Privacy policy

In short: This policy explains how SKS Advertizing Private Limited handles personal data on Remavio. It is written for merchants.

1.1 SKS Advertizing Private Limited (CIN U72200DL2022PTC393183), having its registered office at P. No. 310, Block No. 9, Sundar Vihar, Paschim Vihar-I, Delhi 110087, India (the "Company", "we" or "us"), is the Data Fiduciary, within the meaning of the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), in respect of the personal data described in clause 2.1 as Merchant Data.

1.2 This policy applies to the Remavio website, the signup flow and the merchant admin panel (the "Services"). It forms part of the Terms of Service at /terms, and expressions defined there have the same meaning here.

1.3 This policy is addressed to Merchants. A person who purchases from a Store hosted on the Platform should read the privacy policy published by that Store: the Merchant, and not the Company, determines the purposes for which that person's data is used.

In short: Data about you and your business is Merchant Data and we decide how it is handled. Data about your customers is Store Data and you decide; we only process it for you.

2.1 "Merchant Data" means personal data of the Merchant and its Staff Users that we collect through the Services, being the account created with us and the record of sums paid to us. For Merchant Data the Company determines the purpose and means of processing, and this policy governs it.

2.2 "Store Data" means personal data of a Merchant's customers and other persons that flows through a Store, including customer records, orders and addresses. For Store Data the Merchant is the Data Fiduciary and the Company is a Data Processor, acting only on the Merchant's instructions as expressed through its use of the Services.

2.3 We do not sell Store Data, use it to profile individuals, or use it to market anything of our own.

In short: Your account, store and billing details, technical logs and support emails.

3.1 We collect the following Merchant Data:

• Account details: your name, email address, phone number, password (stored only as a strong one-way hash) and the Staff Users you invite.
• Store details: the store name, subdomain and settings you configure.
• Billing records: what you purchased, when, the amount, the payment gateway's reference and the invoice we issued.
• Technical logs: IP address, browser, pages requested and errors, retained to keep the Services secure and working.
• Support correspondence: what you write to us and our replies.

3.2 We do not see or store card numbers, card verification values, UPI PINs or bank credentials, whether yours or those of your customers. Payments are taken on the payment provider's own systems, and we retain only the reference and the amount.

In short: We use your data to run your account, bill you, keep the platform secure and send service messages. We do not run advertising profiles.

4.1 We process Merchant Data on the basis of the consent you give when you create an account, and, where applicable, for the legitimate uses recognised by section 7 of the DPDP Act, including the purpose for which you voluntarily provided the data and compliance with law. The purposes are:

• to provide the Services you have requested and administer your account;
• to bill you and issue invoices, and to comply with tax and other law;
• to secure accounts, detect abuse and investigate incidents; and
• to send service messages such as expiry reminders and security notices, which form part of the Services and cannot be switched off while your account is open.

4.2 We do not run advertising profiles and do not sell personal data. You may withdraw consent at any time by writing to us as described in clause 10; withdrawal may mean that we can no longer provide the Services, and does not affect processing already carried out.

In short: Only cookies the site needs to work. No advertising or cross-site tracking.

5.1 The admin panel sets a session cookie to keep you signed in and a preference cookie for your light or dark theme. A Store sets a cart and session cookie for its shoppers. Each is necessary for the function you have requested. This website sets no third-party advertising or cross-site tracking cookie.

In short: A small number of providers help us run the platform, each with only the access its job needs. We disclose data to others only when the law requires.

6.1 We engage service providers (Data Processors) to run the Services, each with access limited to what its function requires: our hosting provider in India (application servers and database); Cloudflare (network security, content delivery and file storage); Amazon Web Services (transactional email); Sentry (error monitoring); and Cashfree (payments for your plan).

6.2 We disclose personal data to any other person only where the law requires, or in response to a lawful order or request of a court or competent authority, and shall tell you of it where we are permitted to.

In short: Your account and store data sit on servers we operate in India. A few providers handle some data abroad.

7.1 Your account data and Store Data are stored on servers we operate in India.

7.2 Certain providers process data outside India to perform their function: Amazon Web Services delivers email from Australia; Sentry processes error reports in the United States; and Cloudflare stores files in the Asia-Pacific region and serves them from its global network. Such transfers are made in accordance with section 16 of the DPDP Act and any restriction notified under it.

In short: We keep your data while your store exists and for one year after you close it, then delete it. Invoices are kept as long as tax law requires.

8.1 Account data and Store Data are retained while your Store exists. On closure we retain them for one year and then delete them permanently, together with database records, uploaded files and search indexes.

8.2 Invoices and records of payments made to us are retained for as long as tax or other law requires, notwithstanding deletion of the Store. We may also retain data that is subject to a legal hold or that we need to establish or defend a legal claim.

In short: Encryption, hashed passwords, strict separation between stores and an audit log of sensitive changes.

9.1 We maintain reasonable security safeguards to protect personal data, including:

• encryption of traffic in transit, and one-way hashing of passwords so that they are never held in readable form;
• strict per-store data isolation, so that one Store's queries cannot reach another Store's records, enforced by the application and backed by row-level security rules in the database itself;
• an audit log recording who made each sensitive change in the admin panel, and when; and
• encrypted storage of the provider credentials you enter, such as gateway keys and courier tokens.

9.2 In the event of a personal data breach we shall give intimation to the Data Protection Board of India and to affected persons in the manner and within the time that the DPDP Act and the rules made under it prescribe, and shall notify the Merchant of any breach affecting Store Data without undue delay.

In short: You may ask what data we hold, correct it, erase it, nominate someone to act for you, or complain.

10.1 Under the DPDP Act you have the right to obtain a summary of the personal data we process and the processing activities, to require correction, completion or updating of it, to require its erasure, to seek grievance redressal, and to nominate another person to exercise these rights in the event of your death or incapacity. Subject to clause 8.2, we shall act on a valid request within the time the Act and its rules allow.

10.2 Much of this you can do yourself: the admin panel exports your products, orders and customers at any time, including while a Store is paused. For anything else, write to support@remavio.in from the email address registered on the account. We may require you to verify your identity before acting.

10.3 A person whose data is held as Store Data should address a request to the Merchant that operates the Store.

In short: The platform is a business tool for adults.

11.1 The Services are a business tool and are not intended for any person under eighteen years of age. We do not knowingly collect the personal data of a child, and shall delete it on becoming aware of it.

In short: Complaints go to our Grievance Officer. We post any change here and notify material changes in the admin panel.

12.1 Our Grievance Officer, appointed under the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, is named at /grievance, together with a postal address and the period within which each kind of complaint is acknowledged and resolved. The same officer handles complaints concerning personal data and complaints of unlawful content on a Store we host.

12.2 If you are dissatisfied with how we have handled your data you may also write to support@remavio.in. Where a complaint is not resolved to your satisfaction you may approach the Data Protection Board of India, as the DPDP Act provides.

12.3 We may revise this policy from time to time. A revision is posted on this page with its effective date, and a material change is also notified in the admin panel before it takes effect.