Privacy Policy

This Privacy Policy explains how 123Cart ("we", "us") collects, uses, shares and protects personal data when merchants use 123Cart to run online stores and when customers shop at those stores. We process personal data in accordance with applicable Indian law, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, as they apply.

Who is responsible for what

• For merchant accounts, we decide how and why personal data is processed.
• Each store is run by an independent merchant. The merchant decides what to sell and handles your order, payment and delivery. For order information, the merchant is responsible for how they use it, and we process it on the merchant's behalf to run the store.

Personal data we collect

• Merchant accounts: name, email address, mobile number, password (stored only as a one-way hash), store details, business address, contact numbers, and the UPI ID and bank details the merchant chooses to display to customers.
• Email verification: a single-use link sent to the merchant's email address and the time it was confirmed.
• Merchant verification: the type of identity or business document a merchant uploads, the document itself, the submission and review dates, and the review decision and reason.
• Customers: name, mobile number, delivery address, the products ordered and the amounts, the payment method, the transaction reference you enter and the payment screenshot you upload.
• Technical data: IP address, browser type, and security and audit records (for example sign-ins and administrative actions).

How we use personal data

• To create and secure accounts, verify email addresses and run stores.
• To show orders to the merchant you bought from and send them order notifications.
• To verify merchants, prevent fraud and abuse, and enforce our policies.
• To keep the service secure, investigate incidents and meet legal obligations.

We do not sell personal data and do not use customer data for advertising.

Payments and payment screenshots

Customers pay merchants directly by UPI or bank transfer. 123Cart does not receive or hold the money. Payment screenshots are stored privately (outside the public website), re-encoded to remove hidden data such as location, and shown only to the merchant who received the order, through a link that cannot be guessed and is not indexed by search engines.

Merchant verification documents

Verification documents are stored privately, outside the public website, under random file names. Only platform staff specifically authorised to review verification can open them, and every access is logged. We ask only for one of the listed documents and do not require Aadhaar.

Access controls and security

Passwords are hashed. Access to store data is limited to the merchant who owns the store and authorised platform staff. We use encrypted connections (HTTPS), rate limits and audit logs. No system is perfectly secure, but we work to protect personal data and will notify affected people and authorities of personal data breaches where the law requires it.

Sharing

• With the merchant you ordered from (your order details and payment screenshot).
• With service providers that help us run the platform (for example hosting and email delivery), under confidentiality obligations.
• With authorities when required by law or a valid legal order, or to protect people from fraud or harm.

Retention and deletion

• Account and store data: while the account is active, then deleted when the store is deleted, except records we must keep by law.
• Orders and payment screenshots: kept for the merchant's records while the store exists; deleted when the store is deleted.
• Verification documents: rejected or replaced documents are deleted after the retention period set by the platform; approved documents are kept while the account is active and deleted with the store. The record of the decision is kept for audit.
• Audit and security logs: kept as long as reasonably needed for security and legal purposes.

Your rights

Subject to applicable law, you may ask to access a summary of your personal data, correct or update it, have it erased, and withdraw consent where processing is based on consent. Customers should first contact the merchant for order-related requests; you may also contact us. You may also nominate another person to exercise your rights in case of death or incapacity, as the law allows.

Grievances and contact

For privacy requests or complaints, contact The Grievance Officer at support@123cart.in. We acknowledge complaints within 24 hours and aim to resolve them within 15 days. If you are not satisfied with our response, you may escalate to the Data Protection Board of India or other competent authority as provided by law.

Changes

We publish every version of this policy with its date. When we make material changes, merchants are asked to accept the new version before continuing.