Privacy Policy

• Account details — your name, email address, and WhatsApp number, used for sign-in codes, service messages, and support.
• Business details — legal name, GSTIN, registered address, state, PIN code, and billing email, used to verify your registration against government records and to issue GST tax invoices.
• Store content — everything you create or upload for your storefront: text, images, videos, prices, menus, and contact details.
• Billing data — your plan, payment status, and invoice history. Card and net-banking details are handled by Razorpay; we never see or store your full card or bank credentials.
• Technical data — server logs (IP address, browser type, pages visited) used for security, debugging, and abuse prevention.

We use personal data only to:

• create and secure your account (one-time codes, password resets);
• build, host, and display your storefront and business email;
• process subscriptions and issue GST invoices;
• provide customer support over email and WhatsApp;
• verify GSTINs against government records when you add business details;
• detect and prevent fraud, abuse, and security incidents.

We process data under the Digital Personal Data Protection Act, 2023 and other applicable Indian law, relying on your consent and on processing necessary to provide the Service you asked for. We do not sell your personal data.

We share personal data only with the providers strictly needed to run the Service, each under its own privacy obligations:

• Razorpay — payment processing and subscriptions;
• Meta / WhatsApp — delivery of sign-in codes and support messages via WhatsApp;
• our SMTP email provider — delivery of sign-in codes and transactional email;
• Cloudflare — DNS and edge hosting for custom domains;
• gstincheck.co.in — GSTIN verification against government records (GSTIN only);
• government authorities — where disclosure is required by law.

Your published store is a public website, like any other. Anything you publish — phone numbers, addresses, prices, photos — is visible to anyone who visits it, and you are responsible for giving visitors any notices required of you. We do not run advertising or cross-site tracking trackers on your store.

We keep your data while your account is active. If you cancel your subscription, your websites are unpublished when the paid period ends and your designs stay as drafts.

You can download everything that is yours (websites, store catalogue, orders and bookings, invoices and uploaded files) at any time from Settings, and you can delete your account from Settings. Seven calendar days after you ask, unless you cancel the request, we permanently delete your websites, store data, uploads, domains, email addresses and email accounts, business details and login, and we email you before and after. We keep only the records of what you paid us, the invoices we issued for those payments, your subscription records, and the dates your account was created and deleted, for accounting and audit purposes (Indian law requires tax invoices to be kept). Backups roll off on their normal cycle.

What you collect from your own customers belongs to your business, not to us: delete or export it from your dashboard, and note that it is removed when your account is deleted.

We use HTTPS everywhere, one-time sign-in codes and salted password hashes (we never store passwords in plain text), httpOnly session cookies, and restricted staff access to personal data on a need-to-know basis. No method of transmission or storage is 100% secure, but we continually review our safeguards.

We use a single session cookie (sf_session) to keep you signed in. On our public pages (home, pricing, templates, sign-up and sign-in, and these policies) we also use Microsoft Clarity, which sets its own cookies to record anonymous usage such as clicks and scrolling so we can improve the site. It is not loaded in your dashboard or editor, or on any storefront, and we use no advertising cookies. You can block cookies in your browser, but parts of the Service (signing in) will not work without the session cookie.

You can, at any time:

• view and correct the business and account details in your dashboard;
• ask for a copy of the personal data we hold about you;
• ask us to correct or delete your personal data (subject to legal retention, e.g. tax invoices);
• withdraw consent for optional communications;
• raise a grievance with our grievance officer below.

The Service is intended for businesses and individuals aged 18 and above. We do not knowingly collect personal data from children under 18; if you believe a child has given us data, contact us and we will delete it.

We may update this policy from time to time. Material changes will be posted on this page with an updated date before they take effect. Continued use of the Service after that date means you accept the updated policy.

For privacy questions, data requests, or grievances under the Digital Personal Data Protection Act, 2023:

Versalence Infocomm Private Limited
Unit FO-02, 4th Floor, 28/A, Smart Avenue, Michaelpalya, Indiranagar, Bengaluru, Bengaluru Urban, Karnataka 560038, India
GSTIN: 29AAKCV1471F1Z4
Email: [email protected] · Website: myshopfront.in

We aim to respond to data requests and grievances within 30 days.