Privacy Policy

1. Overview

This Privacy Policy explains how Tijarah (Tijarah, we, us) handles personal data when you use the Tijarah app on iOS or Android, the installable web app, or the website at tijarahapp.in (together, the Service). It is written to meet the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and the rules under them.

Tijarah is the data fiduciary for the data described here. Where a provider collects information from you directly to deliver a service, for example your delivery address for a tiffin, the provider is responsible for that data.

2. What we collect

Account and profile

Your mobile number (verified by OTP), name, profile photo, preferred language, city, and the EJamat ID you confirm to show community membership.

Provider verification

If you list a service, we also collect the details needed to verify you: your Aadhaar-based identity check performed through an authorised verification partner, a business or trade name, and the location of your business, which we may match against Google's place records. Section 6 explains exactly how Aadhaar data is handled.

Listings, reviews and messages

The services, prices, descriptions, photos, and deals you publish; the reviews and replies you write; and the messages you send and receive in Tijarah chat, including enquiries about a listing.

Location

Addresses you save (such as Home or Work) so search can start from them. If you allow it, your device's approximate location while the app is open, so we can show providers near you. You can turn this off in your phone's settings and search by city instead.

Payments

If you buy a paid provider feature, the payment is handled by Razorpay, UPI, or Apple. We receive a confirmation, the amount, and a transaction reference. We never see or store your full card number, UPI PIN, or bank credentials.

Device and usage

Device model, operating system, app version, push notification token, crash reports, and how you use the app: searches, listings viewed, chats started, and bookings made. For providers, this activity is what powers analytics and lead scoring (hot, warm, or cold) on their dashboard.

Support

Anything you send us when you contact support, report a bug, or flag a listing or review.

3. How we use it

• To run the Service: create and secure your account, show listings, enable chat, bookings, reviews, saved locations, and deals.
• To verify people: confirm community membership and, for providers, identity and business location, so badges mean something.
• To help providers grow: give them analytics about their own listing, score enquiries so they can prioritise, and run the sponsored placements and deals they pay for.
• To keep the community safe: moderate reviews and listings, detect fraud, fake accounts, and abuse, and enforce our Terms of Service.
• To talk to you: send OTPs, booking and chat notifications, service updates, and, if you opt in, news about Tijarah. You can turn marketing messages off at any time.
• To improve Tijarah: understand which features are used, fix crashes, and test changes.
• To meet legal obligations: keep the records the law requires and respond to lawful requests.

We do not sell personal data, we do not show third-party advertising in the app, and we do not use your data to build profiles for anyone else.

4. Our legal basis

Under the DPDP Act we process your data with your consent, which you give when you create an account, verify yourself, or grant a permission such as location. You can withdraw consent at any time (section 8), although we may then be unable to provide parts of the Service.

We also rely on the legitimate uses the Act permits, for example processing data you have voluntarily provided for the purpose you provided it, complying with a legal obligation, or responding to a medical emergency or a threat to safety.

5. Who we share it with

Other users

Your profile name, photo, city, and any listing, review, or reply you publish are visible to other Tijarah users. Your verification badges are visible; the documents behind them are not. When you chat with or book someone, they see the messages and details you choose to share with them. Your mobile number is shown to a provider only when you contact them or they need it to complete a booking.

Service providers who work for us

Companies that help us run Tijarah, under contracts that limit them to our instructions: cloud hosting and databases, SMS delivery for OTPs, push notification delivery, an authorised Aadhaar verification partner, Google Maps Platform for place matching and maps, payment processors (Razorpay and Apple), and crash and usage analytics tools.

Legal and safety

We may disclose data where the law requires it, to respond to a valid request from a court or government authority, to enforce our Terms, or to protect the rights, property, or safety of Tijarah, our users, or the public.

Business changes

If Tijarah is merged, acquired, or sells its assets, your data may transfer to the new owner, who must honour this policy or tell you before changing it.

