Privacy Policy

1. Introduction

This Privacy Policy applies to both:

• The IndiAlibaba website at https://indialibaba.com
• The IndiAlibaba Android mobile application available on Google Play

Together these are referred to as the "Service". This is a single, unified Privacy Policy that satisfies Google Play's requirement to link a privacy policy in your Play Store listing.

IndiAlibaba ("we," "our," or "us") is committed to protecting your privacy. By using the Service you agree to the practices described here. If you do not agree, please stop using the Service.

2. Data Controller

• Company: SRI MEENAKSHI GLOBAL TRADERS
• Brand name: IndiAlibaba
• Address: Star Avenue, Plot No. 1, SKS Street, Madurai, Tamil Nadu 625020, India
• Email: support@indialibaba.com
• Website: https://indialibaba.com

3. What Data We Collect

We collect only the data needed to operate the Service. Below is a precise list of what is actually collected and why.

3.1 Account and Profile Data

When you register or update your profile you may provide your full name, email address, mobile number, and country code. This is stored on our backend server and used to identify you, personalise your experience, and fulfil your orders.

3.2 Order and Transaction Data

When you place an order we collect your shipping address (recipient name, mobile number, address line, city, state, postal code, country) and order history (product names, quantities, prices, order status, payment status). Payment processing is handled entirely by Razorpay. We do not store your card number, CVV, or full payment credentials on our servers.

3.3 Cart and Wishlist Data

Items you add to your cart or wishlist (product code, name, price, quantity) are linked to your account and stored on our backend so your selections persist across sessions and devices.

3.4 OTP / Authentication Data

When you request a one-time password (OTP), your mobile number is sent to Twilio to deliver the OTP via SMS. OTP attempts are logged in our database for rate-limiting and fraud prevention. OTP records are invalidated immediately after successful verification and purged periodically.

3.5 Support Chat Data

When you use the in-app support chat, your messages and star ratings are stored in Google Firebase Firestore. Chat sessions are linked to a session ID; if you are logged in, the session also stores your account identifier, display name, and mobile number so support agents can identify you.

Before your chat is passed to a human agent, your messages are processed by OpenAI language models to generate automated responses. See Section 7 for full details.

3.6 Push Notification Token

With your permission, we collect a Firebase Cloud Messaging (FCM) device token to send you push notifications about orders and support chat activity. The token is stored in Firebase Firestore and on our backend. You can revoke this permission at any time in your device's notification settings.

3.7 Location Data (Mobile App — Optional)

The mobile app may request access to your device's precise GPS location solely to auto-fill your delivery address form (city, state, postal code, country). GPS coordinates are reverse-geocoded on your device using the operating system's geocoding service and are not transmitted to our servers. Location access is completely optional — you can enter your address manually instead. You can revoke location permission at any time in your device settings.

3.8 Voice Search / Microphone (Mobile App — Optional)

The mobile app includes an optional voice search feature. When you tap the microphone button, the app requests microphone access and uses your device's on-device speech recognition to convert speech to a search query. Audio is not recorded by us and is not transmitted to our servers. Speech processing is handled entirely by the operating system. You can use text search instead without granting microphone permission.

3.9 Device and Technical Data

We may automatically collect technical information such as your IP address, browser or device type, operating system version, and diagnostic information for security, fraud prevention, and service maintenance. This data is not linked to your account profile.

3.10 Website Session Data

When you log in on the website, your authentication token, user identifier, name, and mobile number are stored in your browser's localStorage. This keeps you logged in between page visits and is stored entirely on your own device. It is cleared when you log out.

3.11 Data We Do NOT Collect

• Camera access or photos from your photo library
• Contacts from your address book
• Full payment card numbers (handled exclusively by Razorpay's PCI-DSS compliant infrastructure)
• Biometric or health data
• Raw audio recordings (voice search is processed on-device only)
• GPS coordinates transmitted to our servers (location is used on-device only)
• Social media profile data
• Newsletter subscriptions

4. How We Use Your Data

• Order fulfilment: Processing purchases, managing delivery, and handling returns or refunds.
• Account management: Creating and maintaining your account, authenticating sign-ins via OTP (Twilio), and enabling profile updates.
• Customer support: Reviewing chat sessions to resolve your enquiries. Automated replies are generated by OpenAI using your chat messages and relevant account context (see Section 7).
• Address auto-fill (mobile app): Using GPS location on-device to pre-populate the delivery address form.
• Voice search (mobile app): Converting spoken queries to text for product search using on-device speech recognition.
• Push notifications: Sending order status updates and support chat alerts. You can opt out at any time via device notification settings.
• Service improvement: Analysing anonymised usage patterns to improve the app and website.
• Security and fraud prevention: Monitoring for suspicious activity, including OTP rate-limiting, to protect users and the platform.
• Legal compliance: Meeting applicable legal obligations and responding to lawful requests from authorities.

5. Third-Party Services We Use

We do not sell your personal data. We share it only with the following service providers, strictly for the purposes described:

5.1 Razorpay (Payment Processing)

We use Razorpay to process payments. When you make a payment, you interact directly with Razorpay's PCI-DSS compliant payment interface. We do not receive or store your full card number or CVV. Razorpay operates under its own Privacy Policy.

5.2 Twilio (OTP SMS)

Your mobile number is sent to Twilio to deliver OTP verification codes via SMS. Twilio is a US-based service and operates under its own Privacy Policy. Data transferred to Twilio is protected under appropriate safeguards.

