Privacy Policy
What we collect, why we need it, who can see it, and how long we keep it. Written against the actual database, so the retention periods below are the ones the software enforces.
Version 2026-08-12 · in effect from 2026-08-12 · VixitAi Labs, Ranchi, Jharkhand
Who we are
Upper Bazaar is a local marketplace for the shops of Upper Bazaar, Ranchi, operated by VixitAi Labs from Ranchi, Jharkhand. This policy covers upperbazaar.com, the marketplace app at /app/, and the consoles used by shopkeepers, service providers and delivery riders.
What we collect, and why
| What | Why we need it | How long |
|---|---|---|
| Your phone number | It is how you sign in — we send a one-time code rather than storing a password. It is also how the shop or the rider reaches you about an order in progress. | While your account exists |
| Your name | So the shop knows whose order it is packing and the rider knows who to ask for. | While your account exists |
| Email address (optional) | Order confirmations, the invoice for a delivered order, and password sign-in if you choose to set one. | While your account exists |
| Delivery address and its map pin | Two separate jobs: deciding whether we deliver to that spot at all, and getting a rider to the right door in a market of unnamed lanes. | Until you delete the address |
| Your orders | The order itself, the invoice, and any refund — all three have to be reconstructable afterwards or a dispute cannot be settled. | Kept as accounting records |
| Notification permission | If, and only if, you allow it: a browser subscription so we can tell you your order has left the shop. | Until you turn it off |
| The delivery code | The code a rider needs at your door. It is stored as a one-way hash, so nobody at this end — including us — can read it back out. | With the order record |
| A doorstep photograph | Sometimes taken at handover to settle “was it delivered”. It exists for a question that stops being asked within days. | Deleted after 30 days |
| Rider location (riders only) | To offer a delivery run to a rider who is actually nearby, and to show you where your order is while it is moving. | Deleted after 14 days |
| Photographs sellers upload | Shop and product pictures for the listing. | While the listing exists |
| What people search for | The words only, counted — never linked to you. It is how we find out what this market is being asked for and does not stock. | Kept as counts |
The two deletions above are done by a scheduled job, not by hand. When a doorstep photograph expires, the file is removed and the pointer to it is cleared, so nothing in the system can serve it afterwards. The record that a delivery happened — when, where, against which code — is kept. It is the photograph that expires, not the proof.
What you type into the search box
We count search terms, and we store nothing that connects one to you— no account, no device, no address, no session. There is no way for us to look up what a particular person searched for, because that information does not exist here.
What is kept is a daily tally: the words, how many times they were asked for, and whether anything was found. A search that finds nothing is the useful part — it tells us which shop or which product this market is missing. Anything that looks like a phone number or an email address is not stored at all; it is replaced by a marker before it is written.
Photographs are stripped before they are stored
Every uploaded image is re-encoded on our server before it is saved. That removes the EXIF block, which on a phone photograph normally includes the GPS coordinates of where it was taken. A shopkeeper photographing their counter is not also publishing their home address.
Who can see your details
- The shop you ordered from sees your name, your delivery address and a contact number — it cannot pack and hand over an order otherwise. In an order split across several shops, each shop sees only its own part.
- The rider assigned to your delivery sees the same, for as long as the delivery is live.
- Our own staff see it when answering a question about an order, and those actions are logged.
- Nobody else. Your address and phone number are never shown on a public page, never included in a review, and never sold or rented to anyone. Reviews show a first name only.
Payments
Most orders here are cash on delivery: you pay the rider at your door and no payment details exist to store. If you pay online, that happens on the payment provider’s own secure page — card and UPI details never reach our servers, and we could not store them if we wanted to. What we keep is that a payment succeeded, for how much, and against which order.
Third parties and tracking
This site runs no analytics, no advertising and no tracking scripts— not Google Analytics, not a Facebook pixel, not a session recorder. Nothing on the page loads from another company’s servers, and nothing follows you between sites. If that ever changes, this section changes with it, before the script ships.
The one thing we do count is search terms, on our own servers, with nothing attached to them — described above. We would rather say that plainly than let “no analytics” do more work than it honestly can.
We do rely on other companies for two narrow jobs, and only with the minimum they need: sending a message you asked for (an order update by email, SMS or WhatsApp — the recipient address and the message), and taking an online payment. We do not send your order history or your address anywhere else.
Cookies
After you sign in we set one cookie so you stay signed in. It is not readable by other sites and is not used to follow you around the internet. There are no advertising cookies to consent to, which is why you are not being asked to dismiss a banner.
Your choices
- See and correct your details — from your account in the app.
- Turn notifications off — in the app, or in your browser settings.
- Delete your account — from your account screen, or by asking us. We remove your profile and stop using your details. Records of completed orders, invoices and refunds are kept, because both sides may need them to settle a dispute or for tax — a delivered order is a transaction between you and a shop, not just a row we own.
- Ask what we hold about you — by the contact route below.
Children
Upper Bazaar is not intended for use by children. We do not knowingly create accounts for anyone under 18.
Security
The site is served only over HTTPS. Passwords, where set, are stored hashed and never in readable form; so are delivery codes. Access to customer details from our staff consoles requires a sign-in and is recorded. No system is perfect, and if something happens that affects your data we will say so plainly rather than quietly.
Changes
When this policy changes materially, the version at the top of this page changes with it. The version is the date it took effect.
Contact us
For anything about your data — a question, a correction, a deletion, or a complaint — reach us on WhatsApp or by email at vixitaissh@gmail.com. Say that it is a privacy question so it reaches the right person. We answer during market hours.
Postal and telephone contact: VixitAi Labs, Ranchi, Jharkhand · +91 70042 24293.