- We collect what we need to run a marketplace that protects buyers and sellers: your account and business details, orders and payments, listings and documents, and how the sites are used.
- We share data only with the people and companies needed for an order (the seller or buyer, the broker, the fabricator, transport) and with the providers who run parts of the service for us. We don't sell personal data.
- Card and bank numbers are handled by payment providers; we only keep the brand, last four digits and a token.
- You can see, correct, download or delete your data, and you can complain to us or your data-protection authority.
1. Who we are
This policy explains how Qwikstone Technologies Private Limited (CIN [CIN — to be added], Registered office, street, city, state, PIN, India) (“QwikStone”, “we”, “us”) collects and uses personal data when you use qwikstone.com, seller.qwikstone.com (Seller Hub, the seller website and the developer site), broker.qwikstone.com, our apps, APIs and communications (the “Services”).
QwikStone is the data fiduciary (under India's Digital Personal Data Protection Act, 2023) and the controller (under the EU and UK GDPR and similar laws) for the personal data described here, except where section 9 says a seller, broker or developer acts as an independent controller for data they receive about you.
Questions or requests: privacy@qwikstone.com. Grievance officer: [Grievance officer's name — to be added], grievance@qwikstone.com.
2. Personal data we collect
2.1 Data you give us
| Category | Examples |
|---|---|
| Account | Name, email, phone number with country code, password (stored only as a one-way hash), preferred language, country, city, currency and units. |
| Two-step sign-in | Authenticator-app secret, backup codes (hashed), trusted devices, the phone or email used for codes. |
| Business and verification | Registered company name, tax and business registration numbers (for example GSTIN, PAN, IEC, EIN, VAT, CNPJ, RFC), addresses, yard locations and opening hours, documents you upload (certificates of incorporation, tax certificates, bank letters, trademark records, association letters), and the names and roles of team members. |
| Orders and requests | Items, quantities, delivery address and postal code, buying requests, drawings and photos you attach, quotes, bids, fabrication specifications, messages with sellers, support cases. |
| Payments and payouts | Card brand, last four digits, expiry month and the payment provider's token; for payouts, the bank name, account holder and the last four digits of the account. Full card and account numbers are entered on the provider's secure form and never reach QwikStone. |
| Listings and content | Listing text and photos, slab sheets, reviews, forum posts, feedback and anything else you publish or upload. |
| Brokers | Association approval letter, areas you work in, availability, inspection reports and photos, payout details, ratings. |
| Developers | Company, website, use case, app names, redirect addresses, API keys and webhook endpoints (secrets are stored hashed or encrypted). |
| Waitlists, leads and associations | Name, email, phone, company and details you send through forms such as the broker waitlist, machinery invitations and trade-association listings. |
2.2 Data we collect automatically
- Sign-in and security: sign-in attempts with time, IP address, browser and device type, and whether the attempt succeeded — used to protect accounts and investigate misuse.
- How you use the marketplace: searches (including searches that return nothing), listings you view, results you click and their position, items added to the cart, checkouts and orders, and the market you shop in. Before you sign in these are linked to a random identifier in a cookie; when you sign in we link them to your account so we can show relevant stock and measure what works. See the Cookie policy.
- Advertising: impressions and clicks on sponsored listings and banners, used to charge advertisers fairly, filter invalid clicks and report results. Advertisers see totals, never who you are.
- Approximate location: the country and city you choose or that we infer from your IP address or postal code, used for prices, delivery estimates and “near you” results.
- Broker location during jobs: while a broker is travelling to and checking in at a yard for an accepted job, the broker app records the device's location to show the seller and buyer that the visit is on its way and to confirm the visit took place (QR check-in at the yard). Location is not collected outside active jobs.
2.3 Data from others
- Registry and verification providers that confirm business and tax registrations (for example GST, company and tax registers).
- Payment providers, who tell us whether payments, refunds and mandates succeeded.
- Other users: sellers, brokers and fabricators add information about orders you're part of (for example an inspection report on stock you reserved). Team owners add their team members.
- Apps you connect: if you authorise a developer's app, it may send us data (for example stock updates) on your behalf.
