keep you signed in and to keep the service secure, plus limited analytics cookies to understand usage. Merchants who enable marketing pixels on their storefront are responsible for disclosing those to, and obtaining any required consent from, their own buyers.

We keep your data while your account is active and for as long as needed to provide the service, comply with legal and tax obligations, resolve disputes, and enforce our agreements. When you delete your store or account, we remove or anonymise personal data within a reasonable period, except where we must retain it by law.

We use reasonable security safeguards — encryption in transit, access controls, and sensitive-field encryption — to protect your data. No method of transmission or storage is perfectly secure, but we work continuously to protect your information and to respond quickly to any incident.

If we become aware of a personal-data breach that affects you, we will take reasonable steps to contain it and, where required by law, notify the relevant authority and affected users without undue delay.

Subject to applicable law, you may:

• Access the personal data we hold about you and request a summary of its processing.
• Correct or update inaccurate or incomplete data.
• Request erasure of your data, or withdraw consent, where the law allows.
• Nominate another person to exercise your rights in the event of death or incapacity, as provided by DPDP.
• Raise a grievance (see below).

You can manage most of this from your dashboard. Buyers should contact the store they purchased from first; we will assist the merchant where needed.

DropnShop is not directed to children under 18, and we do not knowingly collect their personal data. If you believe a minor has provided us information, contact us and we will delete it.

We may update this policy as the product and the law evolve. When we make material changes, we’ll update the “last updated” date and, where appropriate, notify you in the dashboard or by email.

For any privacy question or to raise a grievance, email support@dropn.shop. We will acknowledge grievances promptly and aim to resolve them within the timelines required by applicable law (typically within 30 days).