Privacy Policy

1. Scope and roles

• This policy applies to Duitho websites, public shop pages, demos, dashboards, order and appointment flows, support, and related services.
• Duitho operates the platform.
• A shop owner decides what customer information the shop collects and is responsible for its shop-specific privacy notices and lawful use.
• For that shop information, Duitho generally acts as the owner’s service provider or processor.

2. Information you provide

We may collect account name, email, phone number, one-time-login details, shop name, category, address, city, state, pincode, hours, products, services, prices, GST information, UPI ID, delivery notes, customer names, contact details, order lines, booking details, payment status, cancellations, support messages, and other information you choose to enter.

3. Information collected automatically

We may record IP address, browser and device type, operating system, language, approximate location derived from technical data, pages visited, timestamps, referring page, error logs, security events, and product interaction events. We use these records for authentication, fraud prevention, reliability, diagnostics, and aggregate improvement; they are not used to create a public shop profile.

4. Purposes and legal basis

We process information to provide requested services, authenticate users, create and display shops, process orders and bookings, send status messages, generate invoices, support WhatsApp or UPI hand-offs, provide support, secure the platform, prevent abuse, improve features, comply with legal obligations, and protect rights. Where consent is required, we will request it and allow withdrawal where applicable.

5. Public and private information

• Owners choose which shop name, category, address, contact details, hours, catalog, services, prices, and link appear publicly.
• A privacy-safe link can use a unique store ID instead of a phone number.
• Dashboard data, customer contact details, internal notes, UPI settings, and order details are not intended to be public unless a user deliberately shares them or disclosure is required by law.

6. Shop-owner obligations

Owners must collect only necessary customer information, provide appropriate notices, use it for legitimate shop purposes, keep access secure, honour applicable access or deletion requests, and avoid exporting or sharing it unnecessarily. Duitho may assist with owner instructions but does not take responsibility for a shop’s independent privacy practices.

7. Orders, bookings, payments and WhatsApp

• We share relevant information with the shop and customer to complete an order or booking and may open WhatsApp, email, UPI, or another payment app when a user chooses that action.
• External providers process information under their own terms.
• Duitho does not request or store UPI PINs, card PINs, banking passwords, or payment credentials.

8. Cookies and local storage

• Essential cookies, session storage, and local storage may support login sessions, language, theme, security, and core product operation.
• Analytics cookies (Google Analytics) load only if you choose “Accept analytics” in the cookie banner; choosing “Essential only” keeps them off.
• To change your choice, clear this site's data in your browser and the banner will appear again.
• Disabling essential storage can prevent login or parts of the service from working.

9. Service providers and disclosures

• We may use hosting, database, authentication, email, messaging, monitoring, analytics, security, and support providers under confidentiality and security obligations.
• We may disclose information to the relevant shop or customer, professional advisers, an acquirer or successor, or authorities where needed for law, court process, safety, fraud prevention, or a valid request.
• We do not sell personal information or share it for unrelated advertising.

10. Security and incident response

• We use access controls, scoped shop permissions, authenticated sessions, encrypted connections, logging, least-privilege service access, backups, and operational safeguards appropriate to the risk.
• No service is risk-free.
• We investigate suspected incidents, contain access where practical, preserve evidence, and provide notices when required by applicable law.
• Report suspected compromise to support@duitho.in.

11. Retention and deletion

• We retain information for service delivery, order and accounting records, dispute resolution, abuse prevention, security, legal compliance, and enforcement.
• When no longer needed, information is deleted, anonymised, or securely isolated.
• Backups and legally required records may remain for a limited period.
• Account closure does not automatically erase records that a shop must retain or information needed for another person’s transaction.

12. Rights and requests

• Subject to applicable law, you may request access to information about processing, correction, erasure, consent withdrawal, nomination, or grievance handling through our privacy request centre or by emailing support@duitho.in.
• We verify identity before disclosure or changes and coordinate shop-specific requests with the relevant shop.
• Our target response is 30 days; grievance responses must not exceed 90 days.
• If unresolved after our grievance process, you may approach the Data Protection Board through its official complaint mechanism when available.

13. Children and sensitive data

• For users under 18, verified consent from a parent or lawful guardian is required before processing the child’s personal data, unless an applicable legal exemption permits it.
• Parents can start verification through our privacy request centre or support@duitho.in; do not submit a child’s details until verification and consent are complete.
• A parent may instead place an order using the parent’s own details.
• Do not enter health, biometric, financial-account credentials, government ID, or other sensitive information into general forms or privacy requests.
• Shop owners must apply extra safeguards where their sector requires them.

14. International processing

• Service providers may process information in countries different from where a user lives.
• You can request information about processing locations and recipients through our privacy request centre or support@duitho.in.
• Applicable restrictions on international transfers must be observed by Duitho and its processors.

15. Changes and contact

• We may update this policy when the product, processing, or law changes.
• The latest version and effective date appear on this page.
• For privacy questions, requests, or security concerns, email support@duitho.in.