Privacy Policy

Last updated 22 October 2026

1. Who we are

oneCommerce is run by Pratik Niranjan Pai, an individual based in Mumbai, Maharashtra, India, who runs it as a sole proprietor ("oneCommerce", "we", "us"). It is not yet a registered company. You can reach us at support@onecommerce.tech or on WhatsApp at +91 98203 69727.

This policy follows India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.

2. Two roles

• Our own customers and visitors. For the details of businesses that use oneCommerce, their team members and visitors to this website, we decide how the data is used (we are the Data Fiduciary).
• Chats inside a business's inbox. When a customer messages a business that uses oneCommerce, that business decides how the conversation is used (it is the Data Fiduciary). We store and process it only to run the inbox for that business, under our Data Processing Agreement. If you are a customer of such a business, please contact the business first; we will help it answer you.

3. What we collect

About businesses and their teams

• Business name, contact person, phone, email, billing details (and GST number, if you have one).
• Team logins: name, username, password (stored only as a one-way scrambled version), two-step login settings.
• A login record (time, device and internet address) to keep accounts safe and alert admins to new devices.
• Payments are handled by Razorpay. We see whether a payment succeeded, never your full card or UPI details.

Inside a business's inbox (on the business's behalf)

• WhatsApp messages, photos, videos, voice notes and documents sent to or from the business's number, with customer names and numbers.
• The team's internal notes, labels, owners and follow-ups.
• If connected: Shopify order and product details shown next to a chat (read from Shopify when needed and kept briefly), and courier bookings and tracking for returns.
• If AI help is switched on: AI summaries, suggested replies and flags, plus a count of AI use for the business's reports.

On this website

This website sets no cookies and uses no analytics or advertising trackers. Our web server keeps short technical logs (internet address, time, page) to keep it secure. The inbox itself uses one login cookie, needed to keep you signed in.

4. Why we use it

• To provide the inbox and the features the business has chosen.
• To keep accounts and data secure, detect misuse and fix problems.
• To bill, send invoices and keep the records Indian tax law requires.
• To answer support requests and tell businesses about changes to the service.

We never sell personal data, never use chats for advertising, and never use one business's data for another.

5. AI help

AI help is off until a business's admin switches it on, and the admin chooses which team members may use it. When it is used, the text of the chat concerned is sent to Anthropic (the maker of Claude) to write a summary or a suggested reply, or to check for complaints and urgent messages. Anthropic processes it under its commercial terms and does not use it to train its models.

6. Where data is kept and who helps us

Each business's inbox runs as its own separate copy on a server we rent from Hostinger in India. Every night a backup is made; a locked (encrypted) copy is kept off the server with Cloudflare R2 in its Asia-Pacific region. The key that unlocks those copies is held only by us, not on the server.

Shopify and courier companies are used only when a business connects its own account, and receive what that business's actions require. Some providers (such as Anthropic) may process data outside India; we use them only as allowed by Indian law.

7. How long we keep it

• Inbox data is kept while the business uses oneCommerce.
• When a business leaves, it can ask for an export. We then delete its inbox, and its backups on and off the server, within 30 days, unless the business asks us to keep it longer or the law requires otherwise.
• Billing records are kept for as long as Indian tax law requires (currently 8 years).
• Login records are kept for up to 1 year.

8. How we protect it

• A separate inbox copy for each business, with its own system user.
• Encrypted connections (https) everywhere, strict browser security settings, and protection against repeated login attempts.
• Optional two-step login, new-device alerts for admins, and customer numbers hidden on screen unless an admin allows them.
• Nightly backups, locked before they leave the server.
• Only we can reach the server; we look at a business's chats only when it asks us to for support.

9. Your rights

Under the DPDP Act you may ask to see the personal data we hold about you, have it corrected or completed, have it erased, withdraw consent where we rely on it, nominate someone to act for you, and complain to us. For data inside a business's inbox, the business decides; we pass your request on and help it respond.

Write to our Grievance Officer: Pratik Niranjan Pai, support@onecommerce.tech, Mumbai, Maharashtra, India. We acknowledge within 48 hours and aim to resolve within 15 days. If you are not satisfied, you may complain to the Data Protection Board of India.

10. If something goes wrong

If a security breach affects personal data, we will tell the affected businesses without delay, help them inform their customers, and notify the Data Protection Board of India and CERT-In as the law requires.

11. Children

oneCommerce is a service for businesses and is not meant for anyone under 18.

12. Changes

We will post any change to this policy here with a new date, and tell businesses by email or WhatsApp about important changes.