Privacy Policy

GupKart respects your privacy and is committed to protecting the personal information of merchants and their end-customers. This Privacy Policy explains what information we may process, why we process it, and how information may be shared with service providers when necessary to operate the GupKart platform.

1. Information We Collect

• Merchant Data: Business name, owner or representative details, tax or business-registration information where required, business phone numbers, email addresses, store information, account settings, authentication records, and other information necessary to create, verify, secure, and operate a merchant account.
• Customer Data: Depending on the services used by a merchant, GupKart may process end-customer names, phone numbers, browser-based chat messages, product enquiries, order details, delivery addresses, location information voluntarily shared for delivery purposes, and other information necessary to assist with customer communication, order processing, fulfillment, and support.
• Order & Transaction Data: We may process product information, quantities, order totals, payment method, payment status, courier information, tracking references, and transaction metadata necessary to manage orders. GupKart does not intentionally store customers' full payment-card numbers, CVV codes, or raw card credentials. Payment-card information is handled by applicable payment providers through their own secure systems.
• Technical & Security Data: We may process IP addresses, device or browser information, login events, authentication challenges, timestamps, application logs, and other technical data reasonably necessary to secure the platform, prevent abuse, troubleshoot errors, and maintain service reliability.

2. Browser-Based Chats & AI-Assisted Processing

• Browser Chat Communications: When customers interact through public product links, customer messages and related conversation metadata are processed to display conversations to the merchant, provide customer support, assist with product enquiries, capture orders, and provide other merchant-requested commerce functionality.
• AI-Assisted Processing: Certain merchant-requested commerce features may use artificial intelligence to assist with routine customer conversations, product questions, order capture, or operational workflows. Where third-party AI service providers are used, only information reasonably necessary to provide the requested functionality should be shared with those providers, subject to applicable contractual, technical, privacy, and platform safeguards.
• Customer Conversation Data: GupKart does not sell customer conversation data or personal information for third-party advertising. GupKart does not permit customer conversations or merchant data to be used to create, develop, train, or improve general-purpose artificial intelligence models without authorization.
• Human Assistance: Automated assistance is intended to support commerce operations rather than remove merchant responsibility. Merchants remain responsible for customer service and should provide a reasonable human-support or escalation path where required by applicable messaging policies or the nature of a customer request.

3. How Information May Be Shared

• Communication & Sharing Channels: Where merchants or buyers choose to share links or communicate using third-party messaging apps or social platforms, those platforms process information in accordance with their own terms and privacy practices.
• Cloud & Infrastructure Providers: Data may be processed by hosting, database, storage, security, email, monitoring, or infrastructure providers used to operate GupKart. We aim to provide such providers only the access reasonably necessary to perform their services.
• Payment Providers: Where online payment functionality is enabled, relevant transaction and order information may be shared with the applicable payment provider, such as Safepay, to initiate, verify, process, or reconcile payments.
• Courier & Fulfillment Providers: Delivery information such as recipient name, phone number, delivery address, order reference, parcel information, and other necessary fulfillment data may be shared with the courier selected for an order where courier integration is enabled.
• Mapping & Location Services: Delivery addresses or customer-provided location information may be processed through mapping or geocoding services, including OpenStreetMap-related services, where required to assist with location handling or delivery.
• Legal & Security Requirements: We may disclose information where reasonably necessary to comply with applicable law, lawful legal process, protect users, investigate fraud or abuse, enforce our Terms of Service, or protect the security and integrity of GupKart.

4. Customer Consent & Messaging Choices

• Merchants are responsible for obtaining any consent, opt-in, permission, or other lawful basis required before providing customer contact information to GupKart or other processors and before initiating direct customer communications where such permission is required.
• Customers may request that a merchant stop sending direct communications. Merchants are responsible for honoring valid opt-out, unsubscribe, or stop requests in accordance with applicable law.
• GupKart may apply technical restrictions to automated messaging where required by customer consent status, account restrictions, or platform policies.

5. Merchant and GupKart Data Roles

In many merchant-customer interactions, the merchant determines why customer information is collected and used for its business, while GupKart processes that information to provide the merchant-requested software and commerce services. Depending on applicable law and the specific processing activity, GupKart may also process limited information for its own legitimate operational purposes, including platform security, fraud prevention, billing, legal compliance, service reliability, and enforcement of its Terms of Service.

6. Data Security

• GupKart uses reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss, or misuse.
• Access to merchant and customer information is limited according to operational requirements and account authorization. Sensitive credentials and provider secrets should not be exposed through public pages or ordinary merchant-facing interfaces.
• No internet-based system can be guaranteed to be completely secure. Merchants are also responsible for protecting their passwords, connected accounts, devices, and authorized users.

7. Data Retention & Deletion Requests

• Customer personal information, chats, order records, and related data are retained only for as long as reasonably necessary to provide requested services, maintain legitimate business and security records, resolve disputes, comply with applicable law, or satisfy commercial record-keeping requirements.
• Where data cannot immediately be deleted because of legal, accounting, fraud-prevention, dispute-resolution, security, backup, or record-retention requirements, it may be retained only for the applicable required period and handled in accordance with this Privacy Policy.
• Data Deletion Mechanism: End-customers or merchants may request access, correction, or deletion of eligible personal information by emailing our support desk at admin@gupkart.app. We may request reasonable verification before processing a request. Verified requests are normally reviewed within 7 business days, although completion may take longer where required by law, technical limitations, or legitimate retention obligations.