Privacy Policy

Last updated 4 October 2026

This policy explains how [Legal business name] ("InstaWebCart", "we") collects and uses personal data when you use InstaWebCart, in line with India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

1. Data we collect

• Account details: your name, email address and password (stored only as a secure hash), and the accounts of staff you invite.
• Business and billing details: your business name, GSTIN, address and invoice email, and your plan and payment history.
• Payments: Razorpay processes plan payments. We receive payment and subscription references and amounts, never your card, UPI or bank details.
• Your stores: products, images, pages, settings, orders and the other content you add.
• Technical data: IP address, browser, pages used and server logs, to keep the service working and secure.
• Messages: emails and support requests you send us.

2. Your customers' data

When shoppers buy from a store on InstaWebCart, the store is responsible for their data (it is the "data fiduciary"), and we process it on the store's behalf to run the store: their name, contact and address details, orders and account. Shoppers should contact the store about their data; we'll help stores respond.

3. How we use data

• To provide InstaWebCart: create and run your stores, sign you in and support you.
• To bill you, issue invoices and credit notes, and keep records the law requires.
• To send service emails: receipts, reminders, security and account messages, and the emails your store sends to its customers.
• To keep the service secure and prevent fraud and abuse.
• To improve InstaWebCart using aggregated, non-identifying information.

We don't sell personal data, and we don't use it for advertising.

4. Cookies

InstaWebCart uses only the cookies it needs to work: to keep you signed in, to remember which store's admin you have open, and to keep a shopper's cart. We don't use advertising cookies. Analytics or tracking tools a store adds to its storefront (such as Google Analytics or a Meta pixel) are the store's choice and responsibility.

5. Who we share data with

• Service providers that help us run InstaWebCart, under contracts that protect your data: our server hosting provider (servers in Mumbai, India), our file and backup storage provider, Razorpay (payments), our email delivery provider, and Shiprocket or Delhivery when a store connects them. Ask us for the current list.
• Authorities, when the law requires it.
• A buyer or successor, if our business is sold or merged, under this policy.

6. Where data is stored

InstaWebCart's servers and databases are in India (Mumbai). Images, files and encrypted backups are kept with our storage provider in the Asia-Pacific region, and some providers, such as our email delivery provider, may process data outside India to deliver their service.

7. How long we keep data

We keep your data while your account is active. After it ends, we keep store data for at least 90 days so you can come back, then may delete it. We keep invoices and payment records for as long as tax law requires (currently at least 8 years).

8. Security

We use encryption in transit (HTTPS), hashed passwords, encrypted storage of payment gateway keys, separate data for each store, restricted access and regular backups. No system is perfectly secure; if a breach affects you, we'll tell you and the authorities as the law requires.

9. Your rights

You can ask to see, correct, update or delete your personal data, withdraw consent where we rely on it, and nominate someone to exercise your rights. Most details can be changed in your account; for anything else, email [Support email]. We may need to keep some data where the law requires it.

10. Children

InstaWebCart is for businesses and people aged 18 and over. We don't knowingly collect data from children.

11. Grievance Officer

[Grievance Officer's name], Grievance Officer, [Legal business name], [Registered business address]. Email [Grievance Officer's email]. We'll acknowledge a complaint within 48 hours and aim to resolve it within 30 days. If you're not satisfied, you may complain to the Data Protection Board of India.

12. Changes

We'll post any changes here and update the date above. For important changes we'll email you.