Introduction & Scope
Welcome to ShopChat AI, an innovative digital commerce, interactive live video streaming, and hyper-local community messaging platform developed and managed by One Group Pvt. Ltd. ShopChat AI connects buyers, neighborhood retail stores, wholesalers, manufacturers, and local service providers across India through real-time chat, live video streaming, voice search, location-based discovery, and digital storefronts.
This Privacy Policy ("Policy") describes how we collect, store, process, transfer, disclose, and protect personal data belonging to our users ("Data Principals" or "Users"), including buyers, business owners, content creators, and visitors. This document forms an integral part of our Terms of Service and is published in accordance with the provisions of the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
By accessing, installing, registering on, or using ShopChat AI (via our website, mobile application, or related API services), you confirm that you have read, understood, and consented to the practices described in this Privacy Policy.
1. Purpose of Data Collection
ShopChat AI collects and processes personal data strictly for lawful, specific, and transparent purposes directly connected to operating and improving our ecosystem. These purposes include:
1. User Identity & Account Administration
Onboarding users and verifying 10-digit Indian mobile numbers via One-Time Password (OTP) verification. Managing user credentials, authentication tokens (JWT), and regional preferences (State and District/City).
2. Operating Digital Storefronts & Marketplace
Enabling verified merchants and manufacturers to display catalog products, set prices and discounts, and showcase operational hours. Allowing buyers to discover nearby local stores and factories.
3. Real-Time Communication & Chatrooms
Powering 1-on-1 personal chat between customers and businesses (including product inquiries and delivery statuses), as well as public State and City Community Chatrooms to facilitate local commercial discovery.
4. Interactive Live Video Streaming (LiveKit WebRTC)
Facilitating low-latency live video and audio broadcasts by verified merchants and creators, enabling live comments, pinned product showcases, and time-limited live deal bookings ("Live Offers").
5. Voice Recognition & Regional Search
Enabling voice-assisted search and speech-to-text queries in Hindi, English, and regional languages via device speech recognition services.
6. Safety, Fraud Mitigation & Platform Integrity
Detecting and mitigating fraudulent registrations, counterfeit product listings, prohibited live broadcasts, spam, harassment, and unauthorized security breaches.
2. Legal Basis for Processing
In accordance with Section 4 and Section 6 of the DPDP Act, 2023, ShopChat AI processes personal data based on the following recognized legal grounds:
- Consent: We process personal data primarily based on your free, specific, informed, unconditional, and unambiguous consent, expressed through a clear affirmative action (such as checking an agreement box during registration or granting explicit operating system device permissions).
- Certain Legitimate Uses: Where permitted under Section 7 of the DPDP Act, including:
- Performing services voluntarily requested by the Data Principal (e.g., initiating a call attempt to a merchant upon user click).
- Responding to statutory court orders, judicial summons, or lawful requests by law enforcement agencies in India.
- Mitigating cybersecurity vulnerabilities, preventing fraud, and addressing network or system breakdowns.
3. Consent Management, Modification & Withdrawal
We believe in empowering users with transparent control over their personal data:
- Clear Affirmative Action: Registration cannot proceed without an affirmative selection confirming acceptance of this Policy.
- Granular Store Privacy: Merchants have granular toggle controls (
allowCallsandallowWhatsapp) to decide whether their direct phone number and WhatsApp contact buttons are visible to general buyers. - Community Chatroom Notifications: Push notifications for City and State Chatrooms are switched OFF by default. Users can manually opt-in or opt-out per room at any time.
- Withdrawal of Consent: You have the statutory right under the DPDP Act to withdraw your consent for future processing at any time by updating your account settings or emailing our Grievance Officer at
support@shopchatai.net. Withdrawal operates prospectively and does not invalidate prior lawful processing.
4. Protection of Children's Personal Data
ShopChat AI recognizes the heightened responsibility to protect children's privacy under Indian law:
- The platform is designed and intended for users aged 18 years and above.
- Minors (individuals under the age of 18) may only browse the platform under the direct supervision and verifiable consent of a parent or legal guardian.
- In strict adherence to Section 9 of the DPDP Act, 2023, we do not conduct behavioral monitoring, tracking, or targeted advertising directed at children, nor do we process any data likely to cause harm to a child.
5. Categories of Personal Data Collected
Depending on your role (Buyer, Business Owner, or Visitor), we collect:
- Identity Data: 10-digit mobile number, full name, display profile name, profile avatar photo.
- Business & Store Data: Business name, category, GSTIN/Udyam registration (for verified badge), business address, city, state, operating timings, product catalog photos, pricing, and contact visibility settings.
- Location Data: State and District/City chosen by the user or coarse device location to filter nearby shops, calculate distances, and assign relevant local chatrooms. We do not track precise background GPS location without explicit user permission.
- Communication & Chat Data: Encrypted 1-on-1 personal chat messages, state/city chatroom messages, uploaded media, voice notes, and live stream comments.
- Technical & Device Data: Device model, operating system version, IP address, unique device identifiers, FCM push tokens, and error logs.
6. Data Retention & 30-Day Erasure Guarantee
We retain personal data only for as long as necessary to fulfill the operational purposes for which it was collected or to comply with statutory legal, tax, and reporting obligations:
- Chat & Message Data: Retained to allow you to review conversation history. Users can delete individual messages or chat threads inside the app.
- Search History: Recent search queries can be cleared at any time by the user via the in-app search screen.
- Account Deletion & Data Erasure: Users have the right to request deletion of their account and associated personal data. Upon receiving an authenticated request, One Group Pvt. Ltd. will erase or permanently anonymize your personal data within 30 business days.
7. Rights of Data Principals under DPDP Act, 2023
As a Data Principal under the Digital Personal Data Protection Act, 2023, you enjoy the following enforceable statutory rights:
Right to Access (Section 11)
Obtain a summary of personal data being processed and identities of all entities with whom data has been shared.
Right to Correction & Erasure (Section 12)
Request correction of inaccurate data, updating of incomplete data, or complete erasure of unnecessary data.
Right of Grievance Redressal (Section 13)
Have all questions, complaints, and grievances redressed by our Grievance Officer in a time-bound manner.
Right to Nominate (Section 14)
Nominate an individual who, in the event of death or incapacity, shall exercise your rights as a Data Principal.
8. Grievance Redressal Officer & Contact Information
In compliance with Section 13 of the Digital Personal Data Protection Act, 2023, One Group Pvt. Ltd. has appointed a designated Grievance Officer:
Escalation to Data Protection Board of India (DPBI)
If you are not satisfied with the resolution provided by our Grievance Officer or if we fail to resolve your complaint within 30 days, you have the statutory right under Section 13(4) of the DPDP Act, 2023 to file a formal complaint with the Data Protection Board of India.
9. Governing Law & Jurisdiction
This Privacy Policy and any disputes or claims arising out of or in connection with the collection, storage, or processing of your personal data shall be governed by and construed in accordance with the laws of the Republic of India, specifically the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.
Subject to the statutory powers of the Data Protection Board of India, any legal actions, claims, or proceedings arising out of this Policy shall be subject to the exclusive jurisdiction of the competent courts in Kanpur, Uttar Pradesh, India.