Privacy Policy

This Privacy Policy ("Policy") describes how Ideas Cloud LLP ("ZapU," "we," "our," or "us"), a limited liability partnership incorporated under the laws of India, collects, uses, stores, and discloses information when you use the ZapU platform ("Platform") or visit our website. By accessing or using the Platform, you agree to the collection and use of information in accordance with this Policy. If you do not agree, please discontinue use of the Platform. We may update this Policy from time to time. We will notify you of material changes via email or through the Platform. Continued use of the Platform after any update constitutes your acceptance of the revised Policy.

We collect the following categories of information: Merchant Information • Business name, registered address, GSTIN, and PAN • Contact details: name, email address, phone number • Payment and billing information (processed via third-party payment gateways — ZapU does not store full card details) • Account credentials (password stored in hashed form) Shopper Information (collected on behalf of Merchants) • Name, email address, and mobile number • Delivery addresses • Order history and transaction details • Device and browser metadata for fraud detection purposes Usage and Technical Data • IP addresses, browser type, device identifiers • Pages visited, time spent, clickstream data • API request logs and error reports We collect information directly from you when you register, through your use of the Platform, and automatically through cookies and similar technologies.

ZapU uses collected information to: • Provide, operate, and maintain the Platform and its features • Authenticate users and prevent unauthorised access • Process and fulfil orders placed through the checkout widget • Detect, prevent, and investigate fraud, chargebacks, and RTO (Return to Origin) risk • Send transactional communications (OTPs, order confirmations, billing receipts) • Send service announcements, product updates, and policy changes • Generate anonymised analytics and benchmarking reports for platform improvement • Comply with applicable legal and regulatory obligations ZapU does not sell your personal data to third parties. We do not use shopper data for any purpose beyond enabling the checkout experience as directed by the Merchant.

We may share your information with: • Merchants: Shopper information is shared with the relevant Merchant to fulfil the order. • Payment Gateways: Payment data is shared with your designated payment gateway (e.g., Razorpay, PhonePe, PayU) to process transactions. • Logistics Partners: Delivery address and order details may be shared with shipping providers for fulfilment. • Analytics and Infrastructure Providers: We use trusted third-party service providers (cloud hosting, monitoring, analytics) who process data on our behalf under data processing agreements. • Legal and Regulatory Authorities: We may disclose information when required by law, court order, or regulatory directive, or when necessary to protect our rights or the safety of users. • Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the successor entity. We will notify you before such a transfer occurs. All third-party service providers engaged by ZapU are required to maintain appropriate data protection standards.

ZapU stores data on servers located in India. We use reputable cloud infrastructure providers with appropriate security certifications. We retain personal data for as long as necessary to fulfil the purposes described in this Policy and to comply with applicable legal obligations: • Active account data: retained for the duration of the Merchant's subscription plus 90 days post-termination • Shopper transaction data: retained for a minimum of 5 years to comply with financial record-keeping requirements under Indian law • Log and audit data: retained for a minimum of 1 year After the applicable retention period, data is securely deleted or anonymised.

Ideas Cloud LLP implements reasonable technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration. These measures include: • Encryption of data in transit (TLS 1.2+) and at rest (AES-256) • Access controls and role-based permissions for internal staff • Regular security reviews and vulnerability assessments • Secure coding practices and dependency audits • Audit logs for all administrative actions No method of transmission over the internet or electronic storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that affects your rights or interests, we will notify you as required by applicable law.

ZapU uses cookies and similar tracking technologies to enhance your experience on the Platform. These include: • Essential cookies: Required for authentication, session management, and security. These cannot be disabled. • Functional cookies: Remember your preferences (e.g., language, dashboard settings). • Analytics cookies: Help us understand how the Platform is used, so we can improve it (e.g., page views, feature adoption). You can manage cookie preferences through your browser settings. Disabling non-essential cookies will not prevent you from using the Platform, but may affect certain features. We do not use third-party advertising cookies or serve targeted advertisements through the ZapU Platform.

Subject to applicable law, you have the following rights regarding your personal data: • Access: Request a copy of the personal data we hold about you. • Correction: Request correction of inaccurate or incomplete data. • Deletion: Request deletion of your personal data, subject to legal retention obligations. • Portability: Request your data in a structured, machine-readable format. • Objection: Object to certain processing activities (e.g., use of data for analytics). • Withdrawal of Consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing. To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. Identity verification may be required before we action a request.

The ZapU Platform is intended for use by business entities and individuals who are at least 18 years of age. We do not knowingly collect personal data from anyone under the age of 18. If you believe we have inadvertently collected information from a minor, please contact us immediately at [email protected] and we will delete such data promptly.

The Platform may contain links to third-party websites or integrations (e.g., payment gateways, eCommerce platforms). ZapU is not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party services you use in connection with our Platform.

This Policy is governed by the laws of India, including the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Any disputes arising from this Policy shall be subject to the exclusive jurisdiction of the courts in Mumbai, Maharashtra.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact our Grievance Officer: ZapU Email: [email protected] Phone: +91 8796182620 Business Hours: Monday – Saturday, 10:00 AM – 7:00 PM IST We will endeavour to respond to all privacy-related queries within 30 days.