Privacy Policy

1. Who we are

ShopyCart (shopycart.in) is an order-management and shipping application for online sellers. It is operated by Raj Computers Ltd, Vardhaman Chambers, 2nd Floor, Room No. 210, Kalyan Street, Dana Bunder, Mumbai 400009, India ("we", "us"). Contact: support@shopycart.in.

For data that sellers bring into ShopyCart (their orders and their buyers' details), the seller is the controller and we act as their processor: we handle that data only to provide ShopyCart to them and on their instructions. For our own account and website data, we are the controller.

2. Data we collect

2.1 From marketplaces, with the seller's authorisation

When a seller connects an Amazon, eBay or Etsy account, the marketplace gives us access through its official API under the seller's explicit authorisation. We request only what is needed to fulfil orders:

• Order details: order number, date, status, items, SKUs, quantities, prices, shipping service and channel.
• Buyer delivery details (personal data): the recipient's name, delivery address, and, where the marketplace provides them for delivery, phone number and email address. Billing details where provided.
• Seller account identifiers: seller/merchant ID, marketplace ID and the access and refresh tokens that let ShopyCart read orders and confirm shipments.

2.2 From ShopyCart users

• Account details: username, name, email, phone (optional), organisation, role and a password (stored only as a salted hash; we can never see it).
• Business details the organisation enters in Settings (business name, contact details, address).
• Carrier credentials a user saves to create shipping labels (for example a Royal Mail Click & Drop API key).

2.3 Collected automatically

• Technical logs: the date, time and address of requests, pages used and errors, used to run and secure the service (see section 8).
• Activity history: which user changed an order (for example a status change) so teams can see who did what.

We do not collect payment card or bank details, and we do not buy data about buyers or sellers from anyone.

3. How we use data

We use data only to provide ShopyCart's features to the seller who authorised it:

• showing and managing orders, picking lists and stock;
• creating shipping labels and manifests with the seller's chosen carrier, and sending tracking information back to the marketplace;
• account sign-in, team management, notifications and the seller's own daily summary email;
• keeping the service secure, fixing errors and meeting legal obligations.

Amazon data (any data received through the Amazon Selling Partner API) is used only to fulfil orders and provide these features to the authorising seller, in line with Amazon's Acceptable Use and Data Protection Policies. We never use buyer data for marketing, advertising, profiling, contacting buyers outside of order fulfilment, or building datasets, and we never sell or rent any data.

4. How we store data

• Data is stored in a database on access-controlled servers. The application runs in isolated containers; database and server access is limited to named administrators of Raj Computers Ltd who need it to operate the service.
• All traffic between your browser and ShopyCart is encrypted with HTTPS (TLS). Connections to marketplace and carrier APIs also use HTTPS.
• Each organisation's data is kept separate: users can only see their own organisation's orders, and access within an organisation is limited by role (admin, manager, staff, read-only).
• User passwords are stored only as salted hashes.

5. Security and incident response

We protect data with role-based access, HTTPS, isolated application containers, automatic error alerting, and by keeping personal data out of logs and error reports. Access for staff who leave is removed immediately.

If something goes wrong

If we detect or suspect a security incident affecting personal data (for example unauthorised access, a database breach or a data leak), we will:

1. Contain it: cut off the affected access, rotate credentials and tokens, and stop the cause.
2. Notify Amazon within 24 hours of detection at security@amazon.com when Amazon data may be involved, and notify eBay or Etsy under their own requirements when their data is involved.
3. Notify affected sellers without undue delay, explaining what happened, what data was affected and what they should do; and notify regulators and individuals where the law requires.
4. Investigate and fix: find the root cause, repair it, check for similar issues, and record what was done.

To report a security problem, email support@shopycart.in with "Security" in the subject.

6. Who we share data with

We share data only where needed to provide the service the seller asked for:

We do not share data with anyone else, and we do not delegate access to Amazon personal data to other developers' applications. Some of these providers may process data outside India or the UK; where they do, we rely on their contractual and legal safeguards.

7. Retention and deletion

Closing an account: email support@shopycart.in and we will delete the organisation's data, including all orders and tokens, within 30 days, unless the law requires us to keep something for longer (we will tell you if so). Deleted data is removed from the database and cannot be recovered.

8. Logs and monitoring

• We log requests and errors to run and secure the service and to spot misuse (for example repeated failed sign-ins or unusual access).
• We do not store buyer personal data in logs. Names, addresses, phone numbers, emails, access tokens and API keys are masked before anything is written.
• Errors raise an automatic alert to our team so problems are investigated quickly.
• Logs are kept for 5 days and then deleted automatically.

9. Your rights

You can ask to see, correct, export or delete personal data we hold about you, or object to how we use it, by emailing support@shopycart.in. We reply within 30 days. If you are a buyer who ordered from a seller using ShopyCart, the seller controls your data; we will pass your request to them and help them answer it. You may also complain to your local data protection authority.

10. Cookies

ShopyCart uses only essential cookies: one to keep you signed in and one to protect forms against forgery (CSRF). We do not use advertising or tracking cookies.

11. Changes and contact

If we change this policy we will update the date at the top, and for significant changes we will tell account holders by email before they take effect. Questions: support@shopycart.in, or write to Raj Computers Ltd at the address in section 1.