Privacy Policy

1. What Personal Data We Collect and Why

We collect only the personal data needed to run our store and serve your orders. We do not collect or store your payment card numbers, UPI PINs, or payment credentials — payments are processed entirely on the payment gateway’s own page. The categories of data we process are:

• Account and profile data — When you sign in with Google, we receive your name, email address and profile photo. When you complete your shop profile, you may provide a phone number, shop name, shop address (address lines, pincode, city, state) and optional photos of yourself and your shop. Purpose: to identify you, verify your account, decide your customer category and pricing, and send order updates.
• Delivery and saved-address data — Name, phone number, email and delivery address (address lines, landmark, city, state, pincode, country). If you allow your browser’s location, we also use your approximate location to calculate delivery charges and pre-fill your address. Purpose: to deliver your orders and remember addresses for future orders.
• Order and transaction data — The items you buy, quantities, prices, discounts, taxes, delivery charges, payment method (COD or online payment), payment status and transaction reference. Purpose: to process, fulfil and invoice your orders, and to reconcile payments.
• Payment-related data shared with the gateway — When you pay online, we share your name, phone number, email and order reference with the payment gateway to initiate the transaction. The gateway (and not us) handles your payment details. Purpose: to collect payment for your order.
• Business/ledger data (for business customers) — For wholesale and business customers, our team may maintain a customer ledger containing tax and accounting identifiers such as GSTIN, PAN, and bank account details, along with credit terms and contact-person details. This data is entered by our team to issue compliant invoices and manage credit, and is never collected through the public storefront.
• Technical and usage data — We use PostHog analytics, which records page views, product views, add-to-cart and checkout events, your approximate location/IP-derived region, device/browser type, and identifiers such as a visitor ID, and (when you are signed in) links these analytics to your account so we can understand buying behaviour. Purpose: to improve our website, products and customer experience.
• Communications data — Email address and phone number used to send you transactional emails (order confirmation, payment status, invoice) and, if you subscribe, web-push notifications about order status and, with your consent, offers and reorder reminders. Purpose: order communication and (opt-in only) marketing.

2. How We Use Your Data

We process personal data only for the specific purposes it was collected for:

• To create and manage your account, and determine your customer category and pricing.
• To process, fulfil, deliver and invoice your orders.
• To collect payments (via the payment gateway) and manage COD amounts.
• To send transactional emails and web-push notifications about your orders.
• To send marketing communications (offers, reminders) — only with your explicit consent, which you can withdraw any time.
• To improve our website, catalogue and services through analytics.
• To comply with tax, accounting, legal and regulatory obligations, and to respond to lawful requests from authorities.
• To prevent fraud, misuse and security incidents.

We do not sell, rent, trade or otherwise monetise your personal data.

3. With Whom We Share Data

We share personal data only with the service providers needed to operate the store, and only to the extent necessary:

• Payment gateway (Paytm / One97 Communications): receives your name, phone number, email and order reference to process online payments. We also receive back transaction status and reference details.
• Hosting and database (Supabase; Cloudflare): your account, profile, orders, photos and other records are stored in our database and served through our hosting providers.
• Analytics (PostHog): receives usage and, when you are signed in, profile data to provide analytics (see Section 6 for cross-border note).
• Email (via our hosting provider): transactional emails are sent through our email service.
• Sign-in (Google): you authenticate via Google; we receive your name, email and photo from Google according to your Google account settings.
• Location/pincode lookup (OpenStreetMap; India Post API): when you use location-based delivery estimation, only the anonymous location or pincode you provide is sent to these services for lookup — no personal identifiers.
• Legal and regulatory bodies: if required by law, court order or a lawful request from a government authority.

Each service provider is bound to process data only for our purposes and to protect it. We never authorise any provider to use your data for its own purposes.

4. Legal Basis for Processing

We process your personal data on one or more of these lawful bases:

• Your consent — given when you sign in, place an order, or opt in to marketing.
• Legitimate uses under the DPDP Act — such as processing necessary for the fulfilment of a contract/order, to provide you a requested service, to respond to your requests, and to comply with legal obligations.

5. Your Consent and Withdrawal

Your consent is free, specific, informed and unambiguous, and is taken through a clear affirmative action (e.g. signing in or placing an order).

You may withdraw your consent at any time by:

• Emailing us at admin@ambaautoagency.com or calling 9157228672; or
• Unsubscribing from marketing communications using the link in any marketing email or by disabling notifications in your browser/app.

Withdrawal does not affect the lawfulness of processing before withdrawal, and we may continue to process data where we are required or permitted to do so by law (for example, tax records). We will erase your personal data once the purpose is no longer served, subject to legal retention requirements (Section 7).

