Privacy Policy

1. Who We Are

Dot2Dot Technology Private Limited, CIN U62099KA2025PTC212480, registered office at 677, 29th Main Road, 2nd Stage, BTM Layout Post, Bannerghatta Road, Bangalore South, Bangalore - 560076, Karnataka, India, is the Data Fiduciary for personal data processed through the App, within the meaning of the DPDP Act, 2023.

The SHOPPER 2.0 App is operated by Dot2Dot Technology Private Limited, whose corporate website is https://www.dot2dot.in. Privacy requests for the App may be sent to the Grievance Officer in Section 15.

2. Categories of Personal Data We Collect

• Account data: email address, name (optional), and either a password (stored only as a one-way Argon2id hash, never in readable form) or the Google account identifier if you sign in with Google; profile picture (optional).
• Searches: the words you type or say, and your last 5 searches with whether you typed, spoke or used a photo, so you can run them again.
• Usage data: products you view, skip, save, compare or open to buy, videos you play, and how long you look at a product, linked to your account when you are signed in.
• Wishlist and settings: products you save, your language, whether you are an Amazon Prime member, the stores you say you shop at, and your price-update choice (on or off, daily or weekly) with the time you switched it on.
• Credit cards you hold: the card names you tick in Profile, only to work out what you would pay. We never ask for card numbers, expiry dates, CVV, PINs or bank details.
• Buy taps and purchase answers: when you tap Buy we keep the product, store and prices we showed you; when you come back we ask "Did you buy it?" and keep your answer. We do not see your order or payment on the store.
• Voice and photos for search: a voice recording or a product photo you choose is sent to a provider to turn into a search. We do not store the recording or the photo.
• Device and connection data: your IP address (used by our servers to prevent abuse), the app or device type reported when you sign in (kept with your login session), and the app version.
• Communications data: the content of messages you send to support or the Grievance Officer.

Google user data (Limited Use disclosure): if you choose Sign in with Google, Google tells us your name, email address and a unique Google account identifier. We use them only to create or recognise your account. We do not receive your Google password, contacts, files or other Google data. SHOPPER 2.0's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data for advertising, we don't sell it, and our personnel don't read it except with your consent, for security such as investigating abuse, or where required by law. You can revoke access at any time at https://myaccount.google.com/permissions. If you already had an account with the same email and a password, linking Google ends that password and signs out your older sessions.

We do not collect your phone number, date of birth, contacts, precise or approximate location, files, SMS, biometric data or health data.

3. Purposes of Processing

• To create and secure your account and keep you signed in.
• To find products for what you ask, show them in the feed, and re-order what is left based on what you spend time on.
• To keep your wishlist, recent searches, settings and history.
• To turn your voice or photo into a search, and to translate a request in another Indian language into English so the search works.
• To work out what you would really pay at each store after the cashback or discount of the cards you hold, and to suggest a card you do not hold only when it would save you money (never because of what a bank pays us).
• To work out which of our partner stores to send you to, and to be paid commission when you buy.
• To ask whether you bought after you visit a store, and to show you what you saved.
• To send you price updates for your wishlist if you turn them on, and service messages about your account.
• To show you sponsored content that we have labelled "Sponsored", and to report to sponsors, in aggregate, how many people saw or opened it.
• To understand how the App is used in aggregate and improve it, for example which searches are popular. A search only becomes a public suggestion for others when several different users have made it, and never if it looks personal.
• To detect, investigate and prevent fraud, security incidents and abuse, and to comply with applicable law.

4. Legal Basis and Consent

4.1 We process your personal data based on your consent, given when you create your account and each time you use a feature that needs more data, such as voice, photo search or price updates, in line with Section 6 of the DPDP Act, 2023. We also process data for the legitimate uses the DPDP Act allows, such as security and legal compliance.

4.2 When you switch on price updates we record your choice and the time. Notifications on your phone are not switched on in this version of the App; when they are, we will ask for your phone's permission first.

4.3 You can withdraw consent at any time by turning off a feature or permission, or by deleting your account. Withdrawing consent doesn't affect the lawfulness of processing that happened before, and may limit or disable features that depend on that data.

5. Device Permissions

The microphone permission is used only for voice search. The camera and photos permissions are used only for photo search and for choosing a profile picture. Permissions are requested individually and are optional; the rest of the App works without them. We do not request location, contacts or files. You can review and revoke permissions at any time through your device settings.

6. Third-Party Sharing and Processors

We share personal data with the following third parties, strictly for the purposes described, and only what each needs:

• Cloud infrastructure: Amazon Web Services (Mumbai region; backups in the Hyderabad region). All data we store sits there, access-controlled and encrypted in transit.
• Google (Sign-In): your Google sign-in token, to confirm who you are, if you choose Sign in with Google.
• Google (Gemini AI): the photo you choose for photo search, to name the product in it. We do not store the photo.
• Sarvam AI: your voice recording and the text of a request in another language, for voice search and translation. We do not store the recording.
• SerpApi and Serper (shopping search): your search words only, never your name, email or account, to find products, stores and videos.
• Cuelinks and INRDeals (affiliate networks): the store you are sent to and an anonymous click reference (for example "offer123"), never your name or email, so we are paid commission if you buy.
• Expo (app updates): the App checks Expo's update service for new versions; it receives your device's IP address, app version and platform.
• Stores you choose to visit: when you tap Buy you leave the App and the store's own privacy policy applies.
• Legal and regulatory authorities, where required by law, court order, or to protect the rights, property or safety of the Company, our users or the public.

