Privacy Policy

Last updated: 2026-09-24

This notice explains what personal data indbid collects, why, how long we keep it, and your rights. It follows the Digital Personal Data Protection Act, 2023 (DPDP Act) and its Rules, and the Information Technology Act, 2000 and its rules on reasonable security practices.

The Data Fiduciary (the one responsible for your data) is TODO: Proprietor legal name (exactly as on PAN), a sole proprietor trading as TODO: Trade name (as on Udyam/GST), TODO: Full address, City, State, PIN. Questions and requests go to our Grievance Officer, TODO: Grievance officer name, at TODO: grievance@indbid.in (see our Contact page).

The short version

• No accounts, no passwords, and no tracking or advertising cookies.
• We do not keep raw IP addresses in our database. Visitor location is recorded at state level only.
• You enter card, UPI and bank details on our payment gateway's checkout, not on indbid. We do not store them.
• Our database is in India (Mumbai).
• indbid is for adults (18+) only.

What we collect, why, and for how long

• Listing details: link, name, description, category, state or UT, language, and an optional PIN code. We use them to show your listing; everything except the PIN code is public. The PIN code is used only for district-level stats and is never shown. Kept while the listing is on the board. If a listing is rejected or removed, we keep its link and the reason, so that it cannot be listed again; for a paid listing we also keep the details that go with its payment records (see below). If you start a checkout but do not pay, the listing never goes live and we delete its details within 30 days.
• Email (optional): used to write to you about your own listing if needed (for example, a removal or refund) and, if you gave it before launch, to tell you once when paid spots open. If you give it at checkout, we also pass it to Cashfree so it can send your receipt. No newsletters or marketing. Kept until you ask us to delete it or your listing is deleted.
• Mobile number (at checkout): the payment gateway needs it to process your payment and send your receipt. We keep it with the order record to handle refunds, disputes and fraud checks. Kept as long as the payment record.
• Payment records: order ID, amount, date, status and the gateway's payment ID. We use them to rank listings, issue receipts and invoices, handle refunds and meet tax law. Kept for as long as tax and accounting laws require, currently up to 8 years.
• Visitor stats: when a page is viewed or a listing is clicked, we record the date, whether it was a view or a click, the listing, your state or UT and country (worked out by Cloudflare from your IP address), and a visitor code. The visitor code is a one-way hash of your IP address and browser details, mixed with a random key that changes every day. We delete each day's key within 2 days. After that, no one, including us, can link the code back to an IP address. We use these records only to count unique visitors and clicks and to show state-level totals. Kept while indbid operates, in this unlinkable form.
• Audit log: a timed record of every change to listings, orders and payments (for example "order created" or "payment received"), and of which part of our system made it, with order and listing IDs but no IP addresses, email addresses or phone numbers. Used for security, fraud checks and legal duties. Kept for at least 1 year, as the DPDP Rules require, and as long as the payment records it refers to.

Cloudflare, our host, sees your IP address and browser details when it delivers pages, blocks abuse, limits repeated requests and runs Turnstile (our check that you are human). We do not store your IP address in our database.

We never show who paid for a listing. Payment amounts and times for each listing are public on its page.

Why we are allowed to use it

We use your data with your consent, which you give on the listing and checkout forms. We also use it where the law allows without consent, for example to meet tax, payment and security laws, or to follow a court or government order.

Who we share it with

We do not sell your data or share it for advertising. These service providers (Data Processors) process it for us, only to run indbid:

• Supabase: our database, hosted in Mumbai, India.
• Cloudflare: hosting, content delivery, security and the Turnstile check. Cloudflare may process requests in data centres outside India to deliver pages quickly.
• Our email service provider: sends the few emails described above.

Our payment gateway, Cashfree Payments, processes your payment and sends your receipt. It receives your mobile number, your email if you give one, and the card, UPI or bank details you enter on its checkout. It handles them under its own privacy policy and RBI rules.

We may also share data when the law requires it, for example with a court, CERT-In or a government agency acting under a valid order.

Where your data is stored

All listing, order and payment records are stored in our database in India (Mumbai). Cloudflare keeps short technical logs of the site, which can include an order ID, and may store them outside India.

Cookies

indbid does not use tracking, analytics or advertising cookies. Cloudflare may set a cookie that is strictly needed for security and the Turnstile check. It is not used to track you.

Your rights

Under the DPDP Act, you can:

• Access: get a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
• Correct: ask us to correct, complete or update it.
• Erase: ask us to delete it. We will, unless the law requires us to keep it (for example, payment records under tax law).
• Withdraw consent: at any time, as easily as you gave it, with one email. We then stop using the data and delete it, unless the law requires us to keep it. If you withdraw consent for listing details, we remove the listing. Earlier use of your data stays lawful.
• Grievance redressal: complain to our Grievance Officer about how we handle your data.
• Nominate: name someone to use these rights for you if you die or cannot act yourself.

To use any right, email TODO: grievance@indbid.in from the email address on your listing, or include the order ID and the mobile number used at checkout, so we can check the data is yours. We acknowledge within 24 hours and respond within 7 days. If you are not satisfied with our answer, you can complain online to the Data Protection Board of India.

This notice is in English. To get it in any language listed in the Eighth Schedule of the Constitution, write to us.

How we protect it

• All traffic uses HTTPS.
• Our database tables are not open to the public. The site reaches them only through a few checked server functions, protected by a secret key.
• Within indbid, only the proprietor can access personal data.
• We keep only what we need: no raw IP addresses and no payment card data.

If a data breach affects you, we will tell you and the Data Protection Board of India without delay, and report it to CERT-In within 6 hours, as the law requires.

Children

indbid is only for people aged 18 or older. We do not knowingly collect data from anyone under 18. If you think a child has sent us personal data, tell us and we will delete it.

Changes

We will post any change to this policy here with a new date. If a change affects how we use data you have already given us, we will show a notice on the site first.