6. Transfer of Data Outside India

Some of our service providers may process data from locations outside India:

• PostHog analytics is hosted on cloud infrastructure in the United States. When you use the site, analytics data (including, for signed-in users, profile data) may be transferred to and processed in the US for the purpose of analytics as described in this policy.
• Our hosting providers may store and serve data through data centres located in India or other jurisdictions as applicable.

Such transfers are made in accordance with Section 16 of the DPDP Act and the applicable rules, and we will only transfer personal data to countries that have been notified by the Government of India as permissible, or under a contract that ensures an equivalent level of protection. By using the website and providing your consent, you consent to these transfers for the purposes described in this policy.

7. How Long We Keep Your Data

We keep personal data only as long as needed for the purpose for which it was collected, plus any legally required retention period:

• Account and profile data: kept while your account is active. In line with the DPDP Rules, if you do not contact us or use your account for a continuous period of three (3) years, we will treat the purpose as no longer served and erase the data, after giving you at least 48 hours’ notice so you can tell us you want to keep it.
• Order, invoice and financial data: retained for the period required under applicable tax and accounting laws (including GST invoice retention requirements), and for resolving disputes.
• Logs and processing records: retained for at least one (1) year in accordance with the Seventh Schedule of the DPDP Rules, then erased unless a longer period is required by law.
• Payment transaction data: kept for reconciliation, dispute resolution and fraud prevention for a reasonable period.
• Marketing data: kept until you withdraw consent or unsubscribe, whichever is earlier.

When we no longer need your data, we erase or anonymise it securely.

8. How We Protect Your Data

We implement reasonable security safeguards as required under Section 8 of the DPDP Act and Rule 6 of the DPDP Rules, including:

• Encryption of data in transit (HTTPS) across the website.
• Role-based access controls — only authorised staff can view customer details and financial/ledger records.
• Row-level security on the database so you can only access your own data.
• Secure storage of account credentials (via Google and Supabase authentication) — passwords are never stored by us in plain text.
• No storage of card numbers or payment credentials on our systems.
• Access logging and monitoring of the systems that process personal data.

No method of transmission or storage is 100% secure. In the event of a personal data breach, we will notify the Data Protection Board of India and affected individuals without delay, and in any event within 72 hours of becoming aware, as required under the DPDP Rules, describing the nature, likely impact and the measures taken.

9. Cookies and Similar Technologies

We use the following cookies and local storage:

• Authentication cookies (Supabase): required to keep you signed in. These are essential for the website to function.
• Analytics cookies (PostHog): used to understand how visitors use the site (pages viewed, products viewed, cart/checkout events) so we can improve it. These are not used to show you ads.
• Local storage: we store your cart contents, a session identifier, and (while signed in) a cached copy of your profile on your device for a smooth experience.

You can disable or clear cookies and local storage in your browser settings. Disabling essential authentication cookies will prevent you from signing in; disabling analytics cookies does not affect core functionality.

10. Your Rights as a Data Principal

Under the DPDP Act, you have the following rights, which you can exercise by writing to us at admin@ambaautoagency.com or calling 9157228672:

• Right to access: ask us to confirm whether we process your personal data and receive a summary of the personal data we hold and how it is processed.
• Right to correction: ask us to correct or update inaccurate or incomplete personal data (you can also update most profile details yourself in your account).
• Right to erasure: ask us to erase your personal data when the purpose for processing it is no longer being served and retention is not required by law.
• Right to grievance redressal: lodge a grievance with us and receive a response within the timeline published in Section 11.
• Right to nominate: nominate another individual who may exercise your rights on your behalf in the event of your death or incapacity.
• Right to withdraw consent: as described in Section 5.

If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India through the online platform made available by the Board. Please note we may ask you to verify your identity (and your entitlement to make a request) before acting on it, to protect your data from unauthorised access.

11. Grievance Redressal and Contact

In accordance with Rule 14 of the DPDP Rules, we have a grievance redressal system. We aim to respond to all grievances and data-rights requests within 30 days, and in any case within the maximum of 90 days permitted under the DPDP Rules. For any questions about this policy, your data, or to exercise any of your rights, contact our designated grievance officer:

You may also file a complaint directly with the Data Protection Board of India.

12. Children

Our website and services are intended for business and adult users (shop owners, mechanics, wholesalers and retailers) and are not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us so we can delete it, and we will obtain verifiable parental consent before processing any data of a child where required by the DPDP Act.

13. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or the law. The “Last updated” date at the top of this page shows the latest revision. For material changes, we will notify you through the website or by email where required. Continued use of the website after a change indicates acceptance of the revised policy.