Privacy notice
Privacy Policy
This policy explains how the current Ubhaar-Vyapaar prototype collects and uses information in its B2B marketplace workflows. It is not a legal certification and requires professional legal review before production reliance.
Operator and contact status
Platform operator legal-entity details are not configured in this prototype deployment.
Privacy contact details are not configured in this prototype.
The deployment owner should configure LEGAL_CONTACT_EMAIL
before public production use.
Information we collect
The code currently collects the following categories:
- Account data: username, email address, optional phone number, password hash, role, registration consent timestamps and policy versions.
- Manufacturer profile data: business name, business description, city, state, verification flags, and KYC review status.
- Marketplace listing data: title, category, description, capabilities, machine type, materials, price, MOQ, production days, capacity, cluster, availability status, and optional listing image.
- Buyer workflow data: saved listings, quote-request quantity, requirements, and delivery location.
- Commercial workflow data: quotations, accepted terms, demo order records, simulated milestone funding/release states, messages, notifications, and reviews.
- Authentication/security data: Django session and CSRF cookies, password reset email tokens, and server/security logs generated by the hosting environment.
The current schema does not request government ID numbers, card details, UPI IDs, bank credentials, or KYC document uploads.
How information is used
- To create buyer and manufacturer accounts.
- To show verified manufacturer capacity to buyers.
- To support quote requests, quotations, demo orders, messages, notifications, and reviews.
- To verify or review manufacturer business profiles before public listing visibility.
- To send password reset and system emails when email delivery is configured.
- To protect accounts, prevent unauthorized access, and maintain application security.
Consent and account registration
Account registration requires users to agree to the Terms & Conditions and acknowledge this Privacy Policy. The application records the timestamp and policy versions for that account event. Marketing consent is not collected by the current application.
Cookies and local storage
The current site uses strictly necessary Django session and CSRF cookies, plus a cookie preference cookie after a user makes a choice. Optional Google Analytics is loaded only when a measurement ID is configured and the user accepts analytics. Marketing cookies are not used. See the Cookie Policy for details.
Service providers
Listing images may be stored and delivered through Cloudinary in production when media storage is configured. Password reset and system emails may be sent through SMTP; project deployment notes currently describe Brevo SMTP as the intended production provider.
These providers may receive data necessary to provide their service, such as public listing image files and metadata for Cloudinary, or email addresses and email contents for SMTP delivery.
Data retention
The current application does not implement automated deletion or retention schedules. Account, order, quotation, milestone, message, review, notification, and listing records may be retained until an administrator or future retention workflow changes them.
Recommended retention periods and deletion/anonymisation rules require business and legal review, especially for order records, marketplace disputes, and audit trails.
Security
The application uses Django authentication, password hashing, CSRF protection, session cookies, HTTPS-focused production security settings, upload validation for listing images, and role-based access checks for buyer/manufacturer workflows.
User rights and requests
Users can change their password from account settings. Manufacturers can edit their business profile. A safe self-service account deletion workflow is not currently implemented because deleting accounts may affect business records, orders, messages, and reviews.
To request correction, access, deletion, or review of account data, use the configured privacy contact if available. If no contact is configured, the deployment owner must configure one before public production use.
Children's data
Ubhaar-Vyapaar is intended for business users and does not knowingly target children. The current registration flow does not collect age or date of birth.
Changes
Policy version: 2026-10-11. Future changes should update the configured policy version and should be reviewed before relying on them publicly.