Privacy Policy

Last updated: 30 September 2026

This policy explains what personal data OneSell (onesell.shop and the OneSell mobile app) collects, why, who it is shared with, and the choices you have. OneSell is operated by CodeSH Lab (Udyam Registration No. UDYAM-UP-28-0238789). We follow the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

1. Whose data, and our role

• Sellers — people who create products and checkout links. We decide how seller account data is used.
• Buyers — people who order through a seller's link. The seller you buy from uses your details to fulfil your order; we process them to run the checkout, order page and notifications for that seller, and for the limited purposes below (such as security).

2. What we collect

From sellers

• Account: email address, name, and phone number if you add it. If you sign in with Google, we receive your name and email from Google.
• Store content: products, prices, photos, descriptions, digital files, charges and tax settings.
• ShopLink: your shop name, WhatsApp number, logo and tagline. These are shown publicly on your ShopLink page, together with the products you choose to show there.
• Payment settings: your UPI ID and display name, or your Razorpay Key ID and Key Secret. The Key Secret is stored encrypted and is never shown again, including to you.
• Plan purchases: plan, amount, date and Razorpay payment ID. Card and UPI details are handled by Razorpay — we never see them.
• Mobile app: a push-notification token for your device, so we can alert you about new orders.

From buyers

• Name, phone number and email address.
• Delivery address and delivery notes, when the product is shipped or delivered.
• Order details: what you bought, amount, charges and taxes, payment status, and the UPI transaction reference if you enter one.
• For order tracking, the order ID and phone or email you enter.
• Orders made from a seller's ShopLink page are different: the order is a message sent from your own WhatsApp to the seller. When you tap "Order on WhatsApp", we save what was in your cart (products, options, quantities and total) with an order number, so the seller can match your message and keep track of their orders. We do not receive the message itself, and we do not store your name or your number.

Automatically, from everyone

• Product-page statistics for sellers: page views and checkout starts, traffic source (for example "instagram") and device type. We store a one-way hashed version of your IP address, never the IP itself.
• Security data: short-lived counters based on a hashed IP address to stop spam and abuse. They are deleted within a day.
• Cookies — see section 7.

3. How we use it

• To run the Service: create links, show product pages, take orders, confirm payments with Razorpay, deliver digital products, and show order status.
• To send service messages: order confirmations, payment and delivery updates, cancellations and refunds, login links, and new-order alerts to sellers. We do not send marketing emails.
• To give sellers their order list and product statistics.
• To prevent fraud, spam and abuse, and to keep the Service secure.
• To understand how the website is used and improve it (Google Analytics).
• To meet legal, tax and accounting obligations and respond to lawful requests.

We do not sell your personal data.

4. Who we share it with

• The seller you buy from receives your order details (name, phone, email, delivery address, order) to fulfil the order.
• Razorpay — processes online payments into the seller's account, and plan payments into ours.
• Service providers that run parts of OneSell for us, only for that purpose:
  • Supabase — database and sign-in
  • Vercel — website hosting
  • Cloudflare — file storage, DNS and email forwarding
  • Resend — sending emails
  • Google — Google sign-in and Google Analytics
  • Firebase Cloud Messaging and Expo — mobile push notifications
• Authorities, when required by law, or to protect users against fraud or harm.

5. Where data is stored

Our providers store and process data on servers outside India, including in Japan and the United States, with appropriate safeguards. By using the Service you understand your data may be processed there.

6. How long we keep it

• Seller account and store data: while the account is active.
• Orders and payment records: as long as needed for the seller's business and for tax, accounting and legal requirements.
• Download links: until they expire or reach their download limit.
• Abuse-prevention counters: less than a day.
• After an account deletion request, we delete or anonymise the data within 30 days, except records we must keep by law.

7. Cookies

• Essential cookies keep sellers signed in. The Service does not work without them. If you fill in the "create your ShopLink" form before signing in, one more cookie remembers what you typed for up to 15 minutes so you don't have to type it again.
• Analytics cookies (Google Analytics) measure visits — pages viewed, device, and approximate location. Order and account identifiers are removed from page addresses before anything is sent to Google. You can block these cookies in your browser without affecting the Service.

8. Security

Data is sent over HTTPS. Access to data is restricted per account, Razorpay secrets are encrypted, and paid files are delivered only through short-lived signed links. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.

9. Your rights

You can ask us to:

• tell you what personal data we hold about you and who we shared it with;
• correct or complete your data;
• delete your data or your seller account;
• withdraw consent where we rely on it;
• nominate someone to act for you in case of death or incapacity.

Email support@onesell.shop from the email address linked to your account or order. Buyers: for an order, you can also contact the seller directly; we will help where the data is held by us. We respond within 30 days.

10. Children

OneSell is not meant for anyone under 18, and we do not knowingly collect their data.

11. Changes

We may update this policy. The date at the top shows the latest version, and we will give notice of significant changes on the site or by email.

12. Contact and grievances

Privacy questions: support@onesell.shop. Complaints can be sent to our grievance officer at grievance@onesell.shop (acknowledged within 24 hours, resolved within 15 days). If you are not satisfied, you may complain to the Data Protection Board of India. See also Contact us and our Terms of Service.