Privacy policy

1. Who we are

Vikrayo, available at https://www.vikrayo.com, is owned and operated by Stelliora Tech Private Limited, with its registered office at Mumbai, Maharashtra, India ("Stelliora", "we", "us" or "our"). This policy explains what personal data we process, why, and the choices and rights you have.

2. Two different roles

Vikrayo is a platform that merchants use to run an online store. That means we handle two kinds of personal data, and our responsibilities differ between them.

• Merchant data. Information about the person who signs up and their business. For this, Stelliora is the Data Fiduciary — we decide why and how it is processed, and this policy governs it.
• Shopper data. Information about a merchant's own customers, which the merchant enters or imports. For this, the merchant is the Data Fiduciary and Stelliora acts as a Data Processor on their instructions. The merchant's own privacy policy governs it; we process it only to provide the service to them.

3. What we collect about merchants

• Account details: your name, email address and password (stored only as a hash, never in readable form).
• Business details you give during signup: store name, business type, industry, the channels you sell on, and your business address, country and phone number.
• Technical records: the IP address and time of your last sign-in, and your browser user agent when you change consent settings.
• Credentials you add for third-party services, such as payment gateway or courier API keys. These are encrypted before they are stored.
• Billing details for your plan: your billing name, address and GSTIN, and records of invoices and payments. Card, UPI and bank details are entered with and processed by our payment partners; we do not store them.
• Early-access requests: if you ask for an invitation, the name, email address, company name and message you give us, with the IP address and browser user agent the request came from.
• Messages you send us, such as support requests and feedback.

4. What merchants store about their shoppers

Acting on a merchant's instructions, the platform stores:

• Names, email addresses, phone numbers and postal addresses.
• Order history, including a snapshot of the billing and shipping address as it was at the time of the order.
• Marketing consent state per channel, with the time it changed and who changed it.
• Notes and tags the merchant adds to a customer record.
• The IP address and browser user agent recorded against an order.

5. Why we process it

• To create and run your store, and to let you and your staff sign in.
• To process orders: taking payment, booking shipments and calculating tax.
• To send service messages such as password resets, staff invitations, billing notices and changes to our terms.
• To bill for your plan and keep accounts.
• To respond to early-access requests and support questions.
• To understand how the platform is used and improve it, using aggregated statistics that do not identify you or your shoppers.
• To keep the platform secure and to investigate misuse.
• To meet legal obligations, in particular tax record-keeping.

We do not sell personal data, and we do not use shopper data for our own purposes.

6. Who else receives it

Personal data is shared only with the service providers needed to complete what you asked for:

• Couriers — Shiprocket, Delhivery and Xpressbees receive the recipient's name, postal address, phone number and email when you book a shipment.
• Payment gateways — Cashfree receives the customer's name, email and phone to create a payment order. Stripe and Razorpay receive the order amount and reference, not the customer's contact details.
• Email delivery — our email provider receives the recipient address and message content for service email.
• Website analytics — Google receives usage data from visits to our public website through Google Analytics, as described in the cookies section.
• Hosting and storage — Amazon Web Services hosts uploaded files and serves custom domains.

Each of these is given only what it needs for that specific task.

We may also disclose personal data where required by law, a court order or a lawful request from a government authority; to protect the rights, safety or property of Stelliora, our users or the public; and to a buyer or successor if Stelliora is involved in a merger, acquisition or sale of assets, subject to this policy continuing to apply.

7. Where it is stored

The database runs on infrastructure we control. Some supporting services — file storage, content delivery and email — are operated by Amazon Web Services in the United States, so personal data may be processed outside India. The DPDP Act permits this except to countries the Government restricts by notification.

