Privacy Policy

OctoMercato is a product of Octoyoung Global Solutions Private Limited ("Octoyoung", "we", "us", "our"). This Privacy Policy explains how we collect, use, disclose, store and protect personal information when you visit octomercato.com, create an OctoMercato account, operate a store on the platform, or interact with a store or a connected social channel that uses OctoMercato.

1. Who we are

Octoyoung Global Solutions Private Limited is the company that operates the OctoMercato platform. We provide the software, hosting and tooling that merchants use to run their online stores. Contact details are in section 14.

2. Scope: merchants and shoppers

OctoMercato is used by two main groups of people:

• Merchants — businesses and individuals who create an OctoMercato account and operate a store. We are the controller of merchant account data.
• Shoppers and social users — people who browse, order from, message, or comment on a merchant's store or connected social account. For that data, the merchant is the controller and OctoMercato acts as a processor on the merchant's instructions.

If you are a shopper and want to exercise your rights over an order or a conversation, please contact the merchant first. We will assist the merchant in responding.

3. Information we collect

3.1 Merchant account information

• Name, business name, email address, phone number and password (stored as a one-way hash).
• Store details: store name, domain and subdomain, design settings, catalogue content you upload, and support communications.
• Billing information: plan, subscription status, invoices and payment references. Card and UPI credentials are handled by our payment processor; we do not store full card numbers.

3.2 Store and order data processed for merchants

• Product, category, media and inventory content.
• Order details: items, amounts, status, shipping address, tracking information, and the customer's name, email and phone number.
• Customer account details where a store enables customer sign-in.

3.3 Instagram and Meta data

If a merchant connects an Instagram professional account, we access and process:

• The Instagram professional account ID and username.
• An access token issued by Meta, which we store encrypted at rest.
• Messages, comments and related events sent to that account, so we can display them in the merchant's inbox and generate the replies the merchant has configured.
• Instagram-scoped user identifiers for the people who message or comment.

We use this data only to provide the messaging features the merchant has enabled. We do not sell it, and we do not use it for advertising. Meta's own handling of data is governed by Meta's privacy policy.

3.4 Usage, device and log data

• IP address, browser and device type, pages viewed, referring URL and timestamps.
• Error and security logs, including records of administrative actions.
• Aggregated visit counts used for plan limits and reporting.

3.5 Cookies and local storage

We use strictly necessary cookies and local storage for sign-in sessions, theme preferences and security. We do not use third-party advertising cookies. You can clear these through your browser, although some features will stop working.

4. How we use information

• To create and operate merchant accounts and stores.
• To process orders, payments, invoices and subscriptions.
• To provide messaging automation and the merchant inbox for connected Instagram accounts.
• To provide support, investigate abuse, and secure the platform.
• To measure usage against plan limits and improve the product.
• To comply with legal, tax and accounting obligations.

We do not sell personal information. We do not send unsolicited marketing messages through connected social accounts.

5. Legal bases

Where Indian law (including the Digital Personal Data Protection Act, 2023) or other applicable law requires a legal basis, we rely on: performance of a contract, compliance with legal obligations, our legitimate interests in operating and securing the service, and consent where required. You may withdraw consent at any time; withdrawal does not affect processing already carried out.

6. Sharing and sub-processors

We share personal information only as needed to run the service:

Recipient	Purpose
Cloudflare	Hosting, CDN, database, storage and security
Razorpay	Payment processing and subscription billing
Meta Platforms	Instagram messaging and comments, when a merchant connects an account
Google (Firebase Cloud Messaging)	Push notifications to the merchant mobile app
Email and support providers	Transactional email and customer support
Professional advisers and authorities	Where required by law or to protect legal rights

These providers are bound by their own terms and, where applicable, data processing agreements. Some processing may occur outside India; where that happens we take steps required by applicable law.

7. Retention

• Merchant account and store data: for as long as the account is active, then for a short wind-down period so the account can be restored.
• Instagram messages and comments: up to 90 days, after which they are deleted automatically. Merchants may request earlier deletion.
• Invoices and payment records: for the period required by tax and company law.
• Security and access logs: for a limited period needed to investigate incidents.

When data is no longer needed, we delete or anonymise it. Backups are overwritten on a rolling basis.

8. Security

We use HTTPS in transit, encryption at rest for integration tokens, hashed passwords, access controls and audit logging. No system is completely secure; if a breach affects your personal information we will notify affected parties and authorities as required by law.

9. Your rights

Subject to applicable law, you may request access to your personal information, correction of inaccurate information, deletion, restriction of processing, portability, and withdrawal of consent. Merchants can make these requests from their account settings or by emailing us. Shoppers should contact the merchant first; we will assist the merchant.

You also have the right to complain to the Data Protection Board of India or another competent supervisory authority.

10. Children

OctoMercato is a business tool and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided information, contact us and we will delete it.

11. International transfers

Our infrastructure providers operate globally, so personal information may be processed in countries other than your own. We take contractual and organisational steps to protect it in line with this policy and applicable law.

12. Automated messaging

Where a merchant enables automated replies, the first automated message identifies the experience as automated. Automated messages are sent only within the messaging windows permitted by the relevant platform, and only after a person has initiated contact or commented. Reply STOP to opt out of further automated messages from that account.

13. Changes to this policy

We may update this policy to reflect changes in the service or the law. The effective date at the top will change, and material changes will be communicated to merchants by email or in the admin panel.

14. Contact and grievance redressal

Octoyoung Global Solutions Private Limited
OctoMercato Privacy Team
Email: info@octomercato.com
Alternate: info@octoyoung.com

For grievances under applicable data protection law, write to the Grievance Officer at the same addresses with the subject line "Grievance". We aim to acknowledge requests within 7 days and resolve them within 30 days.