Privacy Policy
In short
- We collect what we need to run OneSite: your account and store details, and the orders your customers place.
- For store owners' accounts, we decide how the data is used. For shoppers' order details, the store decides, and we process them on the store's behalf.
- We don't sell personal data and don't use advertising trackers.
- Our infrastructure is provided by Cloudflare, and some data may be stored outside India.
- You can ask to see, correct or delete your data, and complain to our Grievance Officer or the Data Protection Board.
This summary helps you read the document. The full text below is what applies.
1. Who we are
This policy explains how Darpan Vadher, a sole proprietor carrying on business as ADWeb Solutions (“we”, “us”), of [registered business address], handles personal data when you use OneSite. It is written to meet the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000 and the rules made under them. Words defined in our Terms of Service have the same meaning here.
2. Our role
- Store Owners and visitors to our website. We are the Data Fiduciary for your data. We decide how and why it is used, as described here.
- Customers of Storefronts. When you order from a store built on OneSite, that store is the Data Fiduciary. We act as its Data Processor, processing your order details only to run the store for its owner. The store's own privacy policy, linked in its footer, explains how it uses your data. Please send requests about your order data to the store first. If you cannot reach it, contact us and we will help.
3. What we collect
From Store Owners
- Account details: login email, password (stored only in hashed form, never in readable text), business name, store address (subdomain), industry, order-notification email, and WhatsApp number.
- Store details: address, logo, photos, product and category information, website texts, policies, seller details (legal name, GSTIN, grievance officer contact), payment QR code, and custom domain.
- Records: when you accepted our terms, when you publish your site, and your plan and billing history.
- Messages you send to our support or Grievance Officer.
From Customers, on behalf of Store Owners
- Name, phone number, delivery address, and optionally email address.
- The items ordered, order value and chosen delivery date.
- For UPI orders, a screenshot of the payment. This may show a name, UPI ID and transaction reference. It is stored privately and shown only to the store owner.
Collected automatically
- Technical data: IP address, browser and device type, pages requested, and timestamps. Our hosting provider collects these as standard server logs, and we use them for security, abuse prevention (for example, limiting how often orders can be placed from one connection) and fixing errors.
- Browser storage: a few items stored in your browser, such as your login session, cart and theme choice. See our Cookie Policy.
We do not collect card numbers, bank account details or UPI PINs. We do not knowingly collect data from children. OneSite is not meant for anyone under 18, and store owners must not knowingly process children's data through their Storefronts without verifiable parental consent.
4. Why we use it
| Purpose | Data used | Basis under the DPDP Act |
|---|---|---|
| Creating and running your account, building and hosting your Storefront | Account and store details | Your consent, given when you sign up; and use for the purpose you gave the data for (section 7(a)) |
| Recording orders, showing them to the store owner, and sending order emails | Customer order data | Processed for the store owner, who is the Data Fiduciary |
| Security, fraud and abuse prevention, and keeping the Services working | Technical data, account data | Consent, and legitimate uses allowed by law |
| Service messages (for example security alerts, changes to terms, billing) | Email, WhatsApp number | Consent, and use for the purpose you gave the data for |
| Billing, invoices and tax records | Account and billing details | Compliance with law (section 7(c)–(d)) |
| Responding to legal requests and complaints | Any relevant data | Compliance with law, court orders |
We send marketing emails only if you agree to them, and you can opt out at any time. We do not sell personal data, and we do not use it for targeted advertising.
5. Who we share it with
We share personal data only with the following:
- Cloudflare, Inc.: our hosting, database, file storage, content delivery and security provider. All OneSite data is stored and served on Cloudflare's network, which has servers in India and other countries.
- [email hosting provider]: our email service, which sends order notifications and account emails.
- GitHub, Inc.: runs the process that builds each Storefront. It receives only the store's public information (products, photos, texts), never Customer data.
- India Post's public pincode service (api.postalpincode.in): receives only the 6-digit pincode a Customer types, to fill in their city and state.
- Google Fonts: our marketing website loads fonts from Google, which receives your IP address when the page loads.
- Store Owners: receive the order data of their own Customers.
- Authorities: when the law, a court order or a lawful Government request requires it.
- A successor business: if OneSite is sold or transferred. The data would stay protected under this policy, and we would tell you first.
6. Transfers outside India
Some of our providers process data outside India. The DPDP Act allows this, except to countries the Government of India restricts by notification. If such a restriction affects us, we will take the necessary steps to comply.
7. How long we keep it
- Account and store data: while your account is open, then deleted within 30 days of closure (backups within a further 90 days). Some billing and tax records are kept for up to 8 years, as tax law requires.
- Customer order data: kept for the store owner while their account is open, and deleted when the store owner deletes the account or on their request, unless the law requires us to keep it.
- Technical logs: usually no more than 30 days, unless we need them to investigate a security incident or the law requires us to keep them longer.
8. How we protect it
We use reasonable security practices, including:
- encrypted connections (HTTPS/TLS) everywhere;
- passwords stored as salted bcrypt hashes;
- payment screenshots kept in private storage, available only to the signed-in store owner;
- access to production systems limited to the people who run OneSite; and
- our infrastructure provider's protections against attacks.
No system is perfectly secure. If a personal data breach happens, we will inform the Data Protection Board of India and affected people as the DPDP Act and its rules require.
9. Your rights
Under the DPDP Act you have the right to:
- access a summary of the personal data we hold about you and how we process it;
- correct, complete or update it. Store Owners can change most details themselves in the admin panel;
- erase it, unless we must keep it by law;
- withdraw consent at any time. This does not affect processing already done, and we may then be unable to provide the Services;
- nominate someone to exercise your rights if you die or become unable to; and
- have your grievances redressed, by us first, and then by the Data Protection Board of India.
To use these rights, email [grievance email, e.g. grievance@adwebsolutions.in] from the email address linked to your account (or give enough detail for us to find your data). We may need to verify your identity. We will respond within 30 days, or sooner if the law requires. Customers of a store should first contact that store, as explained in section 2.
10. Changes to this policy
If we change this policy in a meaningful way, we will tell Store Owners by email or in the admin panel before the change takes effect, and update the date at the top.
11. Contact and grievances
Grievance Officer: Darpan Vadher
Email: [grievance email, e.g. grievance@adwebsolutions.in]
Phone: [contact phone number]
Address: ADWeb Solutions, [registered business address]
Hours: Monday to Saturday, 10:00–18:00 IST (except public holidays)