01 Who We Are

We are the Data Fiduciary (under India's Digital Personal Data Protection Act, 2023) for personal data we collect about visitors, prospects, and account holders.

When we process personal data on behalf of our customers (e.g., end-customer order data flowing through the platform), we act as a Data Processor, governed by our Data Processing Addendum.

02 Information We Collect

2.1 Information You Give Us

• Account information: Name, email address, phone number, company name, role, business address, GSTIN
• Billing information: Payment method details (handled by our payment processors — we do not store full card numbers), billing address, invoices
• Communications: Messages, support tickets, demo requests, feedback

2.2 Information from Your Use of the Services

• Usage data: Pages visited, features used, clicks, session duration, error logs
• Device and log data: IP address, browser type, operating system, device identifiers, referring URLs, timestamps
• Cookies and similar technologies: See our Cookie Policy

2.3 Information from Third Parties

• Integration data: When you connect Shopify, WooCommerce, Amazon, Myntra, courier accounts, etc., we receive data from those platforms as authorized by you
• Marketing partners: Limited information from advertising and analytics providers

2.4 Customer Data (Processed on Your Behalf)

When you use the Services to run your e-commerce operations, the platform processes data about your end-customers — names, shipping addresses, contact details, order details, payment status, etc. This data is your data; we process it as your processor under the Data Processing Addendum.

03 How We Use Information

We use personal data to:

• Provide, operate, and maintain the Services
• Set up and manage your account, process payments, and issue invoices
• Authenticate users and prevent fraud or abuse
• Communicate service updates, security alerts, and administrative messages
• Provide customer support
• Improve, personalize, and develop new features
• Send marketing communications (where permitted by law, and you can opt out)
• Comply with legal obligations and enforce our Terms

Legal bases (DPDP Act 2023 and other applicable laws): consent, performance of a contract, compliance with law, and legitimate uses as permitted under applicable law.

04 How We Share Information

We do not sell your personal data. We share it only as described below:

• Service providers / sub-processors: Cloud hosting, analytics, customer support tools, payment processors, email and communication providers. A current list is available on request
• Integration partners: Marketplaces, couriers, and other platforms you connect to the Services, strictly to enable the integration you've authorized
• Legal and safety: When required by law, court order, or government request; to enforce our Terms; or to protect rights, safety, or property
• Business transfers: In connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality
• With your consent: For any other purpose disclosed to you

05 International Data Transfers

Cobay is based in India. Your information may be transferred to, stored, and processed by Cobay or its service providers in countries other than the one in which you reside. Where required, we use appropriate safeguards (such as standard contractual clauses or equivalent measures) for cross-border transfers.

06 Data Retention

We retain personal data for as long as your account is active or as needed to provide the Services, comply with our legal obligations (tax, accounting, dispute resolution), resolve disputes, and enforce agreements. When data is no longer needed, we delete or anonymize it.

07 Your Rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Erase your personal data (subject to legal retention requirements)
• Withdraw consent at any time, where processing is based on consent
• Nominate another individual to exercise your rights in the event of your death or incapacity (DPDP Act)
• Grievance redressal through our Grievance Officer (see Section 12)

To exercise any right, email privacy@cobay.com. We will respond within the timelines required by applicable law.

08 Security

We implement administrative, technical, and physical safeguards designed to protect personal data — including encryption in transit, access controls, monitoring, and secure development practices. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

If we become aware of a personal data breach affecting you, we will notify you and the relevant authorities as required by applicable law.

09 Cookies

We use cookies and similar technologies to operate and improve the Services. See our Cookie Policy for details and how to manage your preferences.

10 Children's Privacy

The Services are intended for businesses and are not directed to individuals under 18. We do not knowingly collect personal data from children. If you believe we have, contact us and we will delete it.

11 Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated by email or through the Services, and the "Last updated" date will be revised. Continued use after changes means you accept the updated Policy.

12 Grievance Officer (India)

In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023:

The Grievance Officer will acknowledge complaints within 24 hours and resolve them within 15 days of receipt.