Privacy Policy

SHOPINZIP PRIVATE LIMITED, operating under the brand name "Areakart" (collectively "Areakart", "Company", "we", "our", or "us"), values the trust you place in us and recognizes the importance of secure transactions and information privacy. This Privacy Policy describes how we collect, use, share, store, and otherwise process your personal information through the Areakart website, mobile application, mobile site (m-site), merchant dashboard, APIs, store-building tools, social media integration tools (including Areakart Social Autopilot), and related products and services (collectively, the "Platform").

Areakart serves merchants and customers in India and, for certain products and services, internationally. Your personal information may be stored and processed in India and, where applicable, in other jurisdictions where we or our service providers operate. These jurisdictions may have data protection laws different from those in the country where you are located. Where we transfer personal data across borders, we take steps intended to ensure the data is handled in accordance with this Privacy Policy and applicable law.

By visiting this Platform, providing your information, connecting a third-party account, or availing of our products and services, you expressly agree to be bound by this Privacy Policy, our Terms of Use, our Data Deletion Policy, and the applicable product/service terms. Indian users and transactions are governed by the laws of India, including the Digital Personal Data Protection Act, 2023, as applicable. For international users, we process data in accordance with applicable data protection laws in the relevant jurisdiction. If you do not agree, please do not use or access the Platform.

Table of Contents

1. Information We Collect
2. How We Use Your Information
3. Cookies and Tracking Technologies
4. How We Share Information
5. Payment Processing and Third-Party Payment Providers
6. Social Media Integrations and Areakart Social Autopilot (Meta, Google/YouTube, LinkedIn, X) — see #social-media-integrations
7. Data Retention
8. Data Deletion and Your Choices
9. Data Security
10. Children's Data
11. Your Rights
12. Changes to This Policy
13. Contact Us

1. Information We Collect

When you use our Platform, we collect and store information you provide from time to time. Where possible, we indicate which fields are required and which are optional. You may always choose not to provide information by declining to use a particular service or feature.

Information you provide directly. This may include your name, business name, email address, delivery and business address, phone number, login identifiers, profile information, and payment instrument details, collected when you set up an account, transact, or participate in an event or contest.

Information collected automatically. We may track usage behaviour, preferences, the URL you came from, the URL you go to next, your browser information, device information, and your IP address. We use this for internal research on user demographics, interests, and behaviour, and to operate, secure, and improve the Platform.

With your consent, we may access your SMS, instant messages, contacts, location, camera, photo gallery, and device information. We may also request your PAN, GST number, government-issued ID, and Know-Your-Customer (KYC) details to (i) check eligibility for certain products and services; (ii) issue GST invoices; and (iii) provide access to products and services offered by us, sellers, affiliates, or lending partners. Access to certain products/services may be affected if consent is not provided.

Social media integration data. If you connect a third-party social media account, we collect limited data necessary to operate that integration. This is described in detail in Section 6.

2. How We Use Your Information

We use your personal information to provide the products and services you request. This may include:

• Setting up and operating your account, store, and dashboard
• Assisting sellers and business partners in handling and fulfilling orders
• Enhancing and customizing your experience
• Resolving disputes and troubleshooting problems
• Promoting a safe and trusted service
• Collecting payments and issuing invoices
• Measuring interest in our products and services
• Informing you of offers, products, services, and updates (with the ability to opt out)
• Detecting and protecting against error, fraud, and criminal activity
• Enforcing our terms and conditions
• Operating social media integration features you have requested

Where we use your personal information for marketing, we will provide you the ability to opt out.

3. Cookies and Tracking Technologies

We use cookies and similar technologies to analyse page flow, measure promotional effectiveness, support sign-in, and promote trust and safety. Most cookies are session cookies and are deleted automatically at the end of a session. You may decline or delete cookies through your browser settings, though some features may not function as a result. You may also encounter cookies placed by third parties on certain pages; we do not control the use of cookies by third parties.

4. How We Share Information

We may share personal information internally within the Company and with third parties to provide the products and services you request, such as deferred payment options offered through our lending partners.

We may disclose your personal information to third parties such as sellers, business partners, logistics providers, and service providers where necessary to: provide access to products and services; fulfil orders; collect payments; provide customer support; comply with legal obligations; conduct market research; enforce our Terms of Use; facilitate marketing and advertising activities; analyse data; and prevent, detect, and investigate fraudulent or illegal activity.

We do not disclose your personal information to third parties for their own marketing and advertising purposes without your explicit consent.

