Privacy Policy

Shivio is a marketplace that connects nearby local stores — and organisations that are not quite a shop, like a school issuing uniforms or a clinic dispensing medicine — with the people they serve. A shop on the high street and a school with no shopfront at all get the same kind of storefront on Shivio; the platform treats them as configuration of the same idea, not as different kinds of business.

This policy is about the information Shivio itself collects to run that marketplace. Each store you buy from also has its own responsibilities for the information you give it directly (a class and roll number declared to a school, for instance) — see §6 below.

We collect information in three ways: what you give us, what your device gives us, and what your activity on the platform creates.

• Account details — your name, and an email address or mobile number (or both), which is how you sign in. A password is stored as a one-way hash we cannot reverse, never as plain text.
• Delivery addresses — the addresses you save, so a store knows where to send an order.
• Location — your pincode, or your device’s coordinates if you choose to share them, used only to rank stores and search results by how close they are and whether they actually deliver to you. We do not track your location in the background or outside of that ranking.
• Orders and payments — what you bought, from which store, for how much, and how you paid. Card and UPI details themselves are handled by our payment processor, Cashfree (see §4) — Shivio never stores your full card number.
• Shopping activity — items on your wishlist, products and stores you have recently viewed, and searches you run, used to make your own experience more useful (showing you what you were just looking at, for instance) rather than sold or shared for advertising.
• Reviews — anything you write about a product or a store, and your star rating.
• Device and session information — your device name, IP address and browser details when you sign in, so we can show you your active sessions and let you sign a stolen device out remotely.
• Communications — support tickets you raise, and messages between you and a store about an order.

• To create your account, sign you in, and keep it secure.
• To place, fulfil, and let you track an order — sharing exactly what a store and its delivery staff need to do that, and nothing more.
• To rank stores and products by distance and relevance to you (never by anything you have not told us, like your pincode).
• To process payments and refunds.
• To send you order updates, OTP codes, and — only where you have not turned them off — notifications about things like a price drop on your wishlist or a low-stock alert.
• To respond to support tickets and investigate anything you report.
• To detect fraud and abuse, and to enforce our Terms of Service.

We do not sell your personal information. We share it only where it is needed to run the marketplace:

• The store you order from — your name, contact details, delivery address and order contents, so it can fulfil your order and handle any return or support question.
• Cashfree, our payment gateway, to process a payment or a refund. Cashfree has its own privacy policy governing what it does with your payment details.
• Delivery personnel — only what is needed to complete a delivery (essentially, an address and a way to confirm handover). By the same token, a rider’s own name, photo and phone number are never shown to you — you see the order’s status, not who is carrying it.
• Law enforcement or regulators, only where we are legally required to.

A store that requires proof you belong to it — a school checking a class list, for example — asks you to declare details like a member’s name, group (class), and an optional reference number, directly on that store’s page. This is between you and that store; Shivio stores the declaration so the store can see it, but the store itself decides what it does with that information beyond running its own shop on the platform.

Where a parent or guardian registers on behalf of a child (for a school uniform order, for instance), the account and the data on it belong to the adult who created it — a child is never expected to hold their own account or agree to these terms themselves.

We keep your account information for as long as your account is active. Order and payment records are kept for longer, even after you delete your account, where the law requires it — for accounting, tax and fraud-prevention purposes — but with your personal details removed from that record wherever we can (see §8).

Passwords are hashed, never stored in plain text. All traffic between your device and Shivio is encrypted (HTTPS/TLS). Access to customer data inside the platform is limited to what a role genuinely needs — a store’s own staff cannot see another store’s orders, for instance. No system is perfectly secure, and we will tell you if we ever become aware of a breach affecting your data.

• Access and correction — see and update your name, contact details and addresses any time from your Account page.
• Notification preferences — control what you hear about from your Account settings.
• Deletion — you can request that your account and personal data be deleted from your Account page, or by writing to us through Contact support. Where the law requires us to keep an order or payment record, we anonymise it rather than keep it identifiable to you.

Shivio uses cookies to keep you signed in and to remember things like your last search location. We do not use third-party advertising cookies to track you across other sites.

We may update this policy as the platform changes. We will change the date at the top of this page when we do, and where a change is significant, we will make a reasonable effort to tell you directly.

Questions about this policy, or a request about your data, can be sent through Contact support, or by email to admin@shivio.in.