6.1 Affiliate links. When you tap Buy, we send you to the store through a link that identifies us to an affiliate network. It costs you nothing extra. The network and the store may set cookies or similar identifiers in your browser, under their own policies. We use clicks only to count and attribute sales and to improve the App.

6.2 Videos from other platforms. Some product videos are shown through the official players of YouTube, Instagram or Facebook. When a video loads or plays, that platform may collect data about your device and viewing and may set cookies, under its own privacy policy. We do not control this and do not receive that data. YouTube videos are shown through YouTube's embedded player and are subject to the YouTube Terms of Service (https://www.youtube.com/t/terms) and the Google Privacy Policy (https://policies.google.com/privacy).

We don't sell personal data. We don't share your name, email, searches, wishlist or the cards you hold with advertisers or ad networks.

7. No Sale, No Ad-Based Use of Your Data

The data you give us is used only to provide the Services described in this Policy. It is not sold, not shared with data brokers, and not used to build advertising profiles. Your searches, wishlist and the cards you hold are never used for targeted advertising.

8. Cross-Border Data Transfer

8.1 Our servers and database are hosted in India: Amazon Web Services (Mumbai region; backups in the Hyderabad region). We store your account and activity data there.

8.2 Some providers listed in Section 6 process data on servers outside India. In particular, your search words are sent to SerpApi and Serper, a photo you choose for photo search is sent to Google (Gemini), sign-in goes through Google, and app update checks go to Expo. We choose providers carefully and send them only what is needed for the purpose, never your name, email or account details (other than Google when you sign in with it). The law allows such transfers except to countries the Government of India restricts.

9. Your Rights

Subject to verifying your identity, you have the right to:

• access a summary of the personal data we hold about you and the processing we carry out; you can see and edit your name and photo in Profile, then Account, and your cards, stores and language in Profile
• correct inaccurate or incomplete personal data
• erase your personal data, subject to Section 10 (Retention); in the App, open Profile, then Account, then Delete my account
• withdraw consent at any time, as described in Section 4.3
• nominate someone else to exercise these rights on your behalf if you pass away or become incapacitated, in line with Section 14 of the DPDP Act; tell us at the address in Section 15
• lodge a grievance with our Grievance Officer (Section 15) and, if it's not resolved, with the Data Protection Board of India

10. Data Retention and Deletion

10.1 We keep your account, wishlist, settings, chosen cards, recent searches, history, Buy taps, purchase answers and activity linked to you for as long as your account is active. Your recent searches are cut to the newest 5 and you can clear them at any time.

10.2 When you delete your account in the App, we delete all of that from our systems straight away, together with your profile picture and login sessions. Steps and details are at /delete-account. If you cannot open the App, email admin@dot2dot.in from the address on your account with the subject "Delete my account" and we will delete it within 30 days.

10.3 Some data is not linked to your account: search words used for suggestions are kept with a random session reference for 30 days; the list of products shown in a feed is kept for about 1 day; login session records are cleared automatically after they expire; cached shopping search results are replaced as they refresh.

10.4 Backups are rotated on a 30 days cycle; deleted data is purged from backups by the end of that cycle, and backups are not used to restore a deleted account. We keep only what the law requires us to keep, for the period required.

10.5 Voice recordings and photos used for search are not stored by us. Our providers process them under their own terms; we ask for no retention. When you tapped Buy, the affiliate network and the store may keep their own records of the visit and any order, under their own policies.

11. Data Security Measures

We maintain reasonable security practices and procedures under Section 43A of the IT Act, 2000 and Section 8(5) of the DPDP Act, 2023, including:

• Passwords stored only as salted Argon2id hashes.
• Short-lived access tokens and single-use, rotating refresh tokens that end a login if one is reused.
• Lock-out after repeated wrong passwords, and rate limits on our endpoints.
• Encryption of connections between the App and our servers (HTTPS).
• Provider keys and secrets kept on our servers only, never inside the App.
• Restricted access to our systems and admin tools.

No system is completely secure.

12. Data Breach Notification

If a personal data breach happens, we'll notify the Data Protection Board of India and affected users without undue delay, in the form and manner the DPDP Act, 2023 and its rules prescribe, including a description of the breach's likely consequences and the measures we've taken or plan to take to address it.

13. Cookies, SDKs, and Analytics

The App does not use third-party analytics, crash-reporting or tracking SDKs. The SDKs and services it does use are Google Sign-In, the Expo update service, and the embedded video players described in Section 6. We measure how the App is used with our own first-party records (Section 2), not with a third party's analytics tool.

14. Children's Data

The App is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us data, contact us and we will delete it.

15. Grievance Officer / Contact

For any question about this Policy, or to exercise the rights in Section 9, contact: Name: Prakash Rajpurohith; Designation: Grievance Officer; Email: admin@dot2dot.in; Address: 677, 29th Main Road, 2nd Stage, BTM Layout Post, Bannerghatta Road, Bangalore South, Bangalore - 560076, Karnataka, India. We'll acknowledge your request within 48 hours and aim to resolve it within 30 days, or the period the law prescribes.

16. Changes to This Policy

We may update this Policy from time to time. We'll notify you of material changes in line with Terms Section 23.1. The "Last Updated" date at the top of this document reflects the most recent revision.