3. Why we use it and our legal grounds
| Purpose | Legal ground |
|---|---|
| Create and secure your account; run sign-in and two-step verification. | Contract; legitimate interest in security. In India: your consent and legitimate uses under the DPDP Act. |
| Process orders: deposits, inspections, fabrication, loading, shipping, balance payments, refunds and payouts. | Contract. |
| Verify sellers, brands and brokers; prevent fraud, counterfeits, money laundering and sanctions breaches. | Legal obligation; legitimate interest in a safe marketplace. |
| Keep tax, accounting and invoice records. | Legal obligation. |
| Show prices, delivery estimates and relevant stock; improve search, listings and the Services. | Legitimate interest; consent where the law requires it. |
| Run advertising: choose which sponsored listings to show, count clicks, filter invalid traffic and report results to advertisers. | Legitimate interest; consent where required. |
| Send service messages (sign-in codes, order updates, receipts, policy changes). | Contract; legal obligation. |
| Send marketing about QwikStone (you can opt out at any time). | Consent, or legitimate interest for existing customers where the law allows. |
| Answer support requests, grievances and legal claims. | Contract; legal obligation; legitimate interest. |
Where we rely on consent you can withdraw it at any time; this doesn't affect what we did before. Where we rely on legitimate interest you can object (section 11).
4. Automated decisions and AI
- Rankings and match scores. Search results and quote rankings are ordered automatically using relevance, availability, delivery time, price and seller record. Sponsored placements are labelled and chosen by an auction that also weighs listing quality.
- Account health. Seller account health is calculated from orders, inspection results, cancellations and response times. Low scores can reduce visibility; suspensions are always reviewed by a person, and you can appeal through a support case.
- Listing checks. New listings are checked automatically for prohibited or misleading content and missing safety information; a person reviews anything rejected if you ask.
- AI features. When enabled, we use AI providers to suggest listing text, translate the interface, generate demo images and answer questions in the Seller Hub assistant. What you type into the assistant is sent to the provider to produce an answer; QwikStone does not keep the conversation, only a count of how often the assistant was used. Don't enter personal data about other people in the assistant.
None of these decisions has a legal or similarly significant effect on you without human review.
5. Who we share data with
We share personal data only where needed, and require recipients to protect it.
5.1 People involved in your order
- Sellers receive the buyer's name or business name, delivery location and the order details needed to prepare and dispatch the order. Buyers' email addresses and phone numbers are not shared with sellers unless the buyer chooses to share them.
- Buyers see the seller's business name, yard city, ratings and the inspection report for their order.
- Brokers receive the yard address, contact for the visit and the listing details for jobs they accept. Fabrication shops receive the specification and drawings for jobs they're allotted. Transport and logistics partners receive pickup and delivery details.
5.2 Service providers who act for us
| Provider type | What they do |
|---|---|
| Cloud hosting, databases, content delivery and storage (for example Amazon Web Services and Cloudflare) | Run the Services and store data and photos. |
| Payments (Razorpay in India; Stripe in other markets) | Take payments, refunds, mandates and payouts; detect payment fraud. |
| Email and SMS delivery | Send sign-in codes, order updates and receipts. |
| Business and tax verification (for example GST and company-registry data providers) | Confirm registrations you give us. |
| AI providers (OpenAI; DeepSeek for the Seller Hub assistant) | Produce listing suggestions, translations, images and assistant answers from the text we send them. |
5.3 Others
- Apps you authorise through QwikStone sign-in (OAuth) receive the data covered by the permissions you approve, until you disconnect them.
- Authorities, courts and regulators where the law requires it, or to protect the rights, property or safety of our users or the public. We review each request and share only what is required.
- A buyer or successor of all or part of our business, under this policy.
We do not sell personal data, and we do not share it for cross-context behavioural advertising. Advertisers on QwikStone only ever see aggregated results.
6. International transfers
QwikStone operates in India, the United States, the United Kingdom, the European Union, Brazil and Mexico, and some providers process data in other countries. When personal data leaves the country it was collected in, we protect it as the law requires — for example with the European Commission's standard contractual clauses and the UK addendum for transfers from the EU and UK, and contractual safeguards for other transfers. Transfers from India are made only to countries not restricted by the Government of India. Text sent to the Seller Hub assistant may be processed by its provider outside your country; you can choose not to use the assistant.