We may disclose personal information where required by law, or in good faith belief that disclosure is reasonably necessary to respond to legal process, enforce our terms, respond to claims, or protect the rights, property, or safety of our users or the public.

Important limitation regarding platform data. The general sharing practices described in this section do not apply to data obtained from connected social media platforms (such as Meta/Facebook/Instagram, Google/YouTube, LinkedIn, or X). Data obtained through those platforms is handled strictly as described in Section 6 and is never sold or shared for advertising or marketing purposes.

5. Payment Processing and Third-Party Payment Providers

Areakart uses third-party payment processors to handle payments, subscriptions, payouts, and related transactions. The processor used depends on your region:

• For transactions in India, we use licensed Indian payment providers, including but not limited to Razorpay and Cashfree.
• For international transactions (outside India), we use Stripe and other applicable licensed payment providers.

When you make or receive a payment through the Platform, certain information (such as name, contact details, billing information, transaction amount, and payment instrument details) is collected and processed by the relevant payment provider in accordance with their own privacy policies and applicable financial regulations. Areakart does not store full card numbers or sensitive authentication data; this information is handled directly by PCI-DSS-compliant payment processors.

Depending on the processor and your location, your payment information may be processed in India, the United States, or other jurisdictions where the relevant payment provider operates. We share with payment providers only the information necessary to process transactions, prevent fraud, comply with applicable law (including KYC, anti-money-laundering, and tax requirements), and resolve disputes and chargebacks. Your use of payment features is also subject to the terms and privacy policies of the relevant payment provider, including:

• Razorpay — https://razorpay.com/privacy/
• Cashfree — https://www.cashfree.com/privacy-policy/
• Stripe — https://stripe.com/privacy

6. Social Media Integrations and Areakart Social Autopilot

Areakart provides social media integration features, including but not limited to Areakart Social Autopilot — covering social post creation, post scheduling, publishing history, social account connection, content display, comment and message management, analytics, and related merchant marketing tools.

Areakart acts as a service provider operating on behalf of the merchant. We access and process a merchant's connected social media accounts only to provide the integration features the merchant requests, and only to the extent the merchant authorizes.

6.1 Data We Collect Through Social Integrations

If a merchant chooses to connect a third-party social media account — including but not limited to Facebook, Instagram, Meta platforms, LinkedIn, YouTube, Google, or X (Twitter) — we may collect and process limited information necessary to provide the requested integration, which may include:

• Connected social account name and account ID
• Facebook Page ID, Instagram Business or Creator account ID, and Meta Business or Page connection information
• Equivalent account, page, channel, or profile identifiers for other connected platforms
• Profile image or account display information
• Permissions and scopes granted by the user
• Access tokens or refresh tokens required to operate the integration
• Captions, media, links, hashtags, schedules, and other content created by the merchant
• Comments, messages, and replies where the merchant has authorized management of such content
• Publishing status, error messages, external post IDs, and external post links
• Limited performance, engagement, or analytics information where permitted by the connected platform and the user's granted permissions

6.2 How We Use Social Integration Data

We use this information solely to provide, operate, secure, improve, and support the social media integration features the merchant requests. This may include connecting the merchant's account, displaying available pages or professional accounts, creating or scheduling merchant-approved posts, publishing content to selected platforms, managing comments and messages where authorized, showing publishing history and analytics, validating media compatibility, detecting errors, preventing misuse, and providing support. We do not use connected social media data for any purpose unrelated to providing these integration features.

6.3 What We Never Do With Social Data

Notwithstanding any general data-sharing provisions elsewhere in this Privacy Policy, data obtained from connected social media platforms — including Meta (Facebook, Instagram), Google/YouTube, LinkedIn, and X — is:

• Never sold to any third party
• Never used for our own advertising or marketing
• Never shared with data brokers or for advertising-targeting purposes
• Never used for any purpose other than providing the integration features disclosed in this policy

We do not publish, comment, message, or take any action on a connected social media account unless the merchant or an authorized user chooses to create, approve, schedule, or initiate such action through the Areakart Platform.

6.4 Platform Compliance

For data obtained through Meta's platforms (Facebook and Instagram), Areakart's collection, use, storage, and deletion of that data complies with Meta's Platform Terms and Developer Policies.

For data obtained through Google APIs, including the YouTube Data API, Areakart's use and transfer of that information adheres to the Google API Services User Data Policy, including its Limited Use requirements. Information obtained from Google or YouTube is used only to provide the user-facing integration features the merchant requests, is not used for serving advertisements, is not sold or transferred to third parties except as necessary to provide the service or to comply with applicable law, and is not used for any purpose other than those disclosed in this policy. Use of YouTube features is also subject to the YouTube Terms of Service and the Google Privacy Policy.

