Privacy Policy

Last updated: August 31, 2026

At Stallio (“we,” “us,” or “our”), we are committed to protecting your privacy and ensuring the security of your personal data in compliance with India's Digital Personal Data Protection (DPDP) Act 2023. This Privacy Policy outlines how we collect, use, disclose, and safeguard your information when you use our multi-tenant SaaS commerce platform, website, applications, APIs, and related services (collectively, the “Service”).

In operating our Service, Stallio serves a dual-role: we act as a Data Fiduciary for the personal data of Sellers who register on our platform, and as a Data Processor for the personal data of Merchant Customers who purchase from Seller storefronts.

1. Information We Collect

We collect the following categories of personal data based on your interaction with the Service:

  • Seller Account Data: Name, email address, password, phone number (optional, for WhatsApp order alerts), and Google OAuth profile (if registering via Google).
  • Store Content: Product listings, images, and pricing uploaded to storefronts.
  • Customer Data (via storefronts): Full name, phone number, email address, shipping address, city, state, pincode, payment method, order items, and Razorpay payment IDs provided during checkout.
  • Usage & Technical Data: IP address, browser type, session cookies, and pages visited on the platform.
  • Support Communications: Jira ticket content, including customer name and email address when raising support tickets.

2. Purpose of Processing

We process your personal data for the following specific purposes:

  • Seller Account Data: To facilitate account creation, authenticate logins, provide platform access, and send WhatsApp order alerts.
  • Customer Data: To process order fulfillment, manage shipping, send order confirmations, and share details with the respective Seller to fulfill the order.
  • Payment Data: To facilitate payment processing via Razorpay.
  • Technical Data: To ensure platform security, monitor performance, and manage user sessions.
  • Support Data: To manage and resolve customer support tickets via Atlassian Jira Service Management.

3. Sellers as Data Fiduciaries for their Customers

When Customers purchase from a Stallio storefront, the respective Seller acts as the Data Fiduciary for that Customer's information under the DPDP Act. Stallio acts solely as a Data Processor on behalf of the Seller.

Customer name, phone number, shipping address, and order details are shared with the respective Seller to fulfill the order. This sharing is a core and disclosed purpose of the Service. Sellers are responsible for ensuring their own compliance with the DPDP Act regarding the customer data they collect and process through their store.

4. Third-Party Sub-processors

To provide our Service, we utilize the following third-party sub-processors:

  • Supabase (Ireland/USA): Database hosting, user authentication, and file storage.
  • Razorpay (India): Payment processing and marketplace split payouts.
  • Resend (USA): Transactional email delivery (such as verification, password resets, and welcome emails).
  • Google (USA): OAuth authentication for Seller sign-in and sign-up.
  • Atlassian/Jira (USA/Australia): Support ticket management; customer name and email may be included in support ticket details.

5. Your Rights as a Data Principal (DPDP Sections 11-14)

Under the DPDP Act, you have the following rights regarding your personal data:

  • Right to Access: You may request a summary of your personal data being processed by us and the identities of all Data Fiduciaries/Data Processors with whom the personal data has been shared. Email grievance@stallio.com with the subject 'Data Access Request'.
  • Right to Correction: You may request correction of inaccurate or misleading data. You can update your details in your Account Settings or email grievance@stallio.com.
  • Right to Erasure: You may request the deletion of your account and personal data. Email grievance@stallio.com. Deletion will be executed within 30 days, subject to our legal retention obligations.
  • Right to Nominate: You have the right to nominate any other individual to exercise these rights on your behalf in the event of your death or incapacity. Email grievance@stallio.com to register a nominee.
  • Right to Withdraw Consent: You may withdraw your consent for non-essential data processing at any time by emailing grievance@stallio.com. Note that withdrawing consent for core service data may result in account deactivation or inability to use the Service.

6. Grievance Redressal (DPDP Section 13)

If you have any grievances or questions regarding our privacy practices, you may contact our designated Grievance Officer:

We aim to acknowledge your grievance within 48 hours and resolve it within 30 days. If your grievance remains unresolved, you have the right to escalate the matter to the Data Protection Board of India at https://dpboard.gov.in.

7. Cookie Policy

Stallio uses necessary functional cookies to maintain authentication sessions and ensure platform security (e.g., 30-day expiry session cookies). We do not currently set or use any third-party advertising or tracking cookies on our platform.

8. Data Retention

We retain your data only for as long as necessary to fulfill the purposes outlined in this policy or as mandated by law:

  • Active account data: Retained for the duration of your active account, plus 90 days after a deletion request is initiated.
  • Order and transaction records: Retained for 7 years to comply with the Income Tax Act and GST Act.
  • Support ticket records: Retained for 3 years.
  • Session cookies: Retained for 30 days for customers and 1 year for sellers.

Data is securely deleted upon purpose fulfillment or upon valid withdrawal of consent, subject to any prevailing legal mandates requiring retention.

9. Cross-Border Data Transfers

Certain sub-processors such as Supabase, Resend, Google, and Atlassian operate internationally. We execute Data Processing Agreements (DPAs) with each entity to ensure the security of your data. We do not transfer personal data to any countries explicitly restricted by the Central Government under the DPDP Act.

10. Children's Data

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from persons under 18. By using the platform, you confirm that you are 18 years of age or older. If you are a parent or guardian who believes your child's data was collected inadvertently, please contact grievance@stallio.com immediately so we can delete the information.

11. Policy Updates

We may update this Privacy Policy from time to time. Significant changes will be communicated via email or through a prominent notice on the platform. Continued use of the Service following such updates constitutes acceptance of the modified policy.

12. Contact & Governing Law

This Privacy Policy is governed by the laws of India. Any disputes arising under this policy shall be subject to the exclusive jurisdiction of the courts of India.

Built for modern social sellers and small businesses.