Privacy Policy

1. Scope and roles

This Privacy Policy explains how THULI ("we", "us", or "our") handles personal information for the Ecommerce One Portal—including the marketing site, login, onboarding, customer portal, platform administration, hosted storefronts, and store admin tools.

Platform users (people who sign up, subscribe, or manage a store with THULI): we determine how Platform account and billing data is processed for providing the Service.

Store owners / merchants: when your store collects shopper data (orders, addresses, contact details, etc.), you are responsible for providing privacy notices to your shoppers and for lawful use of that data. We host and process that data on your behalf to operate your store.

Shoppers: if you buy from a merchant store hosted on THULI, the merchant is primarily responsible for how your purchase data is used for fulfilment and customer service. We process that data to host checkout, orders, accounts, and payments integrations for that store. Review the merchant's own policies on their storefront where provided.

2. Data we collect

Depending on how you use the Platform, we may collect:

• Account and profile data — name, email, phone, avatar, and authentication identifiers from Google sign-in (or other providers we enable)
• Business and onboarding data — company name, tenant slug, domain, template and plan choices, contact details, and notes needed to provision a store
• Billing and subscription data — plan, subscription status, payment references, and Razorpay identifiers for Platform fees. Card, UPI, and similar credentials are collected by Razorpay and are not stored by us.
• Payment connection data — when a merchant connects a Razorpay account, we store the Razorpay account identifier, connection status, who connected it, and encrypted access and refresh tokens used only to run that store's checkout
• Store configuration and content — brand settings, CMS content, catalog, policies, shipping and GST settings, and uploaded media (for example product images in our storage)
• Commerce data — carts, wishlists, orders, shipping addresses, phone numbers, payment method (online via Razorpay or cash on delivery), payment references, GST and shipping amounts from the merchant's settings, and order status history
• Technical and security data — IP address, device/browser information, approximate logs, and security events needed for reliability and abuse prevention
• Communications — messages you send us by email, phone, or WhatsApp

3. How we use data

We use personal data to:

• Create and manage accounts, roles, subscriptions, and stores
• Process Platform subscription payments and prevent fraud or misuse
• Connect, refresh, and disconnect a merchant's Razorpay account so shoppers can pay online, and record the order after payment succeeds
• Host storefronts, checkout, orders, and merchant payment flows
• Show merchants analytics derived from their own orders, such as sales, products, and locations
• Provide support and respond to enquiries
• Operate, secure, debug, backup, and improve the Platform
• Enforce our Terms, protect rights and safety, and meet legal obligations
• Send service-related notices (for example billing or security messages)

We do not use Platform data to sell personal information to third parties for their independent marketing.

4. Legal bases (where applicable)

Depending on applicable law (including India's Digital Personal Data Protection Act, 2023, where it applies), we process personal data with consent where required, or as needed to perform a contract with you, to comply with law, or for legitimate uses such as securing the Service and preventing abuse—subject to your rights under those laws.

5. Sharing and processors

We may share data with:

• Payment providers — Razorpay. Platform subscription fees are charged on our billing account. Store checkout, after a merchant connects Razorpay, is created on that merchant's Razorpay account. For a store payment we send Razorpay the amount, currency, and a short-lived checkout record that can include the shopper's name, email, phone, shipping address, and order lines, so the order can be saved after payment succeeds. The checkout screen may also prefill name, email, and phone in Razorpay's payment window. Payment credentials are entered with Razorpay. Funds for store sales settle to the connected Razorpay account under the merchant's agreement with Razorpay. Razorpay's privacy policy applies to data it processes.
• Infrastructure providers — including database, authentication, and file storage (for example Supabase), and application hosting / custom domains (for example Vercel), which process data on our instructions
• Identity providers — Google, for sign-in
• Merchants — shopper order and account data is available to the store owner/admins of the relevant tenant so they can fulfil and support orders
• Authorities and professional advisers — when required by law, court order, or to protect rights, safety, and integrity of the Service

WhatsApp or phone links on our sites open your device's messaging or calling apps; if you contact us that way, the provider's own terms and privacy rules apply to that channel.

We do not sell your personal information.

6. Store owner and shopper data

Order, address, and customer-account data for a store is stored in our systems so the store can operate. Merchants must use that data only for lawful store operations and must not misuse shopper data. Merchants are responsible for their own privacy notices, consents, and retention practices toward shoppers where the law requires it. If online payments are offered, that notice should say payments are processed by Razorpay.

Connecting Razorpay authorizes us to use that connection only to operate the store's online checkout, including creating payment orders and confirming payment status. The merchant can disconnect in store admin. If the merchant revokes access in Razorpay, we stop using the connection when we are notified and clear the stored tokens.

Platform administrators may access tenant data as needed to operate, support, secure, or administer the Platform (including entitlement and abuse handling).

7. Cookies and similar technologies

We use cookies and similar technologies for:

• Authentication and session continuity (including identity-provider cookies)
• Onboarding or short-lived flow state (for example progress through setup)
• Security and load balancing as provided by our hosting stack

We do not currently rely on third-party advertising pixels as a core part of the Product. You can control cookies through browser settings; disabling essential cookies may break login, checkout, or admin access.

8. Retention

We retain account, billing, and order records for as long as needed to provide the Service and for legal, tax, accounting, dispute-resolution, and security purposes. After account closure or store deletion, we may retain limited records as required by law or for legitimate residual purposes, then delete or anonymize them when appropriate.

Razorpay connection tokens are kept while the connection is active and are cleared when the merchant disconnects or when Razorpay tells us the authorization was revoked. Order and payment references are kept with the related order records. Operational logs are typically kept for shorter windows unless a longer period is needed for investigations.

9. Security

We use reasonable technical and organizational measures appropriate to a multi-tenant hosting Platform, including access controls, encrypted transport in normal configurations, and encryption of stored Razorpay access and refresh tokens. No method of transmission or storage is completely secure. Use strong account credentials, protect devices you use to sign in, and notify us of suspected unauthorized access.

10. Your choices and rights

Subject to applicable law, you may request access, correction, updating, or deletion of personal data we hold about you as a Platform user, or withdraw consent where processing is consent-based. Contact us using the details below. We may need to verify your identity and may decline or limit requests where we must keep data for billing, legal, security, or other permitted reasons.

Shoppers seeking deletion or correction of order data should generally contact the merchant first; we can assist merchants or act where we are required or able to do so as host.

Self-serve account deletion may not be available in-product for all roles. You may request closure by contacting us. Merchant store data deletion may affect live storefronts and order history.

11. Children

The Platform is intended for business users and adults. We do not knowingly create store-owner accounts for children under 18. Merchants must not target or knowingly sell to children in ways that violate applicable law. If you believe we have collected a child's data inappropriately, contact us and we will take reasonable steps to address it.

12. International and cross-border processing

We are based in India. Data may be processed in India and in other locations where our service providers (for example hosting, database, auth, or payment infrastructure) operate. Where required, we take steps appropriate to the context to protect personal data when transferred.

13. Changes

We may update this Policy. The "Last updated" date at the top will change when we do. Continued use of the Platform after an update means you acknowledge the revised Policy. If changes are material, we may provide additional notice through the Service or email where appropriate.

14. Related terms

Use of the Platform is also governed by our Terms & Conditions.

15. Contact

Privacy questions or data requests: thuli.edu@gmail.com or +91 81228 97170. Address: Korattur, Chennai, India.