Privacy policy

This policy explains how Mirav Labs, New Delhi ("we", "us") handles personal data in D2 Commerce OS Shops (shop.d2c.in, the seller admin and the shops built on it). It forms part of our Terms of service. Our marketing website os.d2c.in has its own policy.

1. Sellers: what we collect

• Account details: your name, mobile number, email, password (stored only as a one-way hash) and, if you sign in with Google, your Google account ID.
• Business details: shop name and link, business address, state, phone and WhatsApp numbers, logo and other content you add.
• Verification details: PAN, name on PAN, GSTIN or your GST declaration, bank name, branch, IFSC, account holder's name and account number (stored encrypted), the documents you upload, and the results of the checks.
• Billing details: plans, charges, payments and UPI transaction IDs you send us.
• Connections: details needed to connect services you choose, such as payment gateway keys and your Shiprocket login, stored encrypted.
• Records of use: when you accepted these terms, sign-ins, changes to key details, support messages, IP addresses, browser type, server logs and error reports.

2. Why we use it

To create and run your shop and account; to verify you before your shop goes live and to prevent fraud and misuse; to bill you and keep accounts; to send you service, security, billing and order emails and WhatsApp messages; to give support; to keep the service secure, find and fix errors and improve it; and to meet our legal obligations and respond to lawful requests. We rely on your consent, given when you sign up, and on the purposes the law permits, such as complying with law and preventing fraud.

3. Your customers' data

Shoppers' names, phone numbers, addresses, orders and messages in your shop are collected for you. You decide how they are used and are responsible for them, including telling your customers how you use their data. We process them on your behalf only to run your shop, deliver order messages, keep backups, give support and meet legal obligations. A shopper with a question about their data should contact the shop first; we will help the shop respond.

4. Who we share it with

We don't sell personal data. We share it only as needed with:

• our verification partner, to check PAN, GSTIN and bank details;
• services you connect or choose, such as your payment gateway, Shiprocket and couriers, Google sign-in and domain providers;
• providers that run the service for us: hosting and backups, email delivery and messaging;
• courts, government, tax and law enforcement authorities when the law requires, and professional advisers; and
• a buyer or successor if our business is reorganised or sold, under the same protections.

Some of these providers, including our hosting provider, may store data on servers outside India, with safeguards that protect it.

5. Cookies

We use cookies only to keep you signed in, protect forms from misuse, remember your shop preview and short-term sign-up choices. Our own visit counts use a daily anonymous code, not a tracking cookie. If you add Meta Pixel or Google Analytics to your shop, those services set their own cookies on your shop under their policies, and you are responsible for telling your customers.

6. How long we keep it

• While your account is open, we keep your data to provide the service.
• When you delete your shop, or we delete it under the Terms of service, we delete your shop, its content and your customers' data. We keep your registration details, verification decisions, terms acceptances and the deletion record for 180 days, as the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 require, and then delete them.
• Invoices and records of what you paid us are kept for 8 years, as tax and company law require.
• Server and security logs are kept for up to 180 days, or longer when needed to investigate a security incident.
• We may keep data longer when a law, court or authority requires it, or to establish or defend a legal claim.

7. Security

We use encryption in transit, encrypt bank account numbers and connection keys at rest, restrict access to our team, and keep verification documents in private storage. No system is perfectly secure; tell us at once if you think your account has been misused. If a personal data breach occurs, we will inform affected people and the authorities as the law requires.

8. Your rights

Under the Digital Personal Data Protection Act, 2023 you can ask to see a summary of your personal data and how it is used, correct or update it, have it erased (subject to what the law requires us to keep), withdraw consent, and nominate someone to exercise these rights for you. Most details can be changed in your admin, and you can delete your account from Account → Delete account. Withdrawing consent or deleting your account means we can no longer provide the service to you. For anything else, contact our Grievance Officer below. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

9. Children

The service is for businesses and adults. We don't knowingly collect data from anyone under 18 as a seller.

10. Changes

We may update this policy. We will tell you about material changes by email or in your admin.

11. Contact and grievances

Grievance Officer, Mirav Labs, New Delhi 110088, support@d2c.in, WhatsApp +91 96502 10909. We acknowledge requests within 24 hours and respond within 15 days.