6. Aadhaar and EJamat data

These are the most sensitive things we ask for, so we handle them differently from the rest.

• Purpose-limited. Aadhaar data is used only to verify a provider's identity once, and again only if re-verification is needed. It is never used for search, analytics, marketing, or lead scoring.
• Verified through an authorised partner. The identity check is performed by a verification partner authorised to do so. We store the result of the check and a reference to it, not a copy of your Aadhaar number or card image, beyond what the law and the verification process require.
• Never shown to others. No other user, and no provider, can see your Aadhaar or EJamat details. They see a badge.
• EJamat ID. Your EJamat ID is used to confirm community membership and is stored with your account so you do not have to enter it again. It is not shared with anyone outside Tijarah.
• Restricted access. Only a small number of Tijarah staff involved in verification can access these records, and access is logged.

7. How long we keep it

We keep your data for as long as your account is active. When you delete your account, we remove or anonymise your profile, listings, saved locations, chats, and verification records within 30 days, except where we must keep something for longer, for example:

• Records of paid transactions, kept for the period required under Indian tax and accounting law.
• Reviews you wrote, which are anonymised rather than deleted so that a provider's rating history stays honest.
• Data needed to investigate abuse, resolve a dispute, or comply with a legal request that is under way.

If your account is inactive for three years we will notify you and, if you do not return, delete it as the DPDP Act expects.

8. Your rights and choices

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you and how we have used and shared it.
• Correct or update data that is inaccurate or incomplete. Most profile and listing details can be edited directly in the app.
• Erase your data by deleting your account, subject to the retention rules in section 7.
• Withdraw consent for any processing that relies on it, including location access and marketing messages.
• Nominate another person to exercise these rights for you if you are unable to.
• Complain to our Grievance Officer, and if you are not satisfied with our response, to the Data Protection Board of India.

To use these rights, go to Settings in the app or email support@tijarahapp.in from the number or email linked to your account. We will respond within the time the law requires and will not treat you differently for asking.

Deleting your account: open the app, go to Settings, then Account, then Delete account. You can also email us and we will do it for you after confirming it is really you.

9. Security

Data travels between your device and our servers over encrypted connections, sensitive records are encrypted at rest, and access inside Tijarah is limited to people who need it for their job. Sign-in uses one-time passwords bound to your phone rather than a password that can leak.

No system is perfectly secure. If we learn of a breach that affects you, we will notify you and the Data Protection Board as the law requires. You can help by keeping your phone locked and by remembering that Tijarah will never ask you for an OTP on any channel.

10. Children

Tijarah is for adults. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, tell us and we will remove it.

11. Where your data is stored

Your data is stored on secure cloud infrastructure. Some of our service providers may process data on servers outside India. Where that happens we do so only as the DPDP Act and any restrictions notified under it allow, and with contractual protections in place.

12. App permissions

The app asks for permissions only when a feature needs them. You can change any of them in your phone's settings.

• Camera and photos: to add a profile picture or listing photos.
• Location: to show providers near you and to save addresses. Optional; you can search by city instead.
• Notifications: for OTPs, chat messages, booking updates, and deals. You can mute categories inside the app.

13. Cookies and the website

The tijarahapp.in website is a static site. It sets no tracking cookies and runs no third-party advertising. The download page reads your browser's user agent on your device to send you to the right app store; nothing is sent to us. The App Store and Google Play have their own privacy policies for the download itself.

14. Changes to this policy

We will update this policy when our practices or the law change. For material changes we will notify you in the app before they take effect. The date at the top of this page shows when the current version came into force.

15. Contact and Grievance Officer

Questions about this policy or your data: support@tijarahapp.in.

Our Grievance Officer, Tijarah, appointed under the Information Technology Act, 2000 and the DPDP Act, 2023, can be reached at support@tijarahapp.in or by post at Tijarah, Mumbai, Maharashtra, India. We acknowledge grievances within 48 hours and aim to resolve them within one month.