Privacy Policy

1. Information We Collect

Information you provide directly

• Account information — name, business email, password when you register.
• Business information — store name, business type, GST number, bank details for payouts.
• Payment information — billing address, payment method details (processed securely by Razorpay — we do not store raw card numbers).
• Communications — messages you send to our support team.

Information collected automatically

• Usage data — pages visited, features used, time spent, clicks.
• Device information — IP address, browser type, operating system, device identifiers.
• Log data — server logs, error reports, API requests.
• Cookies — session cookies, preference cookies, analytics cookies (see Section 4).

Information from third parties

• Google OAuth — if you sign in with Google, we receive your name, email address and profile picture from Google.
• Payment processors — Razorpay may share transaction status and dispute information.
• Shipping partners — Shiprocket, Delhivery and others may share delivery status data.

2. How We Use Your Information

We use your information to:

• Create and manage your merchant account.
• Provide, operate and improve the EZStore platform.
• Process payments and payouts to your bank account.
• Send transactional emails (order confirmations, payment receipts, account alerts).
• Send product updates and marketing communications (you can opt out at any time).
• Detect and prevent fraud, abuse and security incidents.
• Comply with applicable laws and regulations, including Indian tax law.
• Respond to your support requests.
• Analyse usage patterns to improve product features.

We rely on the following legal bases for processing: contract performance (to provide the service you signed up for), legitimate interests (security, fraud prevention, product improvement) and consent (marketing emails).

3. Sharing Your Information

We do not sell your personal data. We share it only in these circumstances:

• Service providers — Supabase (database & auth), Razorpay (payments), Shiprocket/Delhivery (shipping), Vercel (hosting), AWS/Google Cloud (infrastructure). These providers are contractually bound to protect your data.
• Legal requirements — when required by Indian law, court order or government authority.
• Business transfers — if FixedLayer Labs Private Limited is acquired or merges, your data may transfer as a business asset. We will notify you beforehand.
• With your consent — any other sharing requires your explicit consent.

4. Cookies & Tracking

We use the following types of cookies:

• Essential cookies — required for login sessions and security. Cannot be disabled.
• Preference cookies — remember your settings and preferences.
• Analytics cookies — help us understand how the platform is used (e.g. page views, feature adoption). We use privacy-friendly analytics.
• Marketing cookies — used only if you have consented to receive personalised communications.

You can control cookies through your browser settings. Disabling essential cookies will prevent you from signing in.

5. Data Retention

• Account data — retained for as long as your account is active, plus 90 days after deletion to allow account recovery.
• Transaction records — retained for 7 years as required by Indian financial regulations.
• Log data — retained for 90 days.
• Marketing data — retained until you unsubscribe or withdraw consent.

To delete your account, contact us at support@fixedlayer.com.

6. Security

We implement industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest, role-based access controls, and regular security audits. Passwords are hashed using bcrypt and never stored in plain text.

Despite these measures, no system is 100% secure. Please use a strong, unique password and enable two-factor authentication when available. Report any suspected security issues to legal@fixedlayer.com.

7. Your Rights

Under applicable Indian law (IT Act 2000, DPDP Act 2023) and, where applicable, GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Deletion — request deletion of your data (subject to legal retention obligations).
• Portability — receive your data in a machine-readable format.
• Withdraw consent — for marketing communications, unsubscribe at any time via the link in any email.
• Restrict processing — object to certain uses of your data.

To exercise any right, email legal@fixedlayer.com. We will respond within 30 days.

8. Third-Party Services

EZStore integrates with third-party services including Razorpay, Shiprocket, Google, WhatsApp Business API, and others. When you use these integrations, their own privacy policies apply. We encourage you to review them:

• Razorpay Privacy Policy
• Shiprocket Privacy Policy
• Google Privacy Policy

9. Children's Privacy

EZStore is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us immediately at legal@fixedlayer.com and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and/or by displaying a prominent notice on the platform at least 14 days before the changes take effect. Continued use of EZStore after changes take effect constitutes acceptance of the updated policy.

11. Grievance Officer

In accordance with the Information Technology Act 2000 and the rules made thereunder, the name and contact details of our Grievance Officer are:

12. Contact Us

For any privacy-related questions or concerns: