Privacy Policy

Last updated 29 October 2026

This policy explains how Sarafa Pro (“Sarafa Pro”, “we”) handles personal data in the Sarafa Pro software. It is written to meet India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 and its rules.

1. Two kinds of data, two roles

Account data (shop owners and staff: name, email, phone, sign-in records). For this we decide how the data is used: we are the Data Fiduciary.
Shop records (a shop’s customers, their phone, address, Aadhaar number, photos, loans and items). The shop decides what to record and why: the shop is the Data Fiduciary and we process the data only on its behalf, as its Data Processor. Customers of a shop should contact that shop first about their data.

2. What we collect

Account details you give us: name, email, phone, shop name and address.
Shop records you enter, including photos you upload.
Payment records from Razorpay (we never see or store full card or UPI details).
Technical data: IP address, browser, sign-in times, and error reports, used for security and to fix problems.

We do not sell personal data, show advertising, or use shop records to train AI models.

3. Why we use it

to run the Service: sign in, save and show your records, send the email reports you turn on;
to keep it secure: rate limits, audit logs, detecting misuse;
to take payment and keep accounting records the law requires;
to contact you about your account, changes to the Service and these policies.

4. How we protect it

All traffic is encrypted (HTTPS). Databases and backups are encrypted at rest.
Aadhaar numbers and customer addresses are also encrypted field by field with a separate key per shop; staff see only the last four Aadhaar digits.
Each shop’s data is isolated in the database; every change is recorded in an audit log.
Passwords are stored as Argon2 hashes. Our own admin access needs two-factor sign-in and is logged.
Data kept on a device for offline use is encrypted and wiped on sign-out.

5. Where it is stored and who else sees it

Data is stored in India (AWS Mumbai region). We use a small number of service providers under contract: our hosting and database provider, our email provider (for sign-in links and reports) and Razorpay (payments). They may only use the data to provide their service to us. We disclose data to authorities only when Indian law requires it.

6. How long we keep it

Shop records: while the account is open, then 30 days after it closes, then deleted.
Backups: up to 35 days, then overwritten.
Audit and security logs: up to 1 year. Error reports: 90 days.
Payment and invoice records: as long as tax law requires (currently 8 years).

7. Your rights

Under the DPDP Act you can ask to access, correct or erase your personal data, withdraw consent, and nominate someone to act for you. Shop owners can export, correct and delete records in the app. For anything else write to support@sarafapro.com. We reply within 30 days.

8. Breaches

If a personal data breach happens we will inform affected shops and the Data Protection Board of India as the law requires, and tell you what we are doing about it.

9. Children

The Service is for businesses and is not meant for anyone under 18.

10. Grievance Officer

[Grievance Officer name], Sarafa Pro, [Registered address], [City], India. Email: support@sarafapro.com. If you are not satisfied with our answer you may complain to the Data Protection Board of India.

11. Changes

We will post changes here and email account holders about material ones.