1. Statutory Framework & Data Fiduciary Role
This Privacy Policy describes the practices of Applicaz (operating via applicaz.xyz, collectively referred to as “Platform”, “We”, “Us”) regarding the collection, processing, storage, and protection of digital personal data.
Our operations adhere to the highest statutory standards mandated under Indian and international jurisprudence:
- Digital Personal Data Protection Act, 2023 (DPDP Act, 2023) enacted by the Parliament of India;
- Information Technology Act, 2000 (Section 43A, 79) and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021;
- Consumer Protection (E-Commerce) Rules, 2020;
- Google API Services User Data Policy;
- International Privacy Standards including the European Union General Data Protection Regulation (EU GDPR), UK GDPR, and California Consumer Privacy Act (CCPA/CPRA).
Under the DPDP Act 2023, Applicaz functions as a “Data Fiduciary” with respect to the account credentials and operational settings of registered merchants. In relation to storefront orders processed on behalf of merchants, Applicaz functions as a technology intermediary maintaining technical and organizational security controls on behalf of the merchant.
2. Google API Services User Data Policy & Limited Use Disclosure
Applicaz's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
When merchants sign in to Applicaz using Google Authentication, we access only the minimal identity details required to establish their account:
Verifies that your Google sign-in belongs to you using industry-standard secure tokens.
Your display name and profile image to personalize your merchant workspace.
Your verified primary email address for essential security notices and account recovery.
Our Commitments Under Limited Use:
- Authentication Purpose Only: Google user data is used exclusively to provide customer-facing application features, specifically authenticating the merchant and securing their store.
- No Transfer or Selling: We never sell, transfer, or share Google user data with third-party advertisers, data brokers, or marketing networks.
- No AI/ML Training: Applicaz does NOT use information received from Google APIs to train, retrain, fine-tune, or develop generalized artificial intelligence (AI) or machine learning (ML) models.
- No Human Inspection: Human access to Google user data is strictly prohibited, except with your explicit permission for support, to investigate security incidents, or as required by law.
3. Information We Collect & Data Minimization
In strict adherence to the principle of Data Minimization under Section 6 of the DPDP Act 2023, Applicaz collects only the information strictly necessary to provide your storefront and billing counter services:
When you sign in using Google, we receive your name, email address, and profile photo. We do not access your Google password, contacts, Google Drive files, or location history.
Business name, business category, business address, public WhatsApp dispatch number, UPI Virtual Payment Address (VPA), catalog items, prices, photos, and page layouts created by the merchant.
When a customer places an order via the merchant’s storefront, the customer’s name, phone number, delivery address, and ordered items are presented solely so the merchant can fulfill the order and display it on their live counter. Applicaz does not cross-profile customers across different independent merchant stores.
Non-identifiable technical data including device viewport size, browser type, and anonymous error logs to ensure high platform availability and error-free updates.
4. User Data Deletion Request Protocol (Right to Erasure)
Applicaz respects your statutory right to erasure under Chapter III Section 12 of the DPDP Act 2023, GDPR Article 17, and Google Developer Policies. Users can permanently delete their account and associated data through any of the three options below:
Log in to your Applicaz Merchant Dashboard → Go to Settings → Select Account Management → Click “Delete Store & Purge Data”.
Instant Automated TriggerSend an email from your registered account email address to support@applicaz.xyz with the subject line [Account Deletion Request].
You can revoke Applicaz's access to your Google account at any time via your Google Account Security Settings.
Immediate DisconnectionUpon account deletion, all personal identifiers, store catalogs, uploaded media assets, and customer logs are permanently purged from active production systems within 7 business days. Encrypted backup archives rotate out and are fully overwritten within 30 days. Transaction records required by statutory tax laws (such as GST invoice receipts) are retained strictly as required by law.
5. Strict Zero-Data-Selling Policy
Applicaz will NEVER sell, rent, lease, monetize, license, or barter your business records, catalog information, customer telephone directories, or sales logs to third-party marketing agencies, ad networks, or data brokers.
Your customers belong exclusively to you. We do not inject third-party advertising banners, tracking scripts, or commercial popups inside your storefronts, live web counters, or mobile apps.
6. Payment Privacy & Direct Transaction Architecture
Applicaz is architected to prioritize customer and merchant privacy:
- Direct Payments: When a customer pays via UPI QR code or WhatsApp checkout, the payment is