PRIVACY · INDIA

Privacy Policy

Effective date: 19 October 2026 · Version: 2026-10-v13

1. Who decides

The operator of Volt_Tronic, [legal entity name] at [registered office address], is the data fiduciary for marketplace accounts and orders. Privacy mail: [email protected]. The service name is Volt_Tronic. It is not declared here as a registered trademark. See the Terms of Service for the name check.

2. Data we store, and why

• Account. Indian mobile number or email address, the name you give, account role, and the time the contact was verified. Used to sign you in, show orders and send notices.
• Password, only if you create one. A salted scrypt hash. The password itself is not stored.
• One-time code. A hash of the code, not the code, kept for about five minutes with a count of wrong attempts. Used to prove you control the mobile number or email.
• Consent. That you accepted the Terms and this Privacy Policy, and the version, with the time. Used to show what you agreed to.
• Sign-in session. An access cookie of about 15 minutes and a refresh cookie of up to 30 days. Both are HttpOnly, so page scripts cannot read them. The database stores only a hash of the refresh value. The access token carries your account id and role.
• Address. Address line, landmark, PIN code, city, state, state code, phone and map coordinates. Used to check whether a seller can deliver and to give that delivery to the seller and rider for that order.
• Cart on this device. Product ids and quantities in the browser’s local storage under vd_store_cart, until you check out or clear it. The server does not keep the cart.
• Order. Items and prices at purchase, GST and HSN, delivery fee, whether you added the AMC and the fee, payment method name, status, distance, estimated time, a 3-character pickup code, a 4-digit delivery code, and the count of wrong delivery-code attempts. Used to fulfil and tax the order, lock a guessed code, and review a disputed handover.
• AMC record, only if you add it. A separate row for each product: name, quantity, fee, GST, the percentage and the length, purchase time, activation on delivery, and expiry. Used to honour the cover and to print the bill.
• Payment record. Amount, status, and the payment reference from the licensed payment partner when you pay online. Used to confirm or refund the order.
• UPI app, only if you choose GPay, PhonePe, Paytm or BHIM at checkout. That app receives the amount, the payee address saved for Volt_Tronic, and the order number. Used to collect that payment. Volt_Tronic does not receive the UPI PIN.
• Saved payment method, only if you tick that box at checkout. The method, a reference from the licensed payment partner, and for a card the network and last four digits. Used to offer that method on a later checkout. You can remove it at checkout. Account deletion removes it too.
• Google or Facebook, only if you choose that button. The provider name and that provider’s account id. Google’s verified email is stored when Google says the email is verified. A Facebook email is not stored. The Facebook access token is checked and then discarded.
• Seller application. Shop name, owner name, phone, GSTIN, PAN, IFSC, shop address and coordinates, and the seller agreement version. The bank account number is stored encrypted. Used to approve the seller and settle orders. No paid KYC vendor is called while that vendor address is empty; an admin reviews the application.
• Security logs. IP address, time, request method, path without the query string, and the block reason. The query string, cookies, passwords, one-time codes, and card details are not written into this log. Used to rate-limit abuse and investigate faults. These are not used to build an advertising profile.
• Optional analytics. Only after you choose “Allow analytics”. The choice is kept in local storage as vd_analytics_consent. If you allow it, and a measurement id is configured, Google Analytics receives visit measurements. If you reject it, that script is not loaded.
• AMC repair request, only if you email one. The order number, product, fault description, serial or IMEI, and photographs you send to support. Used to tell you which service centre to use and whether the fault appears covered. The final decision is made when the appliance is inspected.
• Order alerts, only if this browser already allows notifications. A Firebase messaging token for this signed-in account. Used to send an order notice to this browser. Removed when you unsubscribe or delete the account. The page does not ask for notification permission on its own.

3. Data we do not store

• Card number, expiry, CVV, full UPI id, UPI PIN, net-banking password or bank OTP. Those stay on the licensed payment partner’s page, even if you save a method for later.
• The text of your password or one-time code.
• A Facebook access token after sign-in, or any Apple sign-in data. Apple sign-in is not offered.
• Aadhaar number, contacts, photos, camera or microphone recordings.
• Your live location, unless you save an address or ask for a serviceability check.
• An analytics profile when you reject analytics.
• Uploaded identity-document images. Seller review uses the GSTIN, PAN and bank details above, not a document scan store.
• The shopping cart, until you place an order.

4. Who receives data

We do not sell personal data. For a given order we share the delivery name, address, phone and items with that order’s seller, and the handover details with the assigned rider. If you request an AMC repair, the service centre named in the acknowledgement receives the order number, product, fault description, serial or IMEI, and photographs you sent. The licensed payment partner receives the amount and order reference when you pay online. If you ask to save a payment method, that partner also receives your name and mobile or email so it can keep the reference. Brevo receives the email address and the one-time code when email codes are switched on. When phone codes are switched on through an Android SMS gateway, that phone receives the mobile number and the code so it can send the text. When Firebase phone sign-in is switched on, Firebase Authentication receives the mobile number so it can text the code. We keep the verified mobile number and do not store the text message. If this browser already allows notifications, Firebase Cloud Messaging receives a token so it can deliver an order notice. Google or Facebook receive the sign-in only if you use their button. Cloudflare Turnstile receives a bot-check token only when that check is switched on. Google Analytics receives visit data only after you allow analytics. We share data with authorities when the law requires it.

Google, Facebook, Firebase, Brevo, Cloudflare and Google Analytics may process data outside India under their own terms. The licensed payment partner processes payments in India.

5. How long it is kept

• One-time code hashes: about five minutes, or until used or locked after five wrong attempts.
• Access cookie: about 15 minutes. Refresh session: up to 30 days, or until you sign out or delete the account.
• Cart in the browser: until you change it, clear site data, or the browser drops it.
• Account and address: until you delete the account, except records we must keep.
• Orders, invoices, payment references, the AMC choice and fee, and seller tax fields: for the period required by Indian tax law, including GST records, which can be up to eight years, and for unresolved disputes. An AMC repair email is kept with that order correspondence for the same period.
• A saved payment method: until you remove it or delete the account.

6. Your choices

You can refuse analytics and still shop. You can withhold browser location and type an address instead. You can leave the save-payment box unticked and still pay. You can leave the AMC box unticked and still buy the product. You can ask [email protected] for access, correction or deletion. Deletion works as described in the Terms: profile and address contact fields are erased, saved payment methods are removed, social links are removed, and sessions are revoked. Tax and order records can remain where the law requires them.

7. Children

Volt_Tronic is for people who can enter a contract to buy goods in India. Do not create an account for a child or send someone else’s data without authority.

8. Security

Sign-in cookies are HttpOnly. Passwords and one-time codes are stored only as hashes. Seller bank account numbers are encrypted. Requests are rate-limited. No online service can promise that storage is immune to every attack. Write to [email protected] if you believe an account is being misused.

9. Changes and complaints

Material changes will be published on this page with a new version and date. The version you accept is stored with your account. Grievance Officer: [name], [postal address], [email protected], phone [number]. You may also use the National Consumer Helpline at 1915.

10. Contact