What we hold, and for how long

What we collect

• To sign you in: your phone number or email address, and a display name if you give one. A one-time sign-in code is kept for ten minutes, and sessions are kept for thirty days.
• To deliver an order: the name, phone number, email address, delivery address and any delivery note you give at checkout, the pieces you bought, and what was paid.
• To sell with us: your application holds your identity documents, contact details, address, business details if you have a business, and the bank account you are paid into. The account number is encrypted; only its last four digits are readable outside a payout.
• To show a review: the name you choose to publish, what you wrote, the rating, and which purchase it is about.
• To run the site: a basket identifier, and technical information our hosting provider records for security and reliability.

Why we hold it

To take and deliver an order, to take payment, to verify a seller, to pay a seller, to answer you when something goes wrong, and to meet tax and accounting obligations. We do not sell it, and we do not use it for advertising.

Who else sees it

Only where it is needed to do the thing you asked for:

• Cloudflare hosts the storefront and the API, and stores the database and files.
• Razorpay takes the payment and issues refunds. We do not see or store card details.
• Shiprocket carries the parcel, so it sees the delivery name, address and phone number.
• Resend sends email, andMSG91 sends text messages when SMS is enabled. Each sees the address or number it is sending to.

We share data with a government or a court only where the law requires it.

How long we keep it

• Orders and invoices are kept for at least six years after the end of the financial year they belong to, because tax law requires the record to be kept. An invoice is never altered.
• Seller applications, including identity documents, are kept while you sell with us and afterwards for as long as the law requires us to be able to show who we paid and why.
• Your account and contact details are kept while you have an account. Deleting an account does not delete the order records we are required to keep.
• A sign-in code is kept for ten minutes. A session is kept for thirty days.
• A review stays while it is published. Withdrawing it removes it from the storefront; the purchase record remains.

Cookies

There are three, all needed for the site to work, and no advertising or analytics cookies:

• A basket identifier, so a basket survives a page reload. It lasts thirty days.
• Two sign-in cookies, so you stay signed in. They are httpOnly, so a script on the page cannot read them. They last thirty days.

What you can ask us to do

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. We will do what you ask unless keeping it is required for a legal obligation — an invoice we must retain, for example — in which case we will tell you what is kept and why.

Write to privacy@alkaaf.shop. We answer within thirty days.

Changes

If this policy changes in a way that matters, we will say so on this page and, where it is about your account, tell you directly. The date at the top is when the current version took effect.