Privacy Policy

IndieLane is an online marketplace for handmade goods that connects buyers with independent sellers. For the data described here we act as the data controller (or Data Fiduciary under the DPDP Act).

Sellers act as independent controllers for data they receive to fulfil your order — principally your name and delivery address.

• Account data — name, email address, password (stored only as a bcrypt hash, never in readable form), and optionally a phone number, profile photo and bio.
• Order data — items purchased, delivery address, order status, and the amount paid.
• Payment data — handled by our payment provider, Cashfree Payments. We receive confirmation of payment and a transaction reference. We never receive or store your full card number.
• Content you create — reviews, messages to sellers, support tickets, and problem reports raised against an order.
• Usage data — items you view, searches you run, and your wishlist, used to make the marketplace more useful to you.
• Seller data — if you open a shop, your shop details, listings, fulfilment records and payout ledger.

• To perform our contract with you — creating your account, processing orders, arranging delivery, and handling returns or disputes.
• Legitimate interests — keeping the marketplace secure, preventing fraud and abuse, and improving how the site works.
• Legal obligation — retaining transaction and tax records for the period the law requires.
• Consent — optional analytics storage and marketing email. You can withdraw consent at any time without affecting the rest of the service.

We share personal data only where it is necessary, and never sell it.

• Sellers — receive the delivery details needed to fulfil your order, and your display name on any review you leave.
• Cashfree Payments — to take payment and issue refunds.
• Microsoft Azure — hosting and file storage.
• Email delivery provider — to send transactional email such as order confirmations and password resets.
• Authorities — only where we are legally required to.

• Account data — until you delete your account.
• Order and invoice records — retained after account deletion where tax and accounting law requires it, in a form that no longer identifies you personally.
• Messages, reviews and support history — kept while your account is open; anonymised on deletion.
• Search history — you can clear this yourself at any time.

You can exercise all of the following from Account settings or by contacting us.

• Access and portability — download a complete copy of your data as a structured JSON file, at any time, immediately.
• Correction — update your profile details yourself.
• Erasure — delete your account. Your personal details are removed and remaining records are anonymised, except where retention is legally required.
• Withdraw consent — change your cookie choice or turn off marketing email in your notification preferences.
• Object or restrict — ask us to stop a particular use of your data.
• Complain — to the Data Protection Board of India, or your local supervisory authority if you are in the EU or UK.

Passwords are hashed with bcrypt and are never recoverable in readable form. Access to the API requires a signed, expiring token. Traffic is served over HTTPS, requests are rate limited to resist brute-force attempts, and the database is hosted in Microsoft Azure with encryption at rest.

Where data is transferred outside your country, we rely on the transfer mechanisms permitted under applicable law.

We use a small amount of strictly necessary browser storage to keep you signed in, remember your cart, and show recently viewed items. This is required for the site to function and cannot be switched off.

Optional storage — used to understand how the site is used — is only set if you accept it in the cookie banner. Choosing "Essential only" leaves the marketplace fully usable.

Analytics: if you choose "Accept all", we load Google Analytics, which sets cookies to count visits and see which pages are used. With "Essential only" it is never loaded.

Error monitoring: to find and fix bugs, technical details of errors (the page, browser and what went wrong) are sent to our error-tracking provider, Sentry. This sets no cookies and we configure it not to collect your name, email or IP address.

The marketplace is not directed at children. You must be at least 18 to sell on the platform. If we learn that we hold data from a child in circumstances that require consent we have not obtained, we will delete it.

If we make a material change we will update the date at the top of this page and, where the change significantly affects your rights, notify you directly.