Your data, handled with care

CCKart is a cloud platform for retail businesses: a billing counter (POS), an online store and app, delivery, inventory and purchasing, billing and accounting, HR and payroll, CRM and water-can subscriptions. In this policy, “CCKart”, “we” and “us” mean that business.

This policy covers this website, signing up for CCKart, and using the CCKart platform: the web portal, the mobile and delivery apps, the POS counter app and attendance kiosks.

Under India’s Digital Personal Data Protection Act, 2023, we act in two different roles:

• For our own customers (business owners who sign up, their staff who sign in, and visitors to this website) we decide how personal data is used, so we are the data fiduciary.
• For the data a store keeps in CCKart about its own customers and employees (orders, addresses, payroll, attendance and so on) the store decides how it is used. The store is the data fiduciary, and we process that data on its behalf and only on its instructions, as its data processor. If you are a shopper or an employee of a store that uses CCKart, please contact that store first; we will help it answer you.

When you visit this website. We don’t use analytics, advertising or tracking cookies. Our hosting and security provider records technical details of each request (such as IP address, browser and the page asked for) to keep the site running and protect it from abuse.

When you sign up or contact us.

• Business details: business name, your store’s web address, GSTIN if you give one, and the plan you’re considering.
• Owner details: your name, work email, mobile number and a password (stored only as a one-way hash).
• Mobile verification: a one-time password sent by our SMS provider to confirm the number is yours.
• What you write to us, for example in a demo request or a support email.

When you and your staff use the platform.

• Staff accounts: name, mobile number, email, role and the store locations they work at.
• Activity and security records: sign-ins, important actions (such as voiding an invoice or changing someone’s access) with the time and IP address.
• Devices: details of POS counters and attendance kiosks you register, and notification tokens for phones and browsers that turn on alerts.
• Plan billing: your plan and payment status. Card and UPI details are entered with our payment provider; we never see or store full card numbers.

Data your store keeps in CCKart (we process this as your data processor):

• Customers: names, mobile numbers, email, delivery addresses and map locations, orders, invoices, payments, wallet balances, loyalty points, subscriptions and reviews.
• Employees: HR records such as contact details, ID documents, bank details, salary, attendance, leave and payslips.
• Attendance by face: if a store turns on face check-in at its kiosks, a face template and a photo are used to confirm who is punching in, and a photo is kept with each punch. Stores must tell their employees and get their consent before using it.
• Delivery and location: delivery routes, stops and proof of delivery.
• Messages: WhatsApp conversations with the store’s customers, if the store connects its WhatsApp Business number.
• Supplier invoices: bills the store scans or emails in, which may contain names and contact details of suppliers.

• To provide the platform: create and run your store, process orders, invoices, deliveries, payroll and the other features you use.
• To verify identity and keep accounts secure: one-time passwords, role-based access, and detecting misuse such as repeated failed sign-ins.
• To bill for your plan and send invoices, receipts and payment reminders.
• To send service messages: sign-in codes, order and delivery alerts, and important notices about your account. We don’t send marketing to your store’s customers on our own behalf.
• To provide support when you ask for it, which may mean looking at your store’s records to understand the problem.
• For AI features you choose to use (such as the AI assistant and reading supplier invoices), to send the content needed for that request to our AI provider and return the result.
• To meet legal obligations, such as keeping tax and invoice records and responding to lawful requests.
• To improve the product using aggregated or de-identified usage information that doesn’t identify you.

We rely on your consent, or on the uses the law allows without separate consent (such as providing a service you asked for or meeting a legal obligation). Where we rely on consent you can withdraw it at any time; this won’t affect what happened before, but some features may stop working.

We don’t sell personal data or share it for advertising. We share it only with service providers who help us run CCKart, under contracts that limit them to providing that service:

• Cloud hosting, databases and file storage (including Railway and Cloudflare).
• Website delivery and security (Cloudflare).
• SMS and one-time passwords (MSG91).
• Email delivery (Google).
• Maps and address search (Google Maps).
• App and browser notifications (Expo, Google Firebase and the browser makers’ push services).
• Payments for plans (Razorpay), and payment and accounting services a store chooses to connect, such as Zoho.
• WhatsApp messaging (Meta), when a store connects its WhatsApp Business number.
• AI features (Anthropic), when you use them.

We may also disclose data when the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or sale of our business (in which case this policy will continue to apply to your data).

Some of our service providers process data outside India. We only transfer personal data to countries the Government of India has not restricted, and we require providers to protect it to the standard this policy describes.

We keep personal data for as long as your account is active and as long as needed for the purposes above. When a store closes its account, we delete or anonymise its data after a short period that lets the store change its mind or ask for a copy, except records we must keep by law, such as tax and invoice records, which we keep for the period the law sets. Security records are kept for a limited time to investigate misuse.

• Every connection to our servers is encrypted (HTTPS).
• Passwords are stored only as one-way hashes; connection secrets for services like Zoho and WhatsApp are stored encrypted.
• Each store’s data is kept apart from other stores’, and every request is checked against the person’s role and permissions.
• Sensitive actions are recorded in an audit log the store’s admins can review.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.

Under the Digital Personal Data Protection Act, 2023, you can:

• Ask for a summary of the personal data we hold about you and how it is used.
• Ask us to correct, complete or update it.
• Ask us to delete it, unless we must keep it by law.
• Withdraw consent you have given.
• Nominate someone to exercise these rights for you if you die or become unable to.
• Raise a grievance with us, and if you’re not satisfied, with the Data Protection Board of India.

To use any of these rights, write to support@cckart.com. We may need to confirm your identity first. If your data was added by a store (for example you are its customer or employee), we will pass your request to that store and help it respond.

This website doesn’t set tracking or advertising cookies. It remembers only your light or dark display choice in your browser. The CCKart portal and apps keep your sign-in and a few preferences (such as the store you chose and display settings) on your device so you stay signed in; signing out removes them.

CCKart is a service for businesses and isn’t meant for children. We don’t knowingly collect personal data directly from anyone under 18. If you believe a child has given us personal data, please contact us and we will delete it.

We will update this policy when our practices change. The date at the top shows the latest version. If a change significantly affects how we use your personal data, we will tell store owners by email or in the portal before it takes effect.

For questions, requests or complaints about privacy, contact our grievance officer:

We will acknowledge your message promptly and respond within the time the law requires. For anything else, see our contact page.