For data obtained through LinkedIn, X (Twitter), or any other connected platform, Areakart's use of that data is governed by and compliant with that platform's developer terms, API service terms, and data-handling requirements, and is limited to the scopes and permissions the user has granted.

6.5 Storage and Security of Tokens

Access tokens and related credentials, where stored, are encrypted at rest and used only to provide the connected integration. Connected account data may be processed using trusted infrastructure and service providers (for example, cloud hosting providers such as Amazon Web Services) under appropriate contractual and security safeguards.

6.6 Disconnection and Deletion

A merchant may disconnect any connected social media account at any time within the Areakart Platform. Disconnecting an account revokes Areakart's access and triggers deletion of the associated access tokens, refresh tokens, and stored integration data for that account. A merchant or authorized user may also request deletion at any time.

The full process — including verification, what is deleted, what may be retained for legal or operational reasons, processing time, and platform-specific (Meta/Facebook/Instagram) deletion handling — is described in our Data Deletion Policy at https://www.areakart.com/data-deletion-policy. Tokens and integration data are deleted or irreversibly de-identified within a reasonable period (and no later than thirty (30) days) following disconnection or a verified deletion request, except where retention is required to comply with legal, regulatory, security, or fraud-prevention obligations.

6.7 Content Already Published

If content has been published to an external platform such as Facebook, Instagram, YouTube, LinkedIn, or X, that content may remain available on the external platform according to that platform's own terms, tools, and privacy practices. Deleting data from Areakart does not automatically delete content already published on a third-party platform unless that platform supports such deletion through available permissions and APIs.

Areakart is not responsible for the independent privacy practices, API restrictions, data retention rules, service outages, account restrictions, review requirements, or policy decisions of third-party social media platforms.

7. Data Retention

We retain personal information for as long as necessary to provide our services, comply with legal, tax, accounting, and regulatory obligations, resolve disputes, prevent fraud and abuse, and enforce our agreements. When you place an order through the Platform, we maintain purchase information for our records unless and until you ask us to delete it, subject to applicable retention obligations.

Social media access tokens and integration data are retained only for as long as the account remains connected, and are deleted or de-identified following disconnection or a verified deletion request as described in Section 6.6 and our Data Deletion Policy.

8. Data Deletion and Your Choices

You may request deletion of your data — including data received through connected platforms such as Meta, Facebook, and Instagram — at any time. We provide multiple methods, including in-platform disconnection, email request to support@areakart.com, and removal of Areakart from your connected apps within the relevant social platform.

Our complete deletion process, verification steps, timelines, and limitations are set out in our Data Deletion Policy: https://www.areakart.com/data-deletion-policy.

You may also opt out of marketing communications at any time using the unsubscribe mechanism provided or by contacting us.

9. Data Security

We use administrative, technical, and organizational measures intended to protect data against unauthorized access, misuse, loss, alteration, disclosure, or destruction. These may include access controls, role-based permissions, encryption, token protection, audit logs, monitoring, and secure credential handling.

No internet transmission or electronic storage system can be guaranteed to be completely secure, and you acknowledge that use of online systems involves inherent risk. Further detail on our security measures and incident handling is set out in our Data Deletion Policy.

10. Children's Data

Our services are intended for business, merchant, ordering, commerce, and operational use, and are not directed at children. We do not knowingly collect data from children. If you believe a child's data has been provided to us improperly, please contact us at support@areakart.com so we can review the matter.

11. Your Rights

Subject to applicable law, you may have the right to access, correct, update, or request deletion of your personal data, to withdraw consent, and to lodge a complaint. For users in India, these rights are provided under the Digital Personal Data Protection Act, 2023, where applicable. For international users, equivalent rights may be available under the data protection laws of your jurisdiction. To exercise these rights, contact us at support@areakart.com. We may verify your identity and authority before acting on a request.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal or regulatory requirements, or platform requirements. The updated version will be posted on this page with a revised "Last Updated" date. Continued use of the Platform after changes are posted constitutes acknowledgment of the updated policy.

13. Contact Us

For questions about our privacy practices, to exercise your rights, or to make a complaint, contact:

SHOPINZIP PRIVATE LIMITED
Operating Brand: Areakart
Registered Address: 2, Amar Park Co Op H Soc, Behind Manchhani Masjid, Saraspur, Ahmedabad, Gujarat, India, 380018
Email: support@areakart.com
Website: https://www.areakart.com