8. How long we keep it

• Merchant account data: for as long as the account is open.
• Deleted customer records: anonymised 90 days after deletion.
• Unaccepted staff invitations: deleted 30 days after they expire.
• Abandoned checkouts and carts: deleted after 180 days.
• Access and security logs: kept for 24 months.
• Records of emails we sent: kept for 365 days.
• Early-access requests: until we have decided on the invitation, or earlier if you ask us to delete them.
• Billing and invoice records: for as long as tax and company law require.
• Closed stores: shoppers' personal data, the catalog and other content are deleted 30 days after the store closes; its orders and invoices are kept for 8 years, then deleted.
• Cookie consent decisions: kept as proof of what you agreed to.

Orders are an exception. An order holds a snapshot of the buyer's billing and shipping details and forms part of a tax invoice. Indian tax law requires those records to be retained for several years, so erasing a customer anonymises their customer record and deletes their saved addresses, but does not delete past orders. This is a legal retention obligation, not a choice about data we would otherwise keep.

9. How it is protected

• Traffic is served over HTTPS.
• Passwords are stored as hashes and are never recoverable.
• Third-party API credentials are encrypted before storage.
• Each shop's data is isolated at the database level, so one merchant cannot reach another's records.
• Staff access is governed by roles and permissions, and can be limited to particular locations.
• Access to customer records is recorded in an audit log.
• Personal data is filtered out of application logs before they are written.

No system is perfectly secure. If a personal data breach occurs, we will inform the Data Protection Board of India and the people affected, as the DPDP Act and its rules require, and, where the breach affects shopper data, the merchants concerned.

10. Cookies

We use cookies that are needed for the site to work:

• a session cookie that keeps you signed in and remembers your current shop;
• a security token that protects forms against cross-site request forgery;
• a "remember me" cookie, only if you choose to stay signed in;
• an early-access cookie used by our own team while the platform is invite-only;
• a cookie named pricing_region, set only if you pick India or international pricing on our pricing page, which remembers that choice for 12 months.

On our public website (the homepage, pricing, legal and sign-in pages) we would also like to use Google Analytics, provided by Google LLC, to understand how visitors find and use the site. It only runs if you accept analytics cookies in the consent banner. It then sets its own cookies (named _ga and _ga_*) and collects information such as the pages you visit, how you arrived, your approximate location, and your device and browser. We use these reports only in aggregate; we do not use them to identify you or for advertising. Google Analytics is not used inside the merchant admin, so it never sees shopper data.

Your choice is remembered in a cookie named vk_consent for 12 months, and we keep a record of it (a random identifier, your choices, the policy version, your IP address and browser) as proof of consent. You can change your mind at any time from the "Cookie settings" link at the bottom of every page.

Your light or dark theme choice is saved in your browser's local storage. We do not use advertising or cross-site tracking cookies. Stores built on the platform are run by their merchants, who may use their own cookies and will describe them in their own privacy notices.

11. Your rights

Under the Digital Personal Data Protection Act, 2023 you may:

• Ask for a summary of the personal data we hold about you and how it is processed.
• Ask us to correct or complete inaccurate data.
• Ask us to erase data, subject to the retention obligations described in section 8.
• Withdraw consent you have given, as easily as you gave it.
• Nominate someone to exercise these rights on your behalf.
• Raise a grievance, and escalate to the Data Protection Board of India if we do not resolve it.

If you are a shopper rather than a merchant, contact the store you bought from first — they decide what happens to their customer records. We will help them act on your request.

To exercise these rights, write to the grievance officer below. We may need to verify your identity before acting on a request.

12. Children

The platform is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children for our own purposes. If you believe a child has given us personal data, contact us and we will delete it.

13. Grievance officer

Questions and complaints about personal data go to:

• Name: Sudhir Vishwakarma
• Email: privacy@vikrayo.com
• Address: Mumbai, Maharashtra, India

We acknowledge grievances within 24 hours and aim to resolve them within 15 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

14. Changes

When this policy changes materially we publish a new version on this page with its version date, and tell merchants by email or in the admin before it takes effect. The version you agreed to at sign-up is recorded against your account.