Privacy policy

1. Who processes your data

[LEGAL ENTITY NAME], [REGISTERED ADDRESS], India, operating Udyog Bazaar, is the Data Fiduciary for personal data described here, within the meaning of the Digital Personal Data Protection Act, 2023.

2. What we collect

• Account details — name, email address, mobile number, password, and the role you hold.
• Business details, for sellers — company name, GST number, business type, year established, address, description and logo.
• Verification documents you upload when applying for a Verified badge.
• Marketplace activity — listings, inquiries, requirements you post, messages, reviews and reports.
• Usage data — which listings and supplier profiles are viewed, counted per day for seller analytics.
• Payment records for sellers — subscription status, amounts and payment identifiers. We never receive or store your card, UPI or bank credentials; those go directly to Razorpay.

3. How we use it

To operate your account and the marketplace; to deliver inquiries and messages between buyers and sellers; to run search; to verify businesses; to take subscription payments; to send service notifications; to produce seller analytics; to detect abuse and enforce our terms; and to meet legal obligations.

4. When your details are shown to others

This is the part worth reading closely, because it is the point of the platform.

• Seller business details are public. Company name, city, state, business type, description, logo and listings appear on the public site and are indexed by search engines.
• When you send an inquiry, the name, phone number and email you provide are attached to it and become visible to that seller — but only if they hold a paid subscription (₹500/month). Sellers on the free plan can read and reply to your inquiry but are never sent your phone number or email; those fields are removed on our servers before the page is built.
• Requirements you post are visible to sellers in the matching category.
• Reviews you publish appear publicly with your name once approved.

5. Who else we share it with

Only processors who help us run the service, under contract, for those purposes alone: our hosting and database providers, Razorpay for payments, and our email and SMS delivery providers. We do not sell personal data or share it for third-party advertising.

We may disclose data where required by law or to protect our rights or the safety of users.

6. Where your data is stored

Our database and application servers are currently hosted in the United States (AWS US East 2, Ohio). Your personal data is therefore transferred outside India and stored there, under contractual protections with our providers. [CONFIRM WITH YOUR LAWYER whether your sector or customers require India-resident storage; if so, both the database region and the hosting region must change.]

7. Cookies

We set a small number of cookies, none for advertising:

• A session cookie that keeps you signed in. It is httpOnly and cannot be read by scripts.
• A language cookie remembering whether you chose English or Hindi.
• A visitor cookie holding a random identifier, used only to avoid counting the same person twice in a seller's view statistics. It is not linked to your account.

8. How we protect it

Passwords are stored only as bcrypt hashes and are never recoverable in readable form. One-time codes are stored hashed, never as the digits sent to you. Traffic is served over HTTPS, and database connections are encrypted. Suspending an account invalidates its existing sessions immediately.

No system is perfectly secure, and we cannot guarantee absolute security.

9. How long we keep it

Account and marketplace data is retained while your account is active. After closure we retain what is needed for legal, tax, accounting and dispute purposes — payment and invoice records are generally kept for [RETENTION PERIOD, commonly 8 years under Indian tax law] — and delete or anonymise the rest. Expired one-time codes are short-lived by design.

10. Your rights

Under the Digital Personal Data Protection Act, 2023 you may request access to your personal data, correction of inaccurate data, completion or updating of it, and erasure where we no longer need it. You may withdraw consent where processing rests on consent, and you may nominate another person to exercise these rights in the event of your death or incapacity.

To exercise any of these, contact our Grievance Officer below. If you are not satisfied with our response you may complain to the Data Protection Board of India.

11. Children

This is a platform for businesses and is not directed at children. We do not knowingly collect personal data of anyone under 18. If you believe we have, contact us and we will delete it.

12. Grievance Officer

[NAME], Grievance Officer
[EMAIL] · [PHONE]
[POSTAL ADDRESS]

We acknowledge complaints within 24 hours and aim to resolve them within 15 days.

13. Changes

We may update this policy. Material changes will be notified through the site or by email, and the date above will change.