Privacy Policy

Sailwynd("we", "our", or "us") is committed to protecting your personal data. This Privacy Policy explains what information we collect when you use our platform, how we use it, and your rights under the Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable laws.

1. Who This Policy Applies To

This policy applies to merchants— businesses and individuals who register and use Platform to operate an online store. If you are a customer shopping at a store powered by Platform, your data is controlled by that store's merchant, not by us directly.

2. Information We Collect

Account Information

When you create a Platform account, we collect:

Name and email address
Store name and subdomain slug
Password (stored as a bcrypt hash — we never store plaintext passwords)
Contact phone number (optional)

Billing & Subscription Information

When you subscribe to a paid plan, payment is processed by our authorised payment partners. We do not store your card number, UPI VPA, or full bank details. We store only:

Subscription plan and billing cycle
Payment status and invoice history
A payment gateway customer ID for managing your subscription

Store Configuration & Content

We store the configuration, products, pages, orders, and customer data you enter into your store. You remain the controller of this data; we process it on your behalf as a data processor.

Technical Data

IP address at login (for security and fraud prevention)
Browser and device type (from HTTP headers)
Pages visited within the admin dashboard (if we introduce analytics)

3. How We Use Your Information

To provide the service: create your store, process your orders, calculate shipping and tax
To manage your subscription: billing, plan changes, trial reminders
To send transactional emails: account confirmations, password resets, invoices
For security: detect and prevent fraud, abuse, and unauthorised access
To improve Platform: anonymised usage analytics to understand which features are used

We do not sell your personal data. We do not use it for advertising.

4. Data We Process on Your Behalf

Your store collects personal data from your customers (names, addresses, phone numbers, order history). As a data processor under the DPDP Act, we:

Process this data only as instructed by you
Apply appropriate security measures (encryption at rest and in transit)
Do not share it with third parties except subprocessors necessary to run the service (hosting, email delivery)
Delete it when you terminate your account (within 30 days of closure)

You are responsible for obtaining valid consent from your customers and maintaining a privacy policy on your storefront that reflects your data practices.

5. Cookies & Local Storage

We use essential cookies and browser storage solely to keep you signed in and maintain your session. These are strictly necessary for the Service to function and are deleted when you sign out.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. No data from our cookies is shared with advertising networks.

6. Third-Party Subprocessors

We share your data with third-party subprocessors to operate the service. The current list of subprocessors is maintained separately and may be updated from time to time. Key categories include:

Payment processors — for processing subscription and merchant payments
Email delivery providers — for transactional emails (confirmations, invoices, alerts)
Infrastructure and CDN providers — for hosting, content delivery, and DDoS protection

For the current list of subprocessors, including their names and data processing locations, email us at privacy@sailwynd.com. We will notify you of any material changes to our subprocessor list at least 14 days in advance.

7. Data Retention

Account data is retained while your account is active
After account closure, data is deleted within 30 days
Billing records are retained for 7 years for tax and legal compliance
Security logs (failed logins, IP records) are retained for 90 days

8. Your Rights

Under the DPDP Act 2023 and applicable laws, you have the right to:

Access the personal data we hold about you
Correct inaccurate data
Erase your account and associated data
Data portability — export your store's data in CSV format
Withdraw consent — where processing is based on consent

To exercise any of these rights, email us at privacy@sailwynd.com.

9. Data Security

We protect your data with:

TLS encryption for all data in transit
AES-256 encryption for sensitive fields at rest (API keys, webhook secrets)
bcrypt password hashing
Role-based access controls within Platform staff
Regular security audits

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email to account holders at least 14 days before taking effect. Continued use of Platform after that date constitutes acceptance of the updated policy.

11. Contact Us

For privacy-related questions or to exercise your rights:

Email: privacy@sailwynd.com
Address: Sailwynd, India