Privacy Policy

ARUP BAZAR (“we”) is an online marketplace operated by ARUP BAZAR. This policy applies to the website at arupbazar.vercel.app and to any associated mobile app or WebView that loads the same website pages, including browsing, accounts, checkout, order tracking, support tickets, vendor applications and store chat.

By creating an account, placing an order or contacting support, you agree to the collection and use described here. Nothing in this policy limits rights you have under applicable law.

ARUP BAZAR is operated by ARUP BAZAR. The exact registered/KYC business name is configured by the owner in Admin → Settings → General (“Business / Legal Name”); the brand stays ARUP BAZAR even when the two differ. No legal suffix, GSTIN, company registration number or business address is stated here unless the owner has configured it — nothing is invented.

• Business / privacy email: ARUPBAZAR999@gmail.com
• Phone: 06297849516
• Address: 01, SAGAR, Khansahebabad, South Twenty Four Parganas, West Bengal, 743373 Khansahebabad, jaresoresan Khansahebabad, komolpur, Gangasagar, West Bengal, India
• Support hours: Monday – Sunday, 9:00 AM – 9:00 PM
• Website: arupbazar.vercel.app

We collect only what the implemented forms and flows ask for:

• Account: name, email, optional mobile at sign-up (10-digit Indian mobile when given), and a password stored only as a bcrypt hash — never in plain text.
• Profile and delivery: phone, delivery address, landmark and 6-digit PIN code entered in My Account or at checkout.
• Orders: contact name, phone, email, delivery address, landmark, PIN code, ordered items with price snapshots, subtotal, delivery fee, total, order number and invoice number.
• Cart and wishlist: products added to the cart and saved to the wishlist, linked to the signed-in account (server-side PostgreSQL, not browser storage).
• Vendor applications: business name, owner name, business email, phone, description, optional GSTIN, business address/city/state/PIN and optional store logo.
• Support and chat: ticket subject, category, message, optional order number, ticket replies, and chat messages with stores or support.
• Deletion requests: name, account email, optional phone and reason via /delete-account or My Account.
• Technical minimum: the signed-in session token (see below). No advertising SDKs, analytics SDKs, or device-permission features (camera, location, contacts).

• Accounts and access: create accounts, sign users in, keep sessions active, enforce CUSTOMER / VENDOR / ADMIN roles.
• Orders and delivery: validate stock, compute totals, decrement stock, issue order/invoice numbers, fulfil and deliver COD orders.
• Support: tickets, replies, store/customer chat, and in-app notifications (order, chat, ticket, marketplace).
• Marketplace: review vendor applications and run approved stores, commissions and fulfilment.
• Safety: password hashing, session expiry, validation, ownership checks, deletion-request limits.

We do not sell personal information and do not use it for third-party advertising.

Sign-in uses one cookie (ab_session) with a random token checked against a database session (30-day expiry). HttpOnly, SameSite=Lax, site path, Secure in production. Sign-out deletes the server session and the cookie.

The app does not use localStorage or sessionStorage, and embeds no third-party analytics or advertising trackers.

Checkout supports Cash on Delivery (COD) only. No amount is collected online; invoices read “Cash on Delivery (COD)”. No gateway (PhonePe, Razorpay, Stripe, UPI) is integrated — the payments setting states “No payment gateway is connected in the MVP. Cash on Delivery only.”

We do not collect card numbers, CVV codes, UPI PINs or gateway tokens. Support will never ask for them. If a gateway such as PhonePe is added later, this section must name the provider and link its policy before launch.

Information is shared only with those who need it to fulfil your request:

• Stores fulfilling your order: your name, phone, delivery address and ordered items (per-vendor groups and snapshots).
• Delivery: delivery address and phone so the order can reach you. No third-party courier API is integrated; delivery is coordinated by the platform/stores.
• Support/admin: tickets, replies and chats are visible to support staff and relevant store operators.
• Image hosting (ImageKit): product, category, banner, profile and chat-attachment images are uploaded directly to ImageKit and served from its CDN. ImageKit receives image files and hosting metadata — never passwords or order totals.
• Hosting/database: the deployment host (e.g. Vercel) and the PostgreSQL provider process data to run the site.
• WhatsApp (only if you tap it): floating button, “Buy on WhatsApp” and product/order links open wa.me with a pre-filled message. Using them shares your message with WhatsApp under its own policy.

No email/SMS provider, analytics provider, or payment gateway is integrated, so nothing is shared with those categories today.

Accounts, carts, wishlists, sessions, chats, notifications and vendor profiles persist in the database until removed. Order rows reference users with ON DELETE RESTRICT, and order/item snapshots plus invoice numbers are permanent so past invoices stay accurate. Support tickets and deletion-request records are kept for dispute and audit purposes.

No fixed auto-deletion periods are configured yet (honest statement — this is an owner decision still open). Until then: removable profile data is deleted on a completed deletion request; order, invoice, payment-status and support records are retained for legitimate legal, financial and dispute-resolution purposes.

Implemented safeguards (no absolute promises): bcrypt password hashing, random HttpOnly session tokens with server expiry, server-side validation and totals, per-request ownership checks, role-restricted uploads.

No method is fully secure; never share your password and sign out on shared devices.

To request access, correction, or deletion, email ARUPBAZAR999@gmail.com from your account email, or use Contact Us. Routine profile data can be corrected in My Account.

Inside the app: My Account → Delete my account. Externally (no sign-in): /delete-account — use https://arupbazar.vercel.app/delete-account as the Play Console deletion URL.

We verify ownership by email, review retained records, remove what can be removed, and tell you what was kept and why. Submitting is not completing.

ARUP BAZAR is a general marketplace, not directed at children. We do not knowingly collect children's data. If you believe a child provided information, email ARUPBAZAR999@gmail.com and we will review and remove what can be removed.

Changes are published here with a new Last updated date; the footer and /policy hub always link this canonical URL. Continued use after an update means acceptance.

• Email (fastest): ARUPBAZAR999@gmail.com
• Support: Contact Us or My Support Requests
• Phone: 06297849516