Privacy Policy

Last updated: 10 November 2026. This is a plain-language draft describing how Onboarder handles data; it is pending legal review.

Onboarder ("we") helps shops in India list their products and sell online. This policy explains what we collect, why, who we share it with, and the choices you have. It is written with India's Digital Personal Data Protection Act, 2023 in mind.

What we collect

From sellers (you):

Account details: name, email, password (stored only as a one-way hash) or your Google/GitHub sign-in.
Shop details you enter: shop name, address and map location, phone, GSTIN, FSSAI licence, customer-care contacts, opening hours and delivery settings.
Payout details: UPI ID, or bank account holder name, IFSC and account number. Account numbers are encrypted at rest and only the last four digits are shown.
Your catalog: product names, descriptions, prices, stock, barcodes and photos.
Orders you receive or record, and connection tokens for marketplaces you link (encrypted at rest).
Basic usage and device information for security and to improve the product.

About your customers: when a buyer orders through ONDC or a connected marketplace, we receive the name, phone number and delivery address needed to fulfil that order. We process this on your behalf, only to deliver the order and keep your records.

How we use it

To run the service: build your catalog, publish it to the channels you choose, receive orders and show analytics.
To generate content you request with AI (photos, descriptions, brand kits).
To keep accounts secure, prevent abuse and meet legal obligations.
To contact you about your account. We don't send marketing without your consent.

We do not sell personal data.

Who we share it with

ONDC network participants (buyer apps and gateways) receive your shop's public catalog and, for orders, the details needed to complete them, including settlement details for payments collected by the buyer app.
Marketplaces you connect (such as Shopify or Amazon) receive the products you choose to publish.
Service providers that host and operate Onboarder on our behalf: database and hosting, file storage (UploadThing), email (Resend), payments (Dodo Payments) and AI processing (Google Gemini) for content you ask us to generate.
Authorities, when required by law.

Your storefront

Your public storefront shows your shop name, address, timings, phone and products. Orders placed there are sent directly to your WhatsApp and are not stored by Onboarder.

Retention and deletion

We keep your data while your account is active. You can export your catalog at any time and delete your account from Settings, which permanently removes your shop, catalog, orders and connections from Onboarder. Listings already published to other platforms remain there until you remove them. Limited records may be kept where the law requires.

Your rights

You can access and correct your data in the dashboard, withdraw consent, and ask us to delete it. For anything else, including grievances, contact us through the contact page.

Changes

We'll update this page when our practices change and note the date above. Significant changes will be communicated by email.