1. Who is responsible
TODO: your full legal name or business name, TODO: street address, city, state, PIN code, India, is the Data Fiduciary for personal data processed through AI-Mela. Contact: TODO: support@your-domain.in.
2. What we collect
When you sign in with Google: your name, email address, profile photo and a sign-in identifier from Google, handled through Supabase Auth. We do not receive your Google password or access your other Google data.
When you list a product: the product and business details you enter, including the business name, founder name, city, state and a GSTIN, CIN, LLPIN or DPIIT number. The registration number is used only for review and is never shown publicly.
When you pay: the amount, status and reference numbers of each payment. Card, UPI and bank details are handled by our payment partner and never reach us.
When anyone visits: when you click a listing’s link, we store a one-way hash of your IP address so the same visitor is counted at most once every ten minutes. We cannot turn the hash back into your IP address. We do not use advertising trackers.
We do not collect phone numbers.
3. Why we use it
- To let you sign in and manage your listings (you gave consent by signing in).
- To review listings and check that products are made in India.
- To process bids and keep payment records, as the law requires.
- To email you about your listing’s review, payments and important changes.
- To keep the site secure and prevent fraud.
4. What is public
Everything you enter for a listing is public except the registration number. Your email address and Google account details are never shown publicly.
5. Who we share it with
- Supabase, which hosts our database on servers in Mumbai, India, and handles sign-in.
- Vercel, which hosts the website. Requests may pass through its servers inside and outside India.
- Google, for sign-in.
- Our payment partner, to process payments.
- Government authorities, when the law requires it.
We do not sell personal data.
6. How long we keep it
Account and listing data is kept while your account is active and deleted within 30 days of a deletion request. Payment records are kept for eight years to meet accounting and tax law. Click hashes are kept for 90 days.
7. Your rights
Under the DPDP Act you can ask to access, correct or erase your personal data, withdraw consent, and nominate someone to exercise these rights on your behalf. Email TODO: support@your-domain.in. Withdrawing consent means we close your account and take your listings down. You can also complain to the Data Protection Board of India.
8. Cookies
We use sign-in cookies set by Supabase Auth to keep you signed in. Google’s sign-in window may set its own cookies while you sign in. We do not use advertising or tracking cookies.
9. Children
AI-Mela is not meant for anyone under 18. We do not knowingly collect children’s data.
10. Security
Data is encrypted in transit. Access to the database is restricted by role, and private fields cannot be read through the public website.
11. Grievance Officer
TODO: name of the grievance officer, TODO: support@your-domain.in. We respond within 15 days.
12. Changes
We will post any change here with a new “last updated” date and email signed-in makers about significant changes.