🔒 Privacy Policy
Last Updated: 14 October 2026
1. Information We Collect
Apna Bachat Club is a vendor-focused SaaS platform. We collect only the information needed to run the service:
- Vendors (shops): shop / business name, owner name, WhatsApp number, complete address, Zipcode, optional shop image, and PIN (stored only as a secure hash).
- Customers: only a name and WhatsApp number, which the vendor enters when adding an order or a gift.
- Order & wallet data: order amount, cashback amount, platform fee, wallet balance and transactions — all visible in the vendor dashboard.
🔑 We never store the content of WhatsApp OTPs or messages or any chat history — only the delivery status (sent / failed) of notifications is recorded.
2. How We Use Your Data
- To register your shop and verify your WhatsApp number with an OTP (valid 5 minutes).
- To let you log in with your WhatsApp number and 6-digit PIN.
- To calculate and credit cashback when you add an order.
- To send the customer their cashback, gift and reward notifications on WhatsApp (from your own shop number).
- To process wallet recharges through Razorpay and to collect the platform fee on orders.
- To generate reports and anonymised platform analytics.
3. Data Sharing
- We never sell or rent your data to any third party.
- A customer's name and number are visible only to the vendor they shop with.
- Every vendor can see only their own customers — no other vendor can see your customer data.
- Data is disclosed only when required by law.
- Wallet recharges are handled by Razorpay, which processes the transaction under its own privacy policy.
4. Data Security
- PINs are stored only as a secure hash — never in plain text.
- Sessions use HttpOnly + SameSite=Strict cookies with CSRF protection, and the session ID is regenerated on login.
- Brute-force protection: after 3 wrong PIN attempts the account is locked for 1 hour, with additional IP-level rate limits.
- OTPs expire in 5 minutes and are protected by attempt limits and rate limits.
- The database runs on an access-controlled server and is reachable only by authorised staff.
5. Customer Data & WhatsApp Messages
Customer records are created by the vendor, so the vendor is responsible for their accuracy:
- A customer's cashback, gift and reward notifications are sent from the vendor's own WhatsApp number.
- A message contains only the reward amount and the shop name — no sensitive data.
- The platform never asks a customer for a PIN or OTP — so there is no scope for such a scam.
- A customer who wants their data corrected or removed can contact the shop that added them; our support team also helps with such requests.
6. Your Rights (Vendors)
- You can request access to, or correction of, your account data at any time.
- If you delete your account, your personal data is permanently removed (transaction history may be retained in anonymised form for accounting and legal purposes).
- You can update your shop details at any time from the vendor dashboard.
7. Contact Us
If you have any questions about this Privacy Policy, reach out to us: