Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how FewTone Technologies ("Zoset", "we", "us", or "our"), the owner and operator of the Zoset marketplace, collects, uses, stores, shares, protects, and otherwise processes the personal data of users ("you", "your", or "User") who access or use the Zoset website, mobile application, and all related features, tools, and services (collectively, the "Platform").

Zoset is an online marketplace that enables individual users and shops to list, discover, buy, and sell traditional and occasion wear, with payments handled through a secure escrow mechanism.

We are committed to protecting your privacy and handling your personal data responsibly and in accordance with applicable Indian law, including the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the rules made thereunder (including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011), and the Consumer Protection (E-Commerce) Rules, 2020, each as amended from time to time.

This Policy should be read together with our Terms & Conditions and our Damage Policy, which together govern your use of the Platform.

2. Your Consent

By creating an account, accessing, browsing, or otherwise using the Platform, you acknowledge that you have read and understood this Policy and you consent to the collection, use, storage, disclosure, and processing of your personal data in accordance with this Policy, our Terms & Conditions, and our Damage Policy.

At the point of registration, we record the date and time of your acceptance of these policies (stored in our systems as policies_accepted_at) as evidence of your consent. Where processing is based on your consent, you have the right to withdraw that consent at any time, as described in Section 12 (Your Rights) and Section 13 (Withdrawal of Consent). Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

If you do not agree with this Policy, please do not access or use the Platform.

3. Definitions

For the purposes of this Policy:

• "Personal Data" means any data about an individual who is identifiable by or in relation to such data.
• "Data Principal" means the individual to whom the Personal Data relates (i.e., you).
• "Data Fiduciary" means the person who, alone or with others, determines the purpose and means of processing Personal Data (i.e., FewTone Technologies).
• "Data Processor" means any person who processes Personal Data on behalf of a Data Fiduciary.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, use, sharing, disclosure, or erasure.
• "Seller" means a User who lists an item for sale on the Platform, including individual users and shops.
• "Buyer" means a User who purchases or seeks to purchase an item on the Platform.
• "Escrow" means the mechanism by which buyer funds are held by the Platform and its payment partner until delivery conditions are met, before being released to the Seller.

4. Who We Are (Data Fiduciary)

The Data Fiduciary responsible for your Personal Data is:

For all privacy-related queries, requests, and complaints, please contact our Grievance Officer, whose details appear in Section 18 (Grievance Redressal).

5. Categories of Personal Data We Collect

We collect the following categories of Personal Data, depending on how you use the Platform:

5.1 Authentication and Account Credentials

• Your mobile phone number, which is verified at registration through a One-Time Password (OTP).
• A password, which you set after verifying your number and use to log in to your account. Passwords are stored securely in encrypted (hashed) form and are never stored or visible to us in plain text.
• Bot- and fraud-prevention signals generated by Cloudflare Turnstile at the point of login or registration.

5.2 Profile and Account Information

• First name and surname.
• A unique, lowercase username, which is permanent and cannot be changed once selected at registration.
• Gender.
• Date of birth.
• Profile picture (optional).
• Your interface and layout preferences.

5.3 Seller and Payout Information

• Your UPI ID and associated mobile number, collected to route escrow payouts to you when you sell.

5.4 Shop Information

• If you list as a shop, your registered shop name and a Google Maps location link identifying your boutique.

5.5 Address and Location Data

• Your full shipping address, including city, state, and pincode.
• We use the India Post API (api.postalpincode.in) to validate and lock valid city-pincode combinations.

5.6 Listing and Product Data

• Item titles, descriptions, size, condition, material, colour details, occasion tags, and photographs of the items you list.

5.7 Transaction and Order Data

• Records of orders placed and received, order status, payment status, escrow status, payout records, listing credit balances, top-up packs, and any credits granted to you by our team.

5.8 Video Verification Records

• Packaging videos uploaded by Sellers and unboxing videos uploaded by Buyers, as described in Section 8.

5.9 Usage, Device, and Analytics Data

• Product views and impressions, recorded in an append-only metrics log (product_metrics_log) used to calculate Seller analytics.
• Standard technical and usage information collected through analytics tools, such as device and browser type, approximate location, pages visited, and interactions with the Platform (see Section 10).

5.10 Communications

• Messages exchanged through the Platform's chat features, and any correspondence you have with our support team.

6. How We Collect Your Personal Data

We collect Personal Data:

• Directly from you: when you register, complete your profile, create a listing, upgrade to a shop, add an address, place or fulfil an order, upload a video, or contact support.
• Automatically: when you use the Platform, through logs, cookies used for authentication, and analytics tools.
• From third parties and service providers: such as our payment partner (regarding payment and payout status) and the India Post API (for pincode validation).

7. Purposes of Processing and Legal Basis

We process your Personal Data for the purposes set out below. Our legal basis for processing is your consent, the necessity of processing to provide the services you request and to perform our contract with you, and, where applicable, compliance with legal obligations and the protection of the legitimate interests of Users and the Platform.

8. Video Verification Records

To keep the escrow mechanism secure and to resolve disputes fairly, the Platform uses two categories of video:

• Packaging Video (Seller): Sellers are asked to record and upload a video while packaging the item, before dispatch.
• Unboxing Video (Buyer): Buyers may record and upload a video while opening the delivered item. Uploading an unboxing video is optional for normal orders. However, if a Buyer wishes to raise a dispute, an unboxing video is required as supporting proof.

9. Information Sharing and Disclosure

We do not sell your Personal Data. We share it only as described below.

9.1 Between Buyers and Sellers

To protect your privacy, your phone number and full name are hidden from public listings and from the Platform's chat features. Contact and shipping details are exchanged only after a Buyer has successfully completed checkout and payment. At that point:

• the Seller receives the Buyer's shipping address and phone number; and
• the Buyer receives the Seller's contact details, solely for the purpose of fulfilling the order.

9.2 Delivery and Shipping

Zoset does not currently integrate directly with courier companies. The Seller selects their own delivery partner (including any local courier of their choice) and manually enters a tracking or reference number against the order. The Buyer can view this reference number to track the parcel. Any data shared with the Seller's chosen courier is governed by that courier's own terms and privacy practices.

9.3 Service Providers (Data Processors)

We share limited Personal Data with trusted service providers who process it on our behalf and under our instructions, only to the extent necessary to operate the Platform. These currently include:

• Razorpay - to process payments, operate the escrow flow, and route payouts. Razorpay processes your payment-related information under its own privacy policy and applicable RBI regulations.
• Supabase - to host our database, authentication, and file storage, secured through Row-Level Security policies.
• Cloudflare - to provide bot protection and security (Turnstile).
• Google Analytics - to provide usage analytics (see Section 10).

9.4 Legal and Protective Disclosures

We may disclose Personal Data where we believe in good faith that it is necessary to: comply with applicable law, regulation, legal process, or an enforceable governmental or court request; enforce our Terms & Conditions and Damage Policy; detect, prevent, or address fraud, security, or technical issues; or protect the rights, property, or safety of Zoset, our Users, or the public.

9.5 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of assets, Personal Data may be transferred to the relevant successor entity, subject to this Policy continuing to apply to your Personal Data.

10. Cookies and Analytics

10.1 Cookies

We use cookies only for authentication - that is, to keep you securely signed in to your account. We do not use cookies for advertising or for cross-site tracking.

10.2 Analytics

We use Google Analytics to understand how Users interact with the Platform so that we can improve it. Google Analytics may collect technical and usage data as described in Google's own privacy policy. In the future, we may introduce our own in-house analytics for the same purpose. Any analytics we use is solely to understand usage and improve the service, and is never used to sell your Personal Data.

11. Age Requirement and Minors

You must be 18 (eighteen) years of age or older to carry out real transactions on the Platform, including any purchase, sale, or financial decision.

Users below the age of 18 may browse and use the Platform, but must consult a parent or legal guardian before making any purchase, sale, or financial decision on the Platform. Where the DPDP Act requires verifiable parental or guardian consent for the processing of a child's Personal Data, such consent must be obtained. We do not knowingly use children's data for tracking, behavioural monitoring, or targeted advertising. If we become aware that we have collected Personal Data from a child in a manner not permitted by law, we will take steps to delete it.

12. Your Rights as a Data Principal

Subject to applicable law, you have the following rights in relation to your Personal Data:

• Right to access - to obtain a summary of the Personal Data we process about you and the processing activities undertaken.
• Right to correction and updating - to correct inaccurate or misleading data and complete or update your data. You may edit your first name, surname, and preferences in your account settings. Please note your username is permanent and cannot be changed once chosen.
• Right to erasure - to request deletion of your Personal Data. We will action such requests in accordance with Section 15 (Account Deletion). Please note that we may retain certain data where we are required or permitted by law to do so, or where it is necessary for legal, tax, security, fraud-prevention, or dispute-resolution purposes, and we may decline a deletion request to that extent.
• Right to grievance redressal - to have your complaints addressed by our Grievance Officer (Section 18).
• Right to nominate - to nominate another individual to exercise your rights in the event of your death or incapacity, in accordance with the DPDP Act.

