Privacy Policy
Last updated:
Privacy Policy
Effective: 14th September, 2026
Sabki Shop is a partnership venture: the platform is owned by ABHIDHA & CO., and its direct selling business is operated by Dharmayu Ayurveda LLP (together, "we", "us"). Both act as Data Fiduciaries for the personal data described here. This policy explains what we collect, why, who we share it with, and your rights under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). It applies to Customers and Distributors using our website and app.
1. What we collect
| Category | Examples | When |
|---|---|---|
| Account details | Name, phone number, email, date of birth, gender, address | At sign-up |
| KYC details | PAN and Aadhaar (the Aadhaar number is stored with all but the last 4 digits masked) | When you complete KYC for withdrawals |
| Bank details | Account number, IFSC, account holder name | When you complete KYC for withdrawals |
| Order details | Products bought, invoices, delivery address, payment status | When you order |
| Team and earnings details | Sponsor, Team structure, BV, Green/Red status, Wallet and earnings history | While you are a member |
| Device and location | Device identifiers, IP address, approximate location | When you use the website or app |
| Usage data | Pages viewed, clicks, and session recordings used to understand how the site is used | When you use the website or app |
Session recordings do not capture payment card, UPI or banking credentials. These are entered directly with our payment gateway and are never stored by us; we keep only the transaction reference, amount and status the gateway returns.
2. Why we use it
- To create and manage your account and process orders, deliveries, replacements and refunds
- To verify identity (KYC) and pay withdrawals to your bank account
- To calculate BV and earnings under the Compensation Plan
- To deduct and deposit tax (TDS) and meet legal and audit obligations
- To send order updates, account alerts and offers on WhatsApp, SMS and email
- To prevent fraud, duplicate IDs and misuse
- To enforce our Terms and Code of Conduct, investigate complaints and handle disputes
- To recognise achievements publicly, as described in section 14
- To improve the website and app using analytics
3. Legal basis
We process your data with your consent, given when you sign up and tick the consent box, and for legitimate uses allowed under the DPDP Act, such as meeting legal obligations and fulfilling a purchase you asked for.
4. WhatsApp and marketing messages
By signing up, you agree to receive messages from us on WhatsApp. Order and account messages are part of the service. You can stop promotional messages at any time by replying STOP or writing to us.
5. Cookies and analytics
We use cookies and similar tools, including Google Analytics and Mixpanel, to understand how our website and app are used. By signing up, you consent to this use, as set out in our Terms & Conditions. You can block cookies in your browser settings, though some features may then not work.
6. Who we share data with
We share only what each party needs to do its job, under contracts requiring confidentiality:
- Payment gateway ([name]) to process payments and refunds
- Courier partners ([names]) to deliver orders and handle returns
- AiSensy, our WhatsApp messaging provider
- Railway (backend hosting, servers in Singapore) and Vercel (website hosting)
- Google Analytics and Mixpanel for analytics
- Auditors, chartered accountants and legal advisers, for audit, tax and legal purposes
- A successor entity, if our business is restructured or transferred (section 15)
- The public, when we recognise achievements (section 14)
- Tax, law enforcement and government authorities, when required by law
We do not sell your personal data.
7. Data stored outside India
Our backend data is stored on servers in Singapore. Transfers outside India are made as permitted under the DPDP Act and are protected by the safeguards in section 9.
8. What your upline can see
- Your Sponsor (your direct upline) can see your name, phone number and Team size.
- Members up to 5 levels above you can see only your Team size.
- No upline member can see your KYC, bank, Wallet or order details.
9. How we protect data
KYC documents are kept in restricted private storage. Bank details are encrypted at rest. Access is limited to staff who need it for their work. No system is perfectly secure; if a breach affects you, we will inform you and the Data Protection Board of India as required by law.
10. How long we keep data
| Data | Kept for |
|---|---|
| Tax, invoice and earnings records | 10 years |
| KYC details | 5 years after your ID is closed |
| Other account data | While your account is active, then deleted or anonymised unless the law needs us to keep it |
11. Your rights
Under the DPDP Act you may:
- Ask for a summary of your personal data and how it is used
- Correct or update inaccurate data (most details can be edited in your account)
- Ask us to erase data we no longer need to keep by law
- Withdraw consent at any time
- Nominate someone to exercise your rights if you die or become unable to
- Raise a grievance with us
Withdrawing consent does not affect processing already done. Since we cannot run your account, pay earnings or deliver orders without your data, withdrawing consent will close your ID.
We may ask you to verify your identity before acting on a request. We respond to requests within 30 days. We may decline a request, such as for erasure, where the law requires us to keep the data (for example, tax records) or where we need it to resolve a dispute or complete a pending transaction.
12. Account security
Your ID, password and OTPs are personal to you; do not share them. Any activity carried out using them is treated as carried out by you. If you suspect misuse, tell us immediately on WhatsApp or email so we can secure your account.
13. Data about other people
If you give us someone else's personal data, for example when you register a buyer through your portal, place an order for delivery to someone else, or introduce a new member, you confirm that the person has agreed to you sharing it with us and knows it will be handled under this policy.
Distributors are independent sellers. This policy covers data collected through Sabki Shop. Any personal data a Distributor collects or keeps on their own, outside our platform, is that Distributor's responsibility, and they must handle it lawfully.
14. Public recognition
To celebrate achievements under the Compensation Plan, we may publish your name, photo, city and the rank or reward you achieved on our website, app, social media, WhatsApp groups, printed material and at events. By signing up, you agree to this. You can opt out at any time by writing to us; we will stop future use, but cannot withdraw material already published or printed.
15. Business transfers
If our business is restructured, merged, incorporated into a new entity, or wholly or partly transferred, your personal data may be transferred to the successor entity. The successor will be bound by this policy, and we will tell you about the change.
16. Anonymised data and external links
We may use anonymised or aggregated data that does not identify you for analysis, reporting and planning. Our website and app may link to other websites; those are governed by their own privacy policies, not this one.
17. Children
Sabki Shop is only for people aged 18 and above. We do not knowingly collect data from anyone under 18.
18. Grievances
For any privacy question or complaint, contact our Grievance Officer:
Shweta Bansal, 7710101701, sabki.shop.admin@gmail.com, 1811 Sector 82, Mohali, 11AM to 5PM
If you are not satisfied with our response, you may complain to the Data Protection Board of India.
19. Changes
We may update this policy. We will post the updated version on the website with its effective date and tell you about significant changes by email or WhatsApp.
20. Language
This policy is available in English and Hindi. If there is any difference between them, the English version applies.