Privacy Policy
Last updated: February 2026
simplestores is owned and operated by SIMPLESTORES INDIA PVT LTD (“we”, “us”, “the platform”), a company incorporated in India. simplestores is a software-as-a-service e-commerce platform operated from India. This Privacy Policy explains what personal data we collect from merchants and their customers, how we use it, and the rights you have under the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable global regulations.
1. Data we collect
From merchants: Email address, mobile number, name, store details, GSTIN (optional), payment-gateway credentials (encrypted), domain configuration, uploaded product images and content.
From shoppers visiting merchant storefronts: Name, delivery address, mobile number, email (if provided), order history, payment method (we never see card numbers — Razorpay/Stripe handle that), IP-derived location for fraud prevention, browser fingerprint for cart recovery.
Automatically: Server logs, error reports, anonymous usage analytics via PostHog (you can opt out).
2. How we use it
- Operating your store: products, orders, payments, shipping.
- Sending transactional emails / WhatsApp / SMS to your customers (order confirmation, status updates, abandoned-cart recovery).
- Improving the platform — diagnostics, error fixes, fraud detection.
- Compliance with Indian tax / DPDP obligations.
We never sell your data, your customer list, or your order data to anyone.
3. Who we share with
- Sub-processors (each under a Data Processing Agreement): Razorpay (payments), MSG91 (SMS/WhatsApp/OTP), Cloudinary (images), MongoDB Atlas (database), SendGrid (email), Cloudflare (CDN/DDoS), Domainee (custom domains).
- Law enforcement — only on a valid Indian legal order.
- Nobody else.
4. Your rights under the DPDP Act
- Access — request a copy of your data.
- Correction / Erasure — email privacy@simplestores.in.
- Withdraw consent — close your account at any time via Settings → Account → Delete.
- Lodge a complaint with the Data Protection Board of India.
5. Data security
Encryption in transit (TLS 1.2+). Passwords bcrypt-hashed. Payment credentials encrypted at rest. Daily backups, restricted-access engineering team, security incident response in < 72 hours per DPDP requirements.
6. Retention
Merchant data: retained while your account is active and for 90 days after deletion (for legal / accounting). Shopper data within a merchant's store: governed by the merchant's own privacy notice.
7. Grievance & Nodal Officers
Under India's Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 §3(2) and the Consumer Protection (E-Commerce) Rules, 2020 §4(4), we publish the following disclosed points of contact:
- Grievance Officer (IT Rules 2021 §3(2) + DPDP Act 2023 §10): grievance@simplestores.in · Phone: +91 91760 01144 (Mon-Sat, 10 AM-7 PM IST) · Acknowledgement SLA 24 h · Resolution SLA 15 days.
- Nodal Officer (Consumer Protection E-Commerce Rules 2020): nodal@simplestores.in — the dedicated point of contact for the Ministry of Consumer Affairs, District Collectorates and Consumer Commissions.
- Data-privacy queries: privacy@simplestores.in · Security: security@simplestores.in.
- Legal / trademark / takedown: legal@simplestores.in.
Registered legal entity: SIMPLESTORES INDIA PRIVATE LIMITED, India. Legal service address available on written request to legal@simplestores.in.