← Back to home

Privacy Policy

Last updated: 23 October 2026

Before you publish this: this is a working draft written to match what this product actually does technically. It is not legal advice. Have it reviewed by a lawyer familiar with India's Digital Personal Data Protection Act, 2023 before treating it as final — in particular to fill in the bracketed placeholders below with your actual registered business details.

1. Who this policy covers

Suchi ("we", "us", "the platform") is operated by [Your Registered Business/Entity Name], [Business Address], India. This policy explains what personal data we process for three different groups of people who interact with the platform:

  • Shop owners — businesses on the platform, whether self-registered or onboarded by us, who log in to manage their own product catalogue.
  • Agents — people who apply to introduce shops to Suchi and earn a commission, and log in to the agent portal (see Section 2A).
  • Catalogue visitors — customers who browse a shop's public catalogue page, typically after scanning a QR code or clicking a WhatsApp/shared link. Visitors do not create accounts on Suchi.

2. What we collect from shop owners

When your shop registers or is onboarded, we collect and store:

  • Your email address (which is also your login) and a securely hashed password (we never store your password in plain text).
  • Your shop's name, description, address, and the WhatsApp number customers use to reach you. We do not verify the WhatsApp number.
  • If you self-register: a one-time verification code is emailed to your email address (sent through Amazon SES), and we record the timestamp your email address was successfully verified. The code itself is never stored — only a one-way cryptographic hash of it, discarded once used or expired. The same kind of code protects changing your password, email address or WhatsApp number, and deleting your account.
  • A history of the changes to your shop's email address and WhatsApp number — the previous value, the new value, when the change was made and by whom (you, or Suchi support at your request) — kept for as long as your shop exists, so that a change made without your knowledge can be reversed.
  • A Free-plan record: how many days a shop spent on the Free plan, tied to its email address (in a simplified form that treats dots and "+tags" as the same mailbox) and WhatsApp number. It is kept after the shop is deleted, to enforce the Free plan allowance (see section 6).
  • A record that you accepted these Terms & this Privacy Policy at registration, including the timestamp and which version of each document you agreed to.
  • Any logo, banner, or product images you upload.
  • An optional, non-binding answer you may give — from your dashboard, some time after signup — to what you'd be willing to pay per product per year. This is purely to help us plan fair pricing; it is not a payment and creates no obligation.
  • Messages we send you and, at a shop level, whether you've viewed your Messages inbox.
  • Questions you send us from the Help & FAQ page, and our replies: the text, and any photos or voice notes you choose to attach. These are stored with your shop, are visible only to you and to the platform team, and are not shared publicly.
  • If you enter an Agent ID when registering: which agent it was. That agent is shown your shop's name and whether it is on a paid plan, so they can be paid — never your email, number or password.

We use this to operate your account, verify your identity during registration, generate your public catalogue, and contact you about your shop. Suchi does not currently charge for the service, so we do not collect or store any payment or billing information.

2A. What we collect from agents

If you apply to become a Suchi agent, we collect and store:

  • Your name, email address (your login), WhatsApp number and, if you give it, your city, with a securely hashed password.
  • A one-time verification code is emailed to your address when you apply or reset your password (sent through Amazon SES); only a one-way hash of it is kept, and only until it is used or expires.
  • Your UPI ID, if you add it, to pay your commission. Changing it needs your password, and we email you when it changes.
  • The shops you bring (their name and plan status), the commission on each, your monthly shop counts, and every payout we make to you — kept while your agent account exists and afterwards as long as our accounting and tax records require.
  • Your acceptance of the Terms and Privacy Policy, with its version and time.

We use this to run the agent programme, decide and pay your commission, and contact you about it. To close your agent account or have your data reviewed or corrected, contact our Grievance Officer (Section 7).

3. What we collect from catalogue visitors

Browsing a shop's public catalogue does not require an account, and we do not set any tracking or advertising cookies for visitors. When you view a catalogue, view a product, or tap a shop's WhatsApp button, our server briefly uses your IP address and browser user-agent string — for a maximum of 20 minutes — purely to avoid counting the same visit twice (for example, if a page is accidentally refreshed) and to filter out automated bot traffic. That IP address and user-agent are never saved anywhere — they exist only in server memory for that 20-minute window and are then discarded.

We do not track or store catalogue visitor browsing activity or analytics. If you use a shop's WhatsApp button, you leave our platform and begin a conversation directly with that shop on WhatsApp — that conversation is between you and the shop, governed by WhatsApp's own privacy policy, not this one.

4. Cookies

We use a small number of strictly necessary cookies for shop owners, agents and platform administrators who log in — these keep you signed in and protect against cross-site request forgery. During self-registration, a short-lived (30-minute) cookie also holds the fact that your email address was verified, so the next step in the registration wizard can trust it. None of these are used for advertising or cross-site tracking, and catalogue visitors browsing without logging in are not given any of these cookies.

5. Where your data is stored, and who else sees it

Shop and product data is stored in a PostgreSQL database on Amazon Web Services (Lightsail), and product images and backups are stored with Backblaze. Pages are delivered through Cloudflare, and plan payments are processed by Razorpay, which receives the payment details you enter at checkout (we never see or store card details). Emails to shop owners — verification codes, payment notices and account notices — are sent through Amazon SES, which receives your email address and the message. When a visitor uses a shop's own WhatsApp click-to-chat button, that conversation takes place on WhatsApp (operated by Meta) directly between the visitor and the shop. We choose infrastructure and processor providers that maintain reasonable security practices, and we do not sell shop owner or visitor data to any third party.

6. How long we keep data

We retain shop owner account data for as long as your shop remains on the platform, and as needed afterward to meet our own legal and accounting obligations. Verification codes are deleted automatically once used or expired, whichever comes first. Deleting a shop (by you from Settings, or by a platform admin) permanently removes its products, images, and associated data, including your questions to us and their attachments, and the history of its email and WhatsApp number changes. What remains is the Free-plan record described in section 2 — an email address, a WhatsApp number and a day count — which is used only to enforce the Free plan allowance and is kept for as long as that allowance applies; contact our Grievance Officer if you want it reviewed or removed. Platform announcements are automatically deleted 30 days after being sent.

7. Your rights

Under India's Digital Personal Data Protection Act, 2023, shop owners (as data principals) have the right to access the personal data we hold about them, request correction of inaccurate data, request erasure, and withdraw consent where consent is the basis for processing (including cancelling a UPI Autopay mandate). To exercise any of these rights, or to raise a grievance about how your data is handled, contact our Grievance Officer:

Yashoverdhan Bishnoi
Email: [email protected]
We aim to respond within 3 business days.

8. Children's data

Suchi is a business-to-business platform for retail shop owners and is not directed at, nor knowingly used to collect data from, children under 18.

9. Changes to this policy

We may update this policy as the platform changes. Material changes will be announced to shop owners through the in-app Messages inbox.

10. Contact us

Questions about this policy can be sent to [email protected].