गोपनीयता सूचना

B. Privacy Notice (गोपनीयता सूचना)

Version 1.1 · Effective 25 September 2026 Issued under section 5 of the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025.

B.1 Who we are and our role

• For your own account data (as an owner or staff member of a Shop), SuvarnaMitra is the Data Fiduciary.
• For data the Shop enters about its own customers, karigars and suppliers, the Shop is the Data Fiduciary and we are its Data Processor. We process that data only on the Shop's instructions (see the Data Processing Addendum, §C). The Shop's customers should contact the Shop about their data.

B.2 Personal data we collect about you

We do not collect Aadhaar numbers, and we do not sell personal data or use it for advertising.

B.3 Who we share it with

Only service providers who help run the Service, bound by contract to protect it:

• Database hosting — Neon (Postgres), AWS Singapore (ap-southeast-1)
• Application hosting — Vercel (serverless functions pinned to Mumbai, bom1)
• Email delivery — Resend (invite and password-reset emails)
• Image storage — ImageKit (photos of ornaments, where the Shop uploads them)

We will disclose data to government authorities only when required by law. Our database is hosted in Singapore and our email and image providers may process data outside India. Transfer outside India is permitted under section 16 of the DPDP Act except to countries the Central Government restricts; Singapore is not a restricted country.

B.4 How we protect it

Encryption in transit (HTTPS) and at rest, one-way password hashing, strict separation of each Shop's data, role-based access, access logging and monitoring, and regular backups — the reasonable security safeguards required by s.8(5) of the DPDP Act and the Rules.

B.5 Personal data breach

If a breach affects your personal data, we will inform you without delay and report it to the Data Protection Board of India as required by the DPDP Rules (detailed report within 72 hours), and to CERT-In where its directions apply. For a breach of Shop customer data, we will inform the Shop without delay so it can meet its own obligations.

B.6 Your rights

Under the DPDP Act you may: 1. Access a summary of your personal data and who we shared it with (s.11); 2. Correct, complete, update or erase your data (s.12); 3. Withdraw consent at any time, as easily as you gave it (s.6(4)) — optional consents from Settings → Privacy; withdrawing required consents means closing your login, and does not affect processing done before withdrawal; 4. Nominate another person to exercise your rights on death or incapacity (s.14); 5. Raise a grievance with our Grievance Officer (s.13) — we will respond within 90 days, and aim for much sooner; if unsatisfied, you may complain to the Data Protection Board of India.

B.7 How long we keep it

• Account data: while your login is active, then deleted within 365 days of closure.
• Security and access logs: at least one year (DPDP Rules) and at least 180 days (CERT-In directions). They are stored with the database — see §B.3.
• Consent records: for the life of the account plus 3 years, because we must be able to prove consent.
• Shop business records (bills, ledgers) belong to the Shop, which may need to keep them for the period required by GST law; we keep them for the Shop until it asks for deletion or the contract ends (see Terms §9.3).

B.8 Children

The Service is not for anyone under 18. We do not knowingly process children's data for our own purposes.

B.9 Language

This notice is available in English and Marathi. You can switch language on the accept screen and in Settings. If there is any difference in meaning between the English and the Marathi version, the English version prevails.

B.10 Grievance Officer / contact for privacy

Abdulbasit Fakir · hello@prophetbird.com · +91 80555 71953 · Anmol Colony, Shamraonagar, Sangli 416416, Maharashtra, India

B.11 Changes

We will notify you of material changes and ask for fresh acceptance before they apply to you.