Privacy Policy

1. About this policy

Probin Johori, trading as Lotly Market, India (“Lotly”, “we”, “us”), runs the Lotly Market marketplace at lotlymarket.com. This policy explains what we collect about you, why, who we share it with and what you can ask us to do with it. It applies to everyone who uses the Platform: buyers, brands and visitors. Our Terms of Use go with it.

2. What we collect

• Your account: your mobile number (you sign in with a code we text to it), and your name, email address and photo if you add them.
• Your orders: what you ordered, the delivery name, address and phone number you give (shared with the brand that ships to you), how you paid (the UPI id, or the card type and its last four digits, and the bank reference, visible only to you and to Lotly), any coupon you used, and the texts and emails we sent you about the order.
• A brand’s business details: the business name, legal status, GSTIN and PAN, city and address, documents uploaded for verification, a contact email and WhatsApp number for buyers, and the bank account holder, number and IFSC for payouts. Bank details are kept apart from the rest and shown to our team masked.
• Listings: descriptions, photographs, prices and everything else a brand puts on a product page.
• How you use the site: the pages you open and when, what you search for and the products you view or save, and where you came from. We also record your device type, browser and operating system, and the approximate city your network is in, worked out from your IP address, which we do not keep. This is recorded whether or not you are signed in: a visitor who is not signed in is a random number kept in the browser, and for someone signed in it is tied to their account. Brands see views and saves of their own products as counts, never who you are. Our team can see who is on the site at a given moment, the pages in each visit, and what people search for. An email address or phone number typed into search is not kept.
• Technical data: IP address, browser and operating system, collected automatically by our hosting.

3. Why we use it

• To run the marketplace: show listings, take payment, pass your delivery details to the brand, and pay the brand.
• To keep you informed: sign-in codes, order confirmations, shipping and delivery updates, refunds and payouts, by text and email. These are part of the service, not marketing.
• To review and verify brands before they can sell.
• To give brands insights about their own products (views, saves, enquiries, sales) as numbers, without identifying buyers.
• To find and stop fraud, abuse and breaches of our Terms of Use.
• To meet Indian law and answer lawful requests from authorities.
• To improve the Platform, using usage data in aggregate.

We do not sell your personal data. We do not send marketing without your consent. A brand may text you a coupon only if you have bought from it before, and only within limits we enforce.

4. What is public

• A brand’s name, city, verification status, storefront, contact email and WhatsApp number (so buyers can ask questions) are public.
• Listings, photographs, prices and delivery details are public.
• A buyer’s name, phone number, address, orders and payment details are never public. A brand sees the delivery details of its own orders only.
• A brand’s GSTIN, PAN, documents and bank details are never public; our team sees them only to verify the brand and pay it.

5. Who processes it for us

• Supabase: our database, sign-in and file storage, hosted in Mumbai, India.
• Razorpay: payments, refunds and payouts to brands. Razorpay sees your card, UPI or bank details to take the payment; we keep only the UPI id or card type and last four digits, and the payment reference, for your order page.
• Twilio: the text messages we send to your sign-in number.
• Resend: the emails we send.
• Vercel: hosting, request logs, and privacy-preserving page analytics that store no personal identifiers.
• Anthropic: we send a listing’s own text, never your account details, to write short product insights and drafts for brands.

We use no advertising trackers, third-party cookies or social media pixels.

6. How long we keep it

We keep your account, listings and orders for as long as your account is active. You can delete your account from Settings; we then remove your personal details within 7 working days, except for order and payment records we must keep under Indian tax, company and payment rules. Deleting is refused while one of your orders is on its way. The orders that remain after deletion lose your address and payment details. Records of visits, the pages opened in them and what was searched for are kept for 30 days. Anonymised usage data may be kept for analysis.

7. Cookies and local storage

The Platform uses session cookies and browser storage to keep you signed in and to remember your preferences, such as saved products, filters and whether you were last buying or selling, and a random visitor number that joins up the pages of one visit. These are needed for the Platform to work. We use no advertising or cross-site tracking cookies. Clearing them in your browser signs you out and resets your preferences.

8. Your rights

Under the Digital Personal Data Protection Act, 2023 and other Indian law you can:

• Access: ask for a copy of the personal data we hold about you. Settings has a download of your data.
• Correct: fix anything inaccurate or incomplete, from Profile or by writing to us.
• Delete: delete your account from Settings, subject to the records we must keep.
• Withdraw consent: where we rely on your consent, withdraw it at any time by writing to us. This does not undo processing already done.
• Nominate: name someone to exercise these rights for you if you are unable to.

Write to hello@lotlymarket.com. We reply within 30 days. If you are unhappy with our answer, you may complain to the Data Protection Board of India.

9. Security

Data travels over HTTPS. Our database enforces row-level access, so a person reads only their own records and a brand only its own orders; bank details and how a buyer paid are kept in separate, more tightly held tables. Our team’s access to sensitive data is limited and logged. No system is perfectly secure: if you find a vulnerability or think your account was used by someone else, tell us at hello@lotlymarket.com.

10. Children

Lotly Market is for adults. You must be 18 or over to buy or sell, and we do not knowingly collect personal data from anyone under 18. If you think a child has given us data, write to hello@lotlymarket.com and we will delete it.

11. Changes to this policy

We may update this policy as our practices, the law or the Platform change. The effective date at the top is updated when we do, and for material changes we tell you by email or an in-app notification before they apply.

12. Contact and grievance officer