7. How long we keep data
| Data | Kept for |
|---|---|
| Account and profile | While your account is open, then up to 30 days to allow reactivation or recovery, then deleted or anonymised unless needed below. |
| Orders, invoices, payments, payouts and tax records | 8 years after the end of the financial year they relate to, as required by tax and company law. |
| Business verification documents | For as long as the seller or broker account is active and up to 5 years after it closes, as required by anti-money-laundering rules. |
| Sign-in and security logs | 12 months. |
| Marketplace usage events (searches, views, clicks) | 24 months, then anonymised for statistics. |
| Broker location during jobs | 90 days after the job, or longer if the visit is disputed. |
| Support cases and messages | 3 years after the case is closed. |
| Waitlist and lead forms | Until the purpose is met (for example registration opens) and up to 12 months after, unless you become a customer. |
| Backups | Overwritten on a rolling basis within 35 days. |
8. Security
- Passwords are hashed with Argon2; two-step sign-in is required for sellers, brokers and staff; staff access to our back office is restricted by network, logged and needs an authenticator app.
- Data is encrypted in transit (HTTPS) and stored in access-controlled systems. Integration secrets are stored server-side and are never shown again after entry.
- We don't store full card or bank account numbers.
- If a personal data breach is likely to affect you, we'll tell you and the relevant authorities as the law requires.
No system is perfectly secure. Keep your password private, use two-step sign-in, and tell us at support@qwikstone.com if you suspect misuse.
9. When others are responsible for your data
Sellers, brokers and fabrication shops that receive your data for an order may use it only for that order and to meet their own legal obligations (for example invoicing). If they use it for anything else, they are responsible for that use. Developers' apps that you connect handle your data under their own privacy policies and our API terms.
10. Children
The Services are for adults and businesses. We don't knowingly collect data from anyone under 18. If you believe a child has given us data, contact privacy@qwikstone.com and we'll delete it.
11. Your rights
Depending on where you live, you have some or all of these rights. You can use many of them in Account settings; otherwise email privacy@qwikstone.com. We'll verify your identity and reply within the time the law sets (usually within 30 days).
- Access your data and get a copy, including in a portable, machine-readable format.
- Correct data that is wrong or incomplete.
- Delete data we no longer need or have no lawful reason to keep (we keep what tax and anti-fraud laws require).
- Object to processing based on legitimate interest, and to direct marketing at any time.
- Restrict processing while a complaint is looked at.
- Withdraw consent where we rely on it.
- Nominate someone to exercise your rights if you die or become incapable (India).
- Complain to us (section 13) and to your data-protection authority.
Country-specific information
- India: you have the rights of a data principal under the Digital Personal Data Protection Act, 2023, including grievance redressal through our grievance officer and complaint to the Data Protection Board of India.
- European Union and United Kingdom: you may complain to your local supervisory authority or the UK Information Commissioner's Office.
- United States (including California): you have the right to know, delete and correct personal information and to opt out of its sale or sharing. We don't sell or share personal information for cross-context behavioural advertising, and we don't use sensitive personal information to infer characteristics about you. We won't discriminate against you for using your rights. An authorised agent may make a request for you with your written permission.
- Brazil: you have the rights of a data subject under the LGPD, including confirmation of processing, anonymisation, information about sharing and portability, and may complain to the ANPD.
- Mexico: you may exercise your ARCO rights (access, rectification, cancellation and opposition) and limit the use of your data by writing to us.
12. Marketing and messages
You can stop marketing emails using the unsubscribe link in each one, or in Account settings. Service messages — sign-in codes, order and payment updates, inspection results, policy changes — are needed to run your account and will still be sent.
13. Grievance officer and contact
[Grievance officer's name — to be added], Grievance Officer, Qwikstone Technologies Private Limited, Registered office, street, city, state, PIN, India · grievance@qwikstone.com.
We acknowledge complaints within 24 hours and aim to resolve them within 15 days. Privacy questions and requests: privacy@qwikstone.com.
14. Changes to this policy
We'll update this policy when our practices or the law change. If a change is material, we'll tell you by email or in the Services before it takes effect. The date at the top shows when it was last updated.