Privacy Policy

What is collected, and why

• Name. To pack the order and show it on the account. Account and checkout.
• Mobile number. To log in, send an OTP only if MSG91 is connected, and reach you about an order.
• Email. A customer email is not asked for and is not stored. The customer-care email on the Contact page is the shop’s address, not yours.
• Addresses. The flat, street, landmark, city and pincode you save, and the address typed at checkout, so the order can be delivered.
• GPS / location. Only after you tap Allow. It suggests a delivery area and, while an order is open on screen, shares a position with the store. The page does not ask for location by itself and does not track when the app is closed.
• Orders and purchase history. Items, amounts, tax, the payment method you chose, and delivery status. This is the shop’s bill.
• Wallet. Balances and wallet lines, if you use a wallet. The wallet is closed: it pays this store only. Online top-up is off. It is not a bank account.
• Camera and photos. Only after you tap Scan or choose a photo of a list. It reads a barcode or the list. The photo is not saved as a gallery and is not shared.
• Microphone. Only after you tap voice search. The words are used as a search. A recording is not saved. The microphone is not opened when a page loads.
• Device and log data. A device model, advertising ID and contact list are not collected. An IP address is stored only on a welcome-offer claim. A wrong-password lock stores a count against the mobile, and that row is removed when the account is deleted.
• Password. You set it. An SMS code is sent only when MSG91 is connected. The code is not shown on the page. If MSG91 is not connected, no SMS is sent and password login still works.

Payments

The website takes Cash on Delivery. No card, UPI or other payment processor is used at checkout. A wallet balance you already have can still be used where the shop allows it. Opening a page never marks an order paid.

Who handles it

The store desk uses this information to pack, bill and deliver. The website is served for bachatmart.net. SMS, when connected, goes through MSG91. No email is sent to customers, and no email provider is connected. Google sign-in is not enabled. Bachat Mart does not sell your name, mobile, address or orders. Ads are not used. Data is not shared for advertising.

How long it is kept

GST invoices and accounting records (order and counter-bill amounts, tax and invoice numbers) are kept as the law requires, for 8 years. When an account is deleted, the buyer on those bills is shown as Deleted customer. The mobile, house address and GPS on them are removed.

Other personal data — profile, saved address, saved location, wallet profile, login tokens and offer claims — is erased when the store finishes the deletion. A wallet line’s amount can stay with the mobile removed.

Extra note from the store:

Your rights

You can see and correct your name, mobile and address on Account. You can erase the account from Delete account. Location, camera and microphone run only after you tap Allow; not tapping is how you refuse them. The store answers an access, correction, erasure or consent request within 90 days.

Account deletion

Account and the public Delete account page both ask again for the password or an OTP. The request is logged. The store desk finishes it within 30 days. It does not delete the invoice. An open order or a wallet balance that is not zero blocks it until that is settled.

Grievance officer

Kaushal Rai, Owner