You may also, where required by law, withdraw a consent you have given us. Because most of the data we process is essential to operating your account and completing your transactions, withdrawing consent will generally mean we can no longer provide you the Platform or some of its features, and may require your account to be closed. Withdrawal does not affect any processing already carried out, and does not require us to delete data we are entitled or obliged to retain (see Sections 15 and 16).

To exercise any of these rights, please contact us using the details in Section 18. We may need to verify your identity before acting on your request.

13. Consent and Continued Use

Providing your Personal Data and consenting to its processing under this Policy is a condition of using the Platform, because we cannot create your account, show your listings, process payments, or fulfil orders without it. By continuing to use the Platform, you confirm your ongoing consent to this Policy. If you no longer wish us to process your data, your option is to stop using the Platform and request account closure, at which point Sections 15 and 16 (on deletion and retention) will apply.

14. Managing Your Listings

Sellers can deactivate their listings or mark them as sold at any time from within the Platform. Listing status is updated in real time, including within Buyers' active carts, so that unavailable items are reflected promptly.

15. Account Deletion - What We Delete and What We Retain

You may request deletion of your account by contacting our support team. Upon a verified deletion request, and where we determine that no legal, tax, security, fraud-prevention, or dispute-resolution reason requires us to retain it, we will delete the following personal data associated with your account:

• Your login record and profile, including name, phone number, listing credit balance, and policy acceptance timestamps.
• All saved addresses.
• Your shop or boutique profile, if any.
• All outfit and product listings you created, including their sizes, colours, and occasion tags.
• Your cart and wishlist.
• All reviews you gave or received, and your notifications.

What we retain: We will retain records of completed orders and transactions. We are legally required to maintain these financial, invoicing, and tax records under applicable law, and they also protect both Buyers and Sellers in relation to any subsequent dispute, claim, chargeback, or regulatory requirement. We may also retain other data for as long as reasonably necessary to comply with our legal obligations, prevent fraud and abuse, enforce our agreements, and resolve disputes. Where we are required or permitted by law to retain data, we may decline or defer a deletion request to that extent. Retained records are kept only for these purposes and are not used for any other purpose.

16. Data Retention

We retain your Personal Data for as long as your account remains active, or for as long as needed to provide you the services, and thereafter only for as long as necessary to:

• comply with our legal, tax, and regulatory obligations;
• resolve disputes and enforce our agreements; and
• maintain records of consent and policy acceptance to protect all marketplace participants.

Packaging and unboxing videos are deleted 4 days after successful delivery, as described in Section 8. When Personal Data is no longer required for any lawful purpose, it is securely deleted or anonymised.

17. Data Security

We implement reasonable security practices and procedures designed to protect your Personal Data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• OTP verification of your phone number at registration, followed by password-based login, with passwords stored only in encrypted (hashed) form and never in plain text;
• Row-Level Security (RLS) policies on our Supabase database and storage, restricting access to authorised operations only;
• restricting access to sensitive records, including video verification records, to authorised administrators;
• use of reputable, security-compliant service providers (Razorpay, Supabase, Cloudflare); and
• bot and fraud prevention via Cloudflare Turnstile.

While we take these steps to safeguard your data, no method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security. You are responsible for keeping access to your account and device secure.

18. Grievance Redressal

In accordance with the Information Technology Act, 2000, the Consumer Protection (E-Commerce) Rules, 2020, and the DPDP Act, 2023, the following officer is designated to address your grievances, data requests, and complaints regarding your Personal Data or your use of the Platform:

For general privacy queries and data requests, you may also write to us at zoset@fewtone.com.

We will acknowledge and endeavour to resolve grievances within the timelines prescribed under applicable law.

19. Marketing Communications

By creating an account and using the Platform, you consent to receive communications from us, including updates, offers, recommendations, and promotional or marketing messages, through channels such as email, SMS, WhatsApp, push notifications, and in-app messages. We send these to keep you informed about the Platform and features, listings, and offers that may interest you. You can opt out of promotional messages at any time using the unsubscribe option provided in the message or by contacting us, and we will continue to send you the service and transactional messages necessary to operate your account and orders.

20. Third-Party Links

The Platform may contain links to third-party websites or services (for example, a Seller's chosen courier or a Google Maps location link). We are not responsible for the privacy practices or content of such third parties, and we encourage you to review their privacy policies.

21. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will revise the "Last Updated" date above and, where appropriate, provide additional notice on the Platform. Your continued use of the Platform after any update constitutes your acceptance of the revised Policy.

22. Governing Law and Jurisdiction

This Policy is governed by and construed in accordance with the laws of India. Subject to any applicable law, the courts at Ahmedabad, Gujarat shall have exclusive jurisdiction over any dispute arising out of or in connection with this Policy.

23. Contact Us

If you have any questions, requests, or concerns about this Policy or your Personal Data, please contact: