Privacy
This is a practical draft, not a privacy notice that has been approved for publication. A lawyer needs to confirm the legal basis, retention, and the placeholders below.
Who to contact
[LEGAL_NAME], [REGISTERED_ADDRESS]. Privacy and support contact: [SUPPORT_EMAIL], [SUPPORT_PHONE]. GSTIN, if shown on the shop: [GSTIN].
What the shop stores
Phone sign-in uses Firebase Authentication. The verified phone number on the Firebase token is copied onto the customer profile. A number that is not verified is not stored as verified. Email is optional profile data and is not a second way to sign in.
The shop also stores the name you enter, delivery addresses, the cart, and orders. An order keeps a snapshot of the items, the address, the price, and any WhatsApp opt-in that was on the profile at checkout: the account, the time, and the purpose that was shown.
Card numbers are not stored. Razorpay handles the payment. The shop stores the Razorpay order id and, after capture, the payment id.
Who else receives data
Firebase hosts authentication, the database, and product images. Razorpay receives the amount and order reference when a payment is created. SMS, WhatsApp, and email are sent only when those providers are configured. If they are not configured, the shop records that the notice was skipped. It does not record a delivery that did not happen.
WhatsApp notices are prepared only when the order has an opt-in snapshot. Opting in does not by itself open a WhatsApp Business account.
Owner access
Owner phones are kept in a private allowlist that customers cannot read. A Cloud Function sets the owner claim from that list. Another customer cannot read your profile, addresses, cart, or orders.
Retention and requests
How long orders and account records are kept, and how you ask for access or deletion, will be added after lawyer review. The return window [RETURN_WINDOW] is also undecided. This shop is not built to sell personal information.