SSellerPapa™ Home
Legal

Data protection

Last updated: February 21, 2026

This page summarises how SellerPapa™ protects your data and meets its obligations under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and comparable international frameworks (GDPR-analog).

1. Data fiduciary

SellerPapa is the "Data Fiduciary" for personal data collected from account holders and their team members. You are the Data Fiduciary for the operational data (customers, orders, marketplace records) you sync into SellerPapa through your own connectors.

2. Encryption

  • In transit — TLS 1.2+ enforced on every API request.
  • At rest — all marketplace credentials, OAuth tokens, and platform OAuth-app secrets are stored using Fernet symmetric encryption with keys held in isolated env variables.
  • Session — httpOnly, Secure, SameSite=None cookies for authentication; bearer tokens on the client are never persisted.

3. Access controls

  • Role-based access on every API route (admin, founder, ops_manager, warehouse, procurement, support, accounts).
  • Sensitive admin actions (rotation of platform credentials, demo reset) are gated on role=admin and logged.

4. Sub-processors

See our Privacy policy §3 for the current list. We use only reputable providers, and we ensure they meet or exceed our own security posture.

5. Data localisation

By default we host in India-adjacent regions where possible. Some AI provider inference may occur in the US or EU; this is limited to a purpose-limited JSON snapshot of your dashboard state per Copilot query.

6. Backups & disaster recovery

  • Automated daily MongoDB snapshots retained for 30 days.
  • Documented restore procedure tested quarterly.
  • Application-level failover architecture on our hosting provider.

7. Incident response

We follow a documented incident-response process. In the event of a personal-data breach materially affecting you, we notify the affected users within 72 hours as required by the DPDP Act.

8. Your rights (as a Data Principal)

  • Access — request a copy of the personal data we hold about you.
  • Correction — request updates to inaccurate data.
  • Erasure — request deletion, subject to lawful retention.
  • Grievance redressal — reach our Data Protection Officer at hello@sellerpapa.com. We respond within 30 days.

9. Contact the DPO

Email hello@sellerpapa.com with subject "Data protection request", or call +91 97399 59565.