Privacy Policy

Last updated: August 2026 · Effective: August 2026

Raftoo ("we", "our", "us") is committed to protecting the personal and business data of all users of our platform. This Privacy Policy explains what data we collect, how we use it, who we share it with, and your rights under applicable law — including India's Digital Personal Data Protection Act, 2023 ("DPDP Act").

By registering or using the Platform you consent to the collection and use of data as described in this policy.

1. Data We Collect

Category	Data points	Why we collect it
Account data	Name, email address, phone number, password (hashed)	Account creation and authentication
Business identity (sellers)	Firm name, GSTIN, ownership type, city, state, PAN (via GSTIN), bank account & IFSC	Seller KYC, GST compliance, platform fee payout
Transaction data	Order ID, products, quantities, amounts, payment references, delivery addresses	Order fulfilment, invoicing, dispute resolution
Communications	RFQ messages, quotation responses, dispute descriptions	Platform operations and dispute resolution
Usage data	IP address, browser type, pages visited, timestamps	Security, fraud prevention, analytics
Uploaded files	Product images, transport/delivery receipts	Product listings and proof of delivery

2. How We Use Your Data

To provide and operate the Platform (order management, payments, notifications).
To verify business identity and comply with GST and other statutory requirements.
To process payments via Cashfree Payments and send transaction receipts.
To send transactional communications via email (Resend), WhatsApp and SMS (MSG91) — such as OTPs, order confirmations, and shipping updates.
To resolve disputes between buyers and sellers.
To detect and prevent fraud or abuse.
To improve the Platform through anonymised usage analytics.
To comply with applicable legal obligations.

We do not use your data for unsolicited marketing without your explicit consent.

3. Third-Party Service Providers

We share data with the following trusted service providers solely for the purposes described:

Provider	Purpose	Data shared
Cashfree Payments	Payment processing & GSTIN verification	Order amount, GSTIN, payment details
MSG91	WhatsApp & SMS OTP delivery	Phone number, OTP
Resend	Transactional email	Email address, order details
Cloudflare R2	File/image storage	Product images, delivery receipts
Porter	Logistics & delivery booking	Pickup/delivery address, order details

We do not sell your personal data to third parties. We do not share your data with advertisers.

4. Data Retention

We retain account data for as long as your account is active. Transaction records are retained for a minimum of 7 years to comply with GST and accounting regulations. You may request deletion of your account and non-statutory data by contacting us at privacy@raftoo.com.

5. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

HTTPS encryption for all data in transit.
Bcrypt hashing for passwords — we never store passwords in plain text.
JWT-based session tokens with expiry.
Role-based access controls — seller data is only visible to that seller and admins.
Signed, expiring URLs for file access from cloud storage.

Despite these measures, no system is completely secure. We cannot guarantee absolute security of your data.

6. Cookies

We use localStorage (not third-party tracking cookies) to store your session token and cart data locally on your device. We do not use advertising trackers or cross-site cookies. You may clear your browser's localStorage at any time to log out.

7. Your Rights (DPDP Act 2023)

Under India's Digital Personal Data Protection Act, 2023, you have the following rights:

Right to access — Request a summary of the personal data we hold about you.
Right to correction — Request correction of inaccurate or incomplete data.
Right to erasure — Request deletion of your data, subject to legal retention obligations.
Right to grievance redressal — File a complaint with our Grievance Officer if you believe your rights have been violated.
Right to nominate — Nominate another person to exercise rights on your behalf in case of death or incapacity.

To exercise any of these rights, email us at privacy@raftoo.com with your registered email address and a description of your request. We will respond within 30 days.

8. Grievance Officer

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, our Grievance Officer can be contacted at:

Email: grievance@raftoo.com
Response time: Within 30 days of receipt of complaint

9. Children's Privacy

The Platform is intended for use by businesses and is not directed at individuals under the age of 18. We do not knowingly collect data from minors.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified to registered users via email at least 15 days before taking effect. Continued use of the Platform after the effective date constitutes your acceptance of the revised policy.

Terms & Conditions → Refund Policy → Contact Us →