Privacy Policy

This Privacy Policy explains how Fassalkart Agri-Tech Private Limited (“Fassalkart”, “we”, “us”) collects, uses, stores, and protects your information when you use the Fassalkart mobile application (the “App”) and the website fassalkart.com (the “Site”). By using the App or Site, you agree to the practices described below.

We comply with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India, the Information Technology Act, 2000 and the SPDI Rules, 2011, and applicable Google Play and Apple App Store data-handling policies. We never sell your personal data to third parties.

1. Information We Collect

• Account data: name, phone number, email, password hash, role (buyer / seller / transporter / partner).
• KYC data (sellers, transporters, partners only): Aadhaar number, PAN number, bank account number, IFSC, photographs of identity documents. Stored securely in Firebase Storage with rule-based access and used only to verify your identity per Indian regulatory and RBI requirements.
• Address & delivery data: shipping addresses, GPS coordinates of the delivery pin (only when you tap “Use current location”), pincode.
• Order data: items purchased, prices, payment method, payment IDs (Razorpay), delivery status.
• Device data: device model, OS version, Firebase install ID, push-notification token, IP address.
• Usage data: screens visited, search terms, products viewed (used for recommendations and analytics; aggregated where possible).

We do not collect: health data, biometric identifiers (other than the photograph on your KYC ID), contacts list, SMS messages, call logs, browsing history outside our App, or background location.

2. App Permissions — What We Request and Why

The Fassalkart Android App requests the permissions below. Each permission is requested at the moment it is needed; you can deny or revoke any of them at any time from Android Settings → Apps → Fassalkart → Permissions. Revoking a permission only disables the related feature — the rest of the App continues to work.

3. How We Use Your Information

• To create and operate your account and authenticate you on each login.
• To fulfil orders you place, arrange delivery, and process payments through Razorpay.
• To verify seller / transporter / partner identity through KYC (Aadhaar / PAN / passbook).
• To calculate delivery routes, shipping costs, and show localized content (Mandi prices, weather).
• To send transactional notifications (order, payout, KYC) and, only with your consent, occasional promotional updates.
• To improve the App, debug issues, and analyze usage in aggregate.
• To comply with applicable Indian law, court orders, and tax / GST record-keeping obligations.

4. Legal Basis for Processing (DPDP Act)

• Consent — for marketing notifications, voice search, and use of optional features.
• Performance of a contract — for fulfilling orders, payouts, and delivery.
• Legal obligation — for KYC under RBI / FIU-IND norms, GST invoices, and responding to lawful government requests.
• Legitimate interest — for fraud prevention, security, and basic crash analytics.

5. Third-Party Services We Use (Data Processors)

We do not sell, rent, or trade your personal information to anyone. We share data with the providers above only to the extent strictly required to operate the service, under written data-processing terms.

6. International Data Transfers

Some of our processors (Google Cloud, Razorpay’s fraud engine, push-notification gateways) may process data outside India. Where this happens, the transfer is carried out under Google’s and the processor’s standard data-protection commitments and only to the extent permitted by the DPDP Act and any rules issued thereunder. We do not transfer personal data to any country that the Government of India has notified as restricted.

7. Data Retention

• Active account data — kept for as long as your account is active.
• KYC documents — kept for the duration of the account plus 7 years thereafter, as required by RBI / PMLA record-keeping rules.
• Order & invoice data — 8 years from the end of the financial year, as required by the GST Act and Income-Tax Act.
• Crash & analytics logs — up to 90 days, then aggregated or deleted.
• Push tokens — deleted within 30 days of account deletion or token invalidation.

8. Security

Data in transit is encrypted with TLS 1.2+. Firestore and Storage are protected by per-user security rules so that users can only read and write their own data. KYC documents are stored under kyc/{uid}/ paths and can only be read by the owner and Fassalkart admins. Passwords are hashed by Firebase Auth and never stored in plaintext. We follow industry-standard practices to protect against unauthorized access, alteration, disclosure, or destruction.

We will notify the Data Protection Board of India and affected users without undue delay if a personal-data breach is likely to cause significant harm, as required by the DPDP Act.

9. Children’s Privacy

Fassalkart is intended for users aged 18 and above. We do not knowingly collect personal data from children under 18 without verifiable parental consent. If we learn that we have collected such data without proper consent, we will delete it promptly. Parents or guardians who believe their child has provided personal data to us should contact the Grievance Officer below.

10. Your Rights & Controls

• Access & correction: view and edit your profile, addresses, and KYC data inside the App at any time. For data we cannot expose in the UI, write to us.
• Withdraw consent: revoke any device permission from system settings; opt out of marketing notifications from Profile → Notifications.
• Delete account & data: use the in-App Profile → Delete Account option, or visit our public Account & Data Deletion page, or email fassalkart@gmail.com from your registered email. We delete personal data within 30 days, except where law requires us to retain certain records (KYC, GST invoices — see §7).
• Data portability: request a machine-readable export of your account data via the same email.
• Grievance: raise a complaint with our Grievance Officer (see below).
• Nominate: under the DPDP Act, you may nominate any individual to exercise your rights in the event of your death or incapacity. Write to the Grievance Officer to register a nominee.

11. How to Delete Your Account

You can delete your Fassalkart account, and the personal data associated with it, in any of these ways:

1. Inside the App: Profile → Settings → Delete Account.
2. From a browser: visit https://fassalkart.com/delete-account and submit the form — you do not need to install the App.
3. By email: send a request from your registered email to fassalkart@gmail.com with the subject “Delete my account”.

We will confirm deletion within 30 days. Data we are required to retain by law (KYC for 7 years, GST invoices for 8 years) is retained in a restricted-access archive and is not used for any other purpose.

12. Cookies (Website Only)

The Fassalkart website uses essential session cookies to keep you logged in and to analyze which pages are popular. We do not use third-party advertising cookies. The mobile App does not use cookies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page reflects the most recent revision. Material changes will be notified in-App and by email at least 7 days before they take effect. Continued use of the App or Site after a change indicates acceptance of the revised policy.