Privacy Policy

1. Introduction

ToScroll Technologies Private Limited (“Toscroll”, “we”, “us”, or “our”) operates the Shop.Toscroll platform (“Service”). This Privacy Policy describes how we collect, use, store, disclose, and protect personal information in connection with our platform, including merchant-facing and customer-facing surfaces.

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of our Service.

2. Information We Collect

We collect the following categories of personal information:

• Account information: Name, email address, phone number, and password (stored as a one-way hash) when you create a merchant or customer account.
• Business information: Store name, address, GSTIN, and contact details provided during onboarding.
• Transaction data: Order details, payment status, shipping addresses, and invoice records generated through the platform.
• Technical data: IP address, browser type, device identifiers, access logs, and cookies necessary to operate the Service securely.
• Payment gateway data: We do not store card numbers or UPI credentials. Payment processing is delegated to PCI-DSS compliant providers (Razorpay). We retain only transaction references and status.

3. How We Use Your Information

• To create and manage your account and storefront.
• To process orders, payments, and shipping requests on your behalf.
• To send transactional emails (order confirmations, password resets, billing receipts).
• To provide customer support and respond to enquiries.
• To detect fraud, enforce our Terms of Service, and comply with legal obligations.
• To improve platform performance and develop new features (using aggregated, anonymised data).

We do not sell your personal data to third parties.

4. Data Sharing and Processors

We share personal data only with trusted service providers who process it on our behalf and under confidentiality obligations:

• Cloud hosting: Servers located in India; data does not leave India without adequate safeguards.
• Payment gateway: Razorpay (PCI-DSS Level 1 certified).
• Shipping: Shiprocket and courier partners, for fulfillment-related data.
• Email delivery: Transactional email providers for platform notifications.

We may disclose information if required by law, a court order, or a government authority, or to protect the rights, property, or safety of Toscroll, our users, or the public.

5. Cookies and Tracking

We use strictly necessary cookies to operate the platform (session management, CSRF protection). We may use analytics cookies to understand aggregate usage. You can configure your browser to refuse cookies; however, some parts of the Service may not function correctly without them.

6. Data Retention

We retain personal data for as long as your account is active or as needed to provide the Service, fulfil our legal obligations, resolve disputes, and enforce our agreements. When you request account deletion, we anonymise or delete your personal data within 30 days, except where retention is required by law (e.g., GST records for 8 years under applicable Indian tax law).

7. Your Rights (DPDP Act, 2023)

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Request erasure of your personal data, subject to legal obligations.
• Withdraw consent for processing where consent is the legal basis.
• Nominate another person to exercise your rights in case of death or incapacity.

To exercise any of these rights, contact us at info@toscroll.com. We will respond within 30 days.

8. Security

We implement industry-standard security measures including TLS encryption in transit, bcrypt password hashing, access controls, audit logging, and regular security reviews. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security, but we take reasonable steps to protect your data.

9. Children's Privacy

Our Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by posting the new policy on this page and updating the “Last updated” date. Continued use of the Service after changes constitutes acceptance of the revised policy.

11. Contact Us

For privacy-related questions, data requests, or grievances, please contact our Data Protection Officer: