Privacy Policy

This policy explains what information KhojKhobor collects when you use our website, how we use it, and the choices you have. We collect only what we need to run a local marketplace, and we never sell your personal data.

KhojKhobor is run by Bauddhik Innovations LLP, Plot No. 5203, Holding No. 696, Bhabesh Roy Sarani, College Para, Raiganj, West Bengal 733134. Under India's Digital Personal Data Protection Act, 2023, it decides why and how your personal data is used (the “data fiduciary”).

1. What we collect

• Account details: from Google when you sign in with it, your name, your email address and Google's ID for your account (Google also sends your profile picture, which we don't keep; never your contacts, photos or password); the mobile number you add, if you do; and when you confirmed you're 18 or older and agreed to our terms.
• Delivery addresses: name, phone, address, locality, pincode and landmark that you save for delivery.
• Orders: what you ordered, from which shop, order status history, and any notes you add.
• Payment references: for UPI orders, the 12-digit UTR you submit and, if you choose to add it, the UPI ID you paid from. These let the shop match your payment.
• Content you post: posts, photos, videos, comments, listings, messages, reviews, ratings, questions and answers.
• Questions you ask the town: everyone can see them with your name, and shops whose description matches what you're looking for are told about the question so they can answer. Answers are public too, and so is which answer you said helped.
• Shops and providers you contact: when you're logged in and tap Call, WhatsApp or Message for a shop or a service provider, we note which one and when, so you can review them afterwards and we can ask you how it went once. We don't see or record the call or the WhatsApp chat itself.
• Sign-in and upload records: each time you sign in or put something up, the time, your IP address, your browser and a random device identifier kept in a cookie.
• Technical data: basic logs such as IP address, browser type and pages requested, used for security and to fix problems.

2. What we don't collect

Because you pay shops directly, we never see or store your UPI PIN, bank account details, card numbers or UPI app credentials. KhojKhobor does not process payments.

3. How we use it

• To create and secure your account, and to let you place, track, cancel and return orders.
• To send order updates and account emails, and in-app notifications.
• To show verified-buyer reviews and keep the marketplace free of fraud and abuse.
• To check photos and videos for nudity automatically, on our own server. What the check flags is hidden until someone on our team looks at it; the check never decides on its own.
• To warn you when your account is signed in to on a new device.
• To meet our duties under Indian law, such as answering lawful requests from the authorities.
• To understand, in aggregate, what people search for so we can improve the website. We count the words searched for, not who searched.

4. Who we share it with

• The shop you order from receives your name, phone number, delivery address, order details and payment reference so it can verify payment, deliver and handle returns. Shops may only use this information to fulfil your order.
• Google, which signs you in: Google knows you signed in to our website, and tells us who you are (your name and email). Google handles that under its own terms and privacy policy. We don't share anything else with Google, and we never post anything for you.
• Service providers who help us run the website, under confidentiality obligations: our servers are hosted in Canada, Cloudflare carries the website's traffic, and backups are kept with Amazon Web Services. When something on the website breaks, a report of the error (which page, which browser and the part of our code involved) goes to Sentry, in the United States, so we can fix it; reports leave out your IP address, your cookies and which account you're signed in to. Indian law allows this; we'll stop using any country the government restricts.
• Authorities, when required by law or to protect people from fraud or harm.

Reviews show only your first name and last initial. We don't sell or rent personal data to anyone.

5. Cookies and local storage

We use essential cookies to keep you signed in, to recognise the device you sign in on (so we can warn you about new ones), and to protect forms against cross-site request forgery. Your browser's local storage remembers your guest cart, compare list and recently viewed products on your device. We don't use advertising cookies.

We count visits with Cloudflare Web Analytics, which sets no cookies and doesn't follow you from site to site. It tells us how many people visited, which pages they opened, which website sent them and how quickly pages loaded, never who they are.

6. Security

• The website is served over HTTPS in production. You sign in with Google, so we keep no password of yours.
• Sign-in uses a secure session cookie, and all changes are protected against cross-site request forgery.
• Login, registration and other sensitive actions are rate-limited to slow down guessing attacks.
• Shops only see orders placed with them, and staff access to data is limited to what is needed for support.

No system is perfectly secure. If you notice anything suspicious, such as someone asking for your UPI PIN or OTP in KhojKhobor's name, please report it to [email protected].

7. How long we keep data

• Your account data, while your account is open.
• Sign-in and upload records, and the website's technical logs: one year, then erased.
• Something you delete, or that our team removes for breaking the rules: it goes from the website straight away, and a private copy is kept for one year, then erased. Private messages you delete are erased straight away, unless someone had reported them.
• When you close your account, your profile and posts go from the website straight away. As India's IT Rules 2021 and data protection rules require, a sealed record of the details you registered with is kept for one year, then erased.
• A mobile number whose account posted nudity is kept on a blocked list, so it can't be used to post here again, even after the account is closed.
• Videos in posts are removed after 90 days, unless a shop chooses to keep a few.
• The note that you contacted a shop or provider: one year from the last time, then erased.
• Order records may be kept for longer where needed for accounting, tax, dispute resolution or legal reasons.

These records are kept out of sight, seen only by the website's owner, and shared only with the authorities on a lawful request.

8. If something goes wrong

If your personal data is lost, stolen or seen by someone who shouldn't see it, we'll tell you what happened, what it means for you and what we're doing about it, and we'll report it to the Data Protection Board of India and to CERT-In, as the law requires.

9. Your rights

Under the Digital Personal Data Protection Act, 2023, you can:

• see what we keep about you: your profile, addresses and orders are in your account, and you can ask us for a summary of all of it and who we've shared it with;
• correct or complete your details from your account at any time, or ask us to;
• take back your consent as easily as you gave it: close your account yourself from My Profile → Delete Account. Optional emails can be turned off one by one in your notification settings. Some records must still be kept for a while, as explained above;
• name someone to use these rights for you if you die or can't act yourself; and
• complain to our Grievance Officer. If you aren't satisfied with the answer, you can complain to the Data Protection Board of India.

To make a request, email [email protected] from your registered email address, or use the grievance form while signed in. We reply within 7 days.

10. Children

You must be 18 or older to make an account, and you confirm this when you sign up. We don't knowingly keep data about children; if we learn that an account belongs to someone under 18, we close it.

11. Changes to this policy

We'll update the date above when this policy changes, and highlight important changes on the website. See also our Terms of Use.