Privacy Policy

Version 2.0 · Last updated: October 2026 · Prepared under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (full compliance from 13 May 2027)

CaveZone ("we", "our", "us") operates cavezone.shop, the seller dashboard and the storefronts hosted on it. This notice explains what personal data we process, why, who we share it with, and how you can exercise your rights. It is available in English.

1. Who is responsible for your data

• Sellers (store owners): CaveZone is the Data Fiduciary for your account, store and billing data.
• Buyers (customers of a store): The seller you order from decides why your order details are used and is the Data Fiduciary. CaveZone acts as the seller's Data Processor and handles this data only to run the platform for that seller.

2. Personal data we collect

Seller account: name, email, Google profile photo (if you use Google sign-in), store name, WhatsApp number, description, logo and banner, plan and billing status.

Buyer data: name, mobile number, delivery address and pincode, items ordered, order amount and status, saved addresses and wishlist (if you choose to save them), return-request messages and images, and mobile number verification via OTP.

Delivery partners: name, contact details, store assignment, and proof-of-delivery photos.

Usage data: aggregate store view and WhatsApp click counts. CaveZone itself does not use Google Analytics or advertising trackers.

Payments: we do not store card or bank details. Payments are handled by the payment gateway on its own systems.

3. Why we use it (purposes)

• To create and run seller accounts, stores and orders
• To verify buyers' mobile numbers, take orders, arrange shipping and delivery, and handle returns
• To process plan upgrades, billing and refunds
• To detect and prevent fraud and abuse and to meet legal obligations
• To keep the service secure and working

We use your data only for these purposes and only the data needed for them. We do not sell personal data and do not show advertising.

4. Who we share it with

We use these service providers (Data Processors), only as needed to run the service:

• Google Firebase – sign-in and database
• Cloudinary – image storage
• Hostinger – website and server hosting
• 2Factor.in – OTP SMS for buyer mobile verification
• Cashfree – subscription payments; Razorpay – payments, where a seller turns it on
• Shiprocket – shipping, where a seller turns it on
• WhatsApp – order messages that you start from the store
• Meta Pixel – only if a seller has added their own Pixel to their store. That seller is responsible for it.

Sellers see the order and delivery details of their own buyers. We may also disclose data when the law requires it, for example to courts or government authorities.

AI features: If you use the AI Product Writer, the product details you type (name, category, key features) are sent to Anthropic to generate titles, descriptions and captions. We do not send buyer, order or payment data to any AI provider.

Transfers outside India: Some providers above may process data on servers outside India. We transfer data only to countries not restricted by the Government of India.

5. Your consent

We process your data on the basis of your consent, or for other uses the law allows (for example, completing an order you placed, legal compliance, or a medical or safety emergency). Consent is requested through a clear action such as a checkbox or button, together with a link to this notice. We keep a record of when you consented and which version of this notice applied.

You may withdraw consent at any time, as easily as you gave it, by emailing us or using the delete option in the dashboard. Withdrawal does not affect processing done before it, and orders already placed and paid for will still be fulfilled. After withdrawal we stop processing and ask our processors to stop, unless the law requires us to keep the data.

6. How long we keep data

• Seller account data: while the account is active. When you delete your account we erase it within 7 business days.
• Buyer order data (name, phone, address): 12 months after the order, or until the seller deletes their account, whichever is earlier.
• Invoices, payment and tax records: up to 7 years where the law requires.
• We erase data earlier if you withdraw consent or the purpose is no longer served, unless the law requires us to keep it.

7. Security and data breaches

We protect data with HTTPS, Firebase Authentication, Firebase Security Rules and access controls limited to what each role needs. No internet service is perfectly secure, so please use a strong password. If a personal data breach occurs, we will inform the Data Protection Board of India and each affected person in the form and manner prescribed by law.

8. Children

A child is anyone under 18. CaveZone seller accounts are for adults only. We do not knowingly process a child's personal data without verifiable consent from a parent or lawful guardian. We do not track or monitor children's behaviour and do not show targeted advertising to children. If you believe a child's data has been given to us, contact us and we will act on it.

9. Your rights

You have the right to:

• Access: get a summary of your personal data we process, and who we have shared it with
• Correction and updating: correct, complete or update your data
• Erasure: ask us to delete your data, unless we must keep it for a specified purpose or by law
• Withdraw consent: at any time (see section 5)
• Grievance redressal: see section 10
• Nominate: name another person to exercise your rights if you die or become unable to do so

To use any right, email support@cavezone.shop with the subject "Privacy Request" from your registered email or number. Sellers can also edit store and product data and delete the account from the dashboard (see Delete Account). You also have duties: give only correct information, do not impersonate anyone, and do not file false or frivolous complaints.

10. Grievance officer and complaints

Grievance Officer, CaveZone – support@cavezone.shop (subject: "Privacy Grievance"). We acknowledge complaints within 7 days and aim to resolve them within 30 days. If you are not satisfied with our response, you can complain to the Data Protection Board of India. Please use our grievance process first, as the law requires.

11. Cookies & local storage

CaveZone uses localStorage (not advertising cookies) for dark mode, the shopping cart and login state. CaveZone does not run third-party ad tracking. A seller who adds their own tracking tool, such as Meta Pixel, must give their buyers their own notice and obtain consent.

12. Changes to this notice

If we change how we use your data, we will update this page and the version and date at the top, and ask for fresh consent where the law requires it.