Privacy Policy

This policy covers everyone who uses GetBanaya — Buyers, Creators and visitors — and applies to our website and mobile app. For the purposes of India's Digital Personal Data Protection Act, 2023, GetBanaya is the Data Fiduciary for the data described below.

• Account details — your name, username, email address and, if you provide one, your WhatsApp or phone number, profile photo and preferred language. Your password is never stored in a readable form; our authentication provider stores only a cryptographic hash of it.
• Creator verification data — identity information obtained through Aadhaar-based verification via DigiLocker, and the payout details (bank or UPI) needed to pay you.
• Storefront and listing content — the shop details, product photographs and descriptions a Creator publishes. This is public by design.
• Order data — items ordered, order and escrow status, delivery address, design briefs, mockups and files exchanged for custom work, and messages between Buyer and Creator.
• Payment metadata— order amounts, payment status and the payment provider's reference identifiers. We do not receive or store your card number, UPI PIN or bank credentials — those go directly to our payment processor, Razorpay.
• Technical data — IP address, browser or device type and timestamps, recorded in server logs and used for security, abuse prevention and rate limiting.

We process your data to create and secure your account; to take payment, hold funds in escrow and pay Creators; to fulfil and deliver orders; to send order updates by WhatsApp and email; to verify Creator identity as the law and our own trust standards require; to investigate disputes, fraud and abuse; to meet accounting and legal obligations; and to keep the Platform working and improve it.

Order-related messages — payment confirmations, mockup approvals, shipping updates — are part of the service and are sent to everyone with an active order. Marketing messages are sent only if you opt in, and every one of them carries a way to opt out.

We share only what each recipient needs to do its job, and we do not sell personal data to anyone.

• Supabase — our database, authentication and file storage provider.
• Razorpay — payments, escrow and Creator payouts.
• Meta (WhatsApp Business Platform) — delivery of order notifications to your WhatsApp number.
• DigiLocker — Creator identity verification.
• The other party to your order— a Creator receives the delivery and contact details needed to fulfil your order; a Buyer sees the Creator's shop identity. Neither sees the other's payment details.
• Authorities — where we are required by law, or where it is necessary to establish, exercise or defend a legal claim.

Our database and file storage are hosted in an Indian region (Mumbai). Some of our processors — notably for payments and messaging — may process data outside India in the course of providing their services; where that happens we rely on their contractual commitments to protect it.

Account and profile data is kept while your account is open. Order, payment and escrow records are kept for as long as required for accounting, tax and dispute-resolution purposes — generally eight years from the end of the relevant financial year, in line with Indian recordkeeping requirements. Server logs are kept for a short period for security. When a retention period ends, data is deleted or irreversibly anonymised.

Under the Digital Personal Data Protection Act, 2023, you may:

• Ask what personal data we hold about you and how we use it.
• Ask us to correct or complete inaccurate data.
• Ask us to erase your data, subject to the records we must keep by law.
• Withdraw a consent you gave, such as for marketing messages.
• Nominate someone to exercise these rights if you cannot.
• Complain to us, and then to the Data Protection Board of India.

Most of this is available directly in your account settings. For anything else, write to privacy@getbanaya.in and we will respond within 30 days. We may need to verify your identity before acting on a request.

We use only what the Platform needs to function. There are no advertising, profiling or third-party tracking cookies on GetBanaya.

• Session cookies (names beginning sb-) — set by our authentication provider to keep you signed in. They are HTTP-only, so scripts on the page cannot read them.
• NEXT_LOCALE — remembers the language you chose, for a year.
• gb-password-reset — a short-lived, HTTP-only marker set only while you are completing a password reset, and deleted as soon as you finish.
• Local storage — small interface preferences kept in your browser, such as a remembered filter. This never leaves your device.

Blocking the session cookie will prevent you from signing in; the others can be cleared at any time from your browser settings.

All traffic is encrypted in transit. Every database table enforces row-level security, so a signed-in user can read only the rows they are entitled to. Privileged operations — releasing escrow, changing a user's role, issuing a payout — run only on our servers and cannot be initiated from a browser or device. Payment credentials never reach our systems.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the Data Protection Board of India as the law requires.

GetBanaya is not directed at children. You must be 18 or older to hold an account, and we do not knowingly collect data from children. If you believe a child has given us personal data, write to privacy@getbanaya.in and we will delete it.

We may update this policy as the Platform develops or the law changes. We will update the effective date above and, for material changes, notify you through the Platform or by email before they take effect.

For any question or complaint about your data, contact our Grievance Officer, appointed under the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021:

The Grievance Officer
GetBanaya
Chennai, Tamil Nadu, India
grievance@getbanaya.in

We acknowledge complaints within 48 hours and aim to resolve them within 15 days. General privacy questions can go to privacy@getbanaya.in.