Privacy Policy & User Data Protection

1. Data Fiduciary & Service Overview

This website (hillbazaar.com) is owned and operated by HillBazaar Enterprise ("HillBazaar", "we", "us", or "our"), a registered Indian enterprise headquartered in Uttarakhand, India (UDYAM Registration: UDYAM-UK-12-0105857). We operate an authentic Himalayan farm produce and artisanal marketplace.

We act as the Data Fiduciary responsible for processing and safeguarding your personal information in strict accordance with the Digital Personal Data Protection (DPDP) Act, 2023 and applicable global data protection principles.

🔐 2. Google Sign-In & Google API Services User Data Policy

When you choose to register or log in using Google Sign-In / Google 1-Tap OAuth, we access only the essential information authorized by your consent:

• Primary Account Profile: Your full name and profile avatar/photo URL provided by your public Google profile.
• Primary Email Address: Your verified Google email address (used uniquely to create your HillBazaar customer account and send transactional order receipts).
• Google Account Identifier: A unique cryptographic user ID token to safely authenticate your sessions across visits.

Strict Limits on Google Data Usage:

• We NEVER sell, rent, or trade Google user data to third-party data brokers or marketing firms.
• We NEVER use Google user data for serving targeted advertisements, programmatic ads, or behavioral profiling.
• We NEVER use your Google credentials or data to train machine learning or artificial intelligence models without explicit user consent.
• We do NOT request access to your Google Drive, Gmail messages, Contacts, Calendar, or any sensitive or restricted scopes.

3. Personal Information We Collect

In addition to Google Sign-In data, we collect only the data strictly necessary to fulfill e-commerce orders under data minimization guidelines:

• Contact Information: Full name, verified mobile phone number (for delivery SMS and WhatsApp shipping updates), and email address.
• Shipping Destination: Complete delivery address, building/house number, street, city, state, and postal PIN code.
• Order & Transaction Logs: Items purchased, total transaction amounts, Razorpay order/payment IDs, and courier tracking Air Waybill (AWB) numbers.
• Technical Metadata: IP address, device type, browser specifications, and timestamp cookies used exclusively to safeguard against automated bot attacks and malicious checkout abuse.

4. Specified Purposes of Data Processing

Your personal data is collected and processed solely for lawful, specific transactional purposes:

1. Order Fulfillment & Dispatch: Handing over your name, address, and mobile number to vetted courier aggregators (e.g., Shiprocket, Delhivery, Blue Dart, India Post) to execute doorstep parcel delivery.
2. Statutory Tax Invoicing: Generating GST-compliant sales invoices and maintaining sales ledgers as mandated by Section 36 of the Central Goods and Services Tax (CGST) Act, 2017.
3. Transaction Communications: Dispatching automated order receipts, shipping notifications, and delivery status alerts via Email, SMS, and WhatsApp.
4. Customer Service & Refunds: Processing return inquiries, customer-initiated refunds via Razorpay banking rails, and resolving delivery issues.

5. Cookies & Session Storage

We use strictly necessary technical cookies and session storage mechanisms to keep you logged in, remember items in your shopping bag, and protect checkout transactions against Cross-Site Request Forgery (CSRF). We do not deploy intrusive third-party cross-site ad trackers.

6. Third-Party Service Providers

We share minimal necessary data strictly with trusted infrastructure partners bound by confidentiality and data processing agreements:

• Supabase Inc.: Cloud database and authentication infrastructure hosted in secure, ISO-certified data centers with AES-256 encryption at rest.
• Razorpay Software Pvt Ltd: RBI-licensed payment gateway for processing UPI, Cards, and NetBanking transactions.
• Shiprocket / Delivery Carriers: Courier logistics partners for shipping Himalayan goods.
• Google LLC: Identity authentication services via Google OAuth 2.0.

7. Data Retention & User Account Deletion

We retain your personal account data for as long as your account remains active or as required to provide services. Sales invoices and financial records are preserved for 72 months to fulfill statutory Indian commercial accounting laws.

8. Technical & Operational Data Security

HillBazaar implements defense-in-depth security measures to protect personal information from unauthorized access, alteration, or disclosure:

• Encryption in Transit: 100% of network traffic is encrypted using modern TLS 1.3 / SSL cryptographic protocols (HTTPS).
• Database Access Controls: Granular Row-Level Security (RLS) policies block public, unauthorized queries to customer order records.
• Tamper-Proof Admin Sessions: Cryptographic HMAC-SHA256 digital signatures ensure admin panels are inaccessible to non-authorized staff.

9. Children's Privacy

Our services and storefront are not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal information, please contact us immediately for prompt erasure.

10. Grievance Redressal & Data Protection Officer

Under the DPDP Act 2023 and Consumer Protection (E-Commerce) Rules, 2020, you may address any privacy concerns or exercise your legal rights by contacting:

Designated Entity: HillBazaar Enterprise

Email Contact: hello@hillbazaar.com

Registered Operations Hub: Khatima, Uttarakhand 262308, India

All customer data inquiries and grievance communications are formally acknowledged within 48 hours and resolved in accordance with applicable statutory timelines.