Privacy Policy

1. Information We Collect

When you interact with the BuyOnLink platform (accessible via buyonlink.com and associated subdomains), we collect information necessary to provide e-commerce storefronts, manage payment processing, and facilitate courier shipping:

• Merchant Account Information: Your name, registered business name, email address, mobile phone number, store domain, and billing credentials.
• Store Catalog & Content: Product titles, descriptions, pricing, variant configurations, stock counts, and photographs uploaded to your store.
• Shopper & Order Information: When customers place an order on your storefront, we securely record their delivery address, recipient name, phone number, order items, and payment reference IDs generated by authorized payment gateways.
• Technical & Usage Telemetry: Device type, IP address, browser user-agent, operating system, and anonymous page performance logs to ensure sub-500ms edge delivery.

2. How We Use Collected Information

We process information solely for authentic business and platform operations:

• Hosting and serving your storefront themes via high-speed CDN edge nodes.
• Routing payment events and webhook status confirmations through authorized banking and gateway partners.
• Generating automated courier shipping manifests and AWB labels (Shiprocket, Delhivery, Blue Dart).
• Triggering automated order receipts, shipping updates, and abandoned checkout recovery messages via WhatsApp.
• Preventing fraudulent chargebacks, bogus COD orders, and security vulnerabilities.

3. Financial & Payment Security

Under no circumstances does BuyOnLink store, log, or inspect full credit card numbers, debit card PINs, CVV codes, or netbanking passwords on our servers. All sensitive financial tokens are handled directly by PCI-DSS Level 1 compliant banking gateways and licensed payment aggregators.

4. Data Storage, Isolation & RLS Security

All store records and transactions are persisted in PostgreSQL databases secured by Row Level Security (RLS). Each merchant's catalog, customer list, and financial transactions are cryptographically isolated by tenant identity keys, guaranteeing that no merchant or external user can access another store's private records.

5. Third-Party Subprocessors

We collaborate with vetted enterprise infrastructure providers under strict data processing agreements:

• Payment Gateways: Authorized PCI-DSS Level 1 payment aggregators and licensed UPI providers.
• Logistics & Shipping: Shiprocket (BigFoot Retail Solutions), Delhivery Limited, Blue Dart Express.
• Edge Routing & CDN: Cloudflare Inc.
• Database & Cloud Storage: Supabase Inc. (Encrypted at rest with AES-256).

6. Rights of Data Principals (Under DPDP Act 2023)

In compliance with the Digital Personal Data Protection Act, 2023 of India, you and your customers retain complete rights over personal information:

• Right to Access: You can export your entire customer list, catalog, and order database in standard CSV format anytime.
• Right to Rectification: You can update inaccurate account or store data directly from your Admin console.
• Right to Erasure: Upon store cancellation, you can request full permanent purging of your account and store database records.
• Right to Grievance Redressal: Direct access to our designated Grievance Officer.

7. Grievance Officer & Contact

For data protection inquiries, privacy questions, or statutory grievance redressal, contact our Grievance Officer: