Privacy Policy

MartLiv ("we", "us", or "our") operates the MartLiv mobile application and website (collectively, the "Platform"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform. By accessing or using MartLiv, you consent to the practices described in this policy. This policy is governed by the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

1. Information We Collect

We collect information that you provide directly and information that is collected automatically when you use our Platform.

1.1 Information You Provide

• Name, email address, and mobile phone number
• Delivery addresses (including GPS coordinates for serviceability checks)
• Order history, wishlist, and product preferences
• Communications with our customer support team
• Profile information you choose to update

1.2 Information Collected Automatically

• Device Identifiers: We generate and store a unique device UUID, and collect your device's native hardware identifier (Android ID or iOS Identifier for Vendor) for session security and fraud prevention
• Device Fingerprint: We create a hashed fingerprint using device brand, model, OS version, and memory to verify device authenticity
• Location Data: With your permission, we collect precise GPS coordinates to determine delivery serviceability and find the nearest warehouse
• Push Notification Token: We store your Firebase Cloud Messaging (FCM) token to send order updates, delivery notifications, and promotional alerts
• Search History: Your recent product search queries are stored on our servers to provide quick access to past searches
• IP Address: Collected for rate limiting, security, and access logging purposes

1.3 Payment Information

Payment transactions are processed securely through PhonePe, our third-party payment gateway. We do not store your credit/debit card numbers, UPI PINs, or bank account details on our servers. We only retain the transaction ID, payment status, and payment instrument type (e.g., UPI, card) for order tracking and refund processing.

2. How We Use Your Information

• Process, fulfill, and deliver your orders
• Send real-time order status updates and delivery notifications via push notifications
• Verify delivery serviceability based on your location
• Authenticate your identity via OTP-based login and detect unauthorized device access
• Prevent fraud, rate-limit abuse, and enforce security policies
• Improve our services, user experience, and product offerings
• Send promotional communications, deals, and offers (with your consent, which you may withdraw at any time)
• Generate business analytics and sales reports (in aggregated, anonymized form)
• Comply with legal obligations and respond to lawful requests

3. Information Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. We may share your information only in the following circumstances:

• Delivery Partners: Your name, delivery address, and phone number are shared with our delivery riders to fulfill your orders
• Payment Processor (PhonePe): Order amount and transaction details are shared for payment processing, verification, and refunds
• Cloud Infrastructure: Your data is stored on MongoDB Atlas (cloud database) and secured servers. We use ImageKit for product image delivery
• Firebase (Google): Push notification tokens are processed through Firebase Cloud Messaging for delivering notifications
• Google Maps: Location coordinates are shared with Google Maps API for address geocoding and serviceability checks
• Error Monitoring (Sentry): Anonymous crash reports, device metadata (model, OS version), and error stack traces are sent to Sentry for application stability monitoring and bug fixing. No personally identifiable information is intentionally collected through this service
• Legal Compliance: We may disclose information when required by law, court order, or government authority, or to protect our rights and safety

4. Data Storage and Security

We implement industry-standard technical and organizational measures to protect your personal information:

• All data in transit is encrypted using HTTPS/TLS
• Passwords and OTPs are never stored in plain text
• Device-bound authentication tokens prevent session hijacking
• Rate limiting protects against brute-force attacks on login and payment endpoints
• Database access is restricted and authenticated
• Automated database backups ensure data durability

Your data is stored on servers hosted in India. While we take reasonable precautions, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide our services:

• Account Data: Retained until you request account deletion
• Order History: Retained for a minimum of 8 years for tax and legal compliance
• Search History: Up to 15 recent product searches are retained; you can clear them at any time from the app
• Location Data: Your most recent GPS location is stored for serviceability; up to 5 recent location searches are retained
• Device Identifiers: Retained as long as your account is active for security purposes
• Server Logs: Access logs containing IP addresses are retained for up to 90 days

6. Your Rights

Under applicable Indian data protection laws, you have the following rights:

• Access: View your personal information from your profile
• Correction: Update your name, email and delivery addresses at any time
• Deletion: Request deletion of your account and associated data directly via our Account Deletion Page or from your mobile app profile
• Search History: Clear your product search history directly from the app
• Wishlist: Add or remove products from your wishlist at any time
• Notifications: Opt out of push notifications through your device settings
• Location: Revoke location permissions through your device settings at any time
• Withdraw Consent: You may withdraw consent for data processing by contacting us, subject to legal and contractual obligations

7. Cookies and Local Storage

Our website uses cookies and local storage to enhance your experience:

• Essential Cookies: Required for authentication, session management, and shopping cart functionality
• Functional Cookies: Store your preferences such as delivery location and display settings
• Analytics: Help us understand usage patterns to improve our services

Our mobile app uses secure on-device storage (SecureStore) to persist your login session and device UUID. Cookies and local storage data are retained for a maximum of 90 days, after which they automatically expire. You can manage or delete cookies at any time through your browser settings. For a detailed breakdown, please see our Cookie Policy.

8. Children's Privacy

Our Platform is not intended for children under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will take steps to delete such information promptly.

9. Third-Party Links

Our Platform may contain links to third-party websites or services (e.g., PhonePe for payments). We are not responsible for the privacy practices or content of these third-party services. We encourage you to read their privacy policies before providing any personal information.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of significant changes by posting the updated policy on this page with a revised "Last updated" date. For material changes, we may also notify you via push notification or email. Your continued use of the Platform after any changes constitutes acceptance of the updated policy.

11. Grievance Officer

In accordance with the Information Technology Act, 2000 and the rules made thereunder, the Grievance Officer for the purpose of this Privacy Policy is: