Privacy Policy
Last updated: 25 September 2026
This policy explains what Qartlo collects when you use Qartlo, why, and what you can do about it. It covers two different groups of people, and the distinction matters:
- Merchants — people who run a store on Qartlo. We are the data controller for their data.
- Shoppers — people who buy from a merchant’s store. The merchant is the controller of that data; we process it on their behalf. For questions about a specific store’s data practices, contact that merchant.
What we collect
| Data | Why |
|---|---|
| Merchant account: name, email, phone, business details, GSTIN | To create and operate your account, invoice you, and meet tax obligations |
| Store content: products, images, prices, settings | To render your storefront |
| Shopper details: name, phone, email, delivery address | To place and fulfil orders on the merchant’s behalf |
| Order and payment records: amounts, status, gateway payment IDs | To process orders, reconcile payments, and handle refund disputes |
| Technical logs: IP address, request metadata, error reports | Security, rate limiting, fraud prevention, and debugging |
We do not collect or store card numbers, UPI PINs, or bank credentials. Payment details are entered directly with Razorpay, which is PCI-DSS compliant. We only ever see a payment identifier and a status.
How we use it
- To provide the Service and to fulfil orders placed through it.
- To take payment for subscriptions and to enforce plan limits.
- To keep the platform secure — rate limiting, abuse detection, and investigating suspicious payments.
- To respond to support requests.
- To send service messages (billing, security, downtime). Marketing email is separate and you can opt out of it.
We do not sell personal data, and we do not use shopper data to advertise to them.
Who we share it with
Only with processors needed to run the Service:
- Google Firebase / Google Cloud — hosting, database, authentication, and error reporting. Data is stored in the Mumbai (asia-south1) region.
- Razorpay — payment processing and subscription billing.
- Upstash — rate limiting counters (no personal data beyond a hashed request key).
- Law enforcement or regulators, where we are legally required to.
Where a merchant configures an outbound webhook to their own systems, order data is sent there at the merchant’s direction and under their responsibility.
How long we keep it
- Order and invoice records: as long as tax and accounting law requires.
- Merchant account data: for the life of the account, then up to 30 days after closure so you can export it.
- Technical logs: a rolling window, typically 30 days.
Security
- All traffic is served over HTTPS.
- Database access is governed by server-enforced security rules; collections holding orders and billing are writable only by our server, never directly by a browser.
- Secrets are held in a managed secret store, not in code.
- Payment webhooks are verified with a signature before they are acted on.
No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you and the relevant authority as required by law.
Your rights
You can ask us to access, correct, export, or delete your personal data, or to restrict how we use it. Write to support@qartlo.com and we will respond within 30 days.
If you are a shopper asking about data held by a particular store, we will pass your request to that merchant, who is the controller.
Cookies
We use cookies and similar browser storage to keep you signed in, remember a shopping cart, and hold interface preferences. We do not use third-party advertising cookies.
Children
The Service is not intended for children under 18, and we do not knowingly collect their data.
Grievance Officer
In accordance with the Information Technology Act, 2000 and the rules made under it, the grievance officer is:
Swarna Yeswanth Sai Pani Kumar Reddy
Qartlo
37-14/126, Annavarvarappadu 1st Line, Ongole, Prakasam District, Andhra Pradesh 523001, India
yeswanth.qartlo@gmail.com
Changes
We will post any update here and change the date above. Material changes will also be notified by email.