5.3 OpenAI (AI Support Chat)

When you use the support chat, your messages are processed by the OpenAI API before escalation to a human agent. The data sent to OpenAI includes:

• Your chat messages and recent conversation history
• If you are logged in: your name, up to 5 recent orders (order codes, item names, delivery status, payment status), your cart contents, your wishlist items, and your default delivery address (city, state, postal code)
• Store context: store name, product categories, and store policies

This data is used solely to generate a relevant support response. We do not use your data to train OpenAI models. OpenAI operates under its own Privacy Policy. If you prefer not to have your data processed by OpenAI, you can tap "Human" in the chat header to bypass AI entirely.

5.4 Google Firebase (Firestore and Cloud Messaging)

We use the following Firebase products:

• Firebase Firestore — stores support chat conversations, ratings, and FCM device tokens.
• Firebase Cloud Messaging (FCM) — delivers push notifications to your device. Requires your permission on Android 13+.

We do not use Firebase Analytics or Firebase Crashlytics. Google's data practices for Firebase are described at firebase.google.com/support/privacy.

5.5 Backend Infrastructure

Our secure backend infrastructure stores your account, cart, wishlist, and order data. All communication with our backend is encrypted via HTTPS/TLS.

6. App Permissions (Android)

The IndiAlibaba Android app requests the following permissions. All sensitive permissions are optional and can be denied or revoked at any time in your device settings without affecting core shopping functionality.

• Location — Fine and Coarse (ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION) — Optional: Used on-device only to auto-fill your delivery address. GPS coordinates are reverse-geocoded locally and are never sent to our servers. You can enter your address manually without granting this permission.
• Microphone — RECORD_AUDIO — Optional: Used for voice search on the home and search screens. Audio is processed on-device by the operating system's speech recognition. No audio is recorded or transmitted by us. You can use text search instead.
• Internet — Required: Required for all core app functionality — browsing products, placing orders, and using support chat.
• Post Notifications — POST_NOTIFICATIONS (Android 13+) — Optional: Required to receive order updates and support chat notifications. You can disable this in your device's notification settings at any time.

We do not request camera, contacts, storage, phone, or biometric permissions.

7. Data Security

• All data transmitted between your device and our servers is encrypted using HTTPS/TLS.
• Firebase Firestore data is stored in Google's secure, encrypted cloud infrastructure.
• Authentication tokens are stored locally on your device (app: device storage; website: browser localStorage) and are transmitted only to our backend API.
• OTP endpoints are rate-limited at both the IP level and per-phone level to prevent brute-force abuse.
• Payment processing is handled by Razorpay's PCI-DSS compliant infrastructure. We never store card details.
• Access to personal data is restricted to authorised personnel and service providers who have a legitimate need.
• Despite our safeguards, no system is 100% secure. If you suspect unauthorised access to your account, contact us immediately at support@indialibaba.com.

8. Data Retention

• Account information is retained while your account is active. It is deleted or anonymised within 30 days of an account deletion request, except where retention is required by applicable law (e.g. financial and tax records).
• Chat messages stored in Firestore are retained only as long as necessary to provide customer support or comply with legal obligations, and are then deleted.
• OTP records are invalidated immediately after successful verification and purged periodically from the database.
• Server access logs are retained for a short period for security monitoring and then deleted.

9. Account Deletion

You may request deletion of your account and personal data at any time by contacting us at support@indialibaba.com with the subject line "Account Deletion Request". We will delete or anonymise your personal data within 30 days, except where retention is required by applicable law. Deleting your account will permanently remove your order history, saved addresses, wishlist, and cart from our systems.

10. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Correct inaccurate or incomplete data. You can update your name and email directly in the app under Account Settings.
• Erasure: Request deletion of your personal data. See Section 9 for how to delete your account.
• Withdraw consent: For push notifications, location, and microphone access, withdraw permission via your device settings at any time without affecting other app functionality.
• Opt out of AI chat processing: Tap "Human" in the chat header to bypass OpenAI and speak directly with a human agent.

To exercise any of these rights, email us at support@indialibaba.com. We will respond within 30 days.

11. Children's Privacy

The Service is not intended for children under the age required by applicable law (generally under 13). We do not knowingly collect personal data from such children. If you believe a child has provided us with personal data, please contact us at support@indialibaba.com and we will promptly delete it.

12. International Data Transfers

IndiAlibaba is incorporated in India. Some of our service providers — including Twilio and OpenAI — are based in the United States. When we share your data with these providers, it may be processed outside India. We take reasonable steps to ensure such transfers are protected under applicable data protection laws and contractual safeguards.

13. Links to Third-Party Websites

The Service may contain links to third-party websites or services. This Privacy Policy does not apply to those sites, and we are not responsible for their privacy practices. We encourage you to review the privacy policy of any third-party site you visit.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you via email or an in-app notification. Continued use of the Service after the effective date of any update constitutes your acceptance of the revised policy.

15. Contact Us

If you have any questions, requests, or complaints about this Privacy Policy or our data practices, please contact us:

• Company: SRI MEENAKSHI GLOBAL TRADERS (IndiAlibaba)
• Address: Star Avenue, Plot No. 1, SKS Street, Madurai, Tamil Nadu 625020, India
• Email: support@indialibaba.com
• Website: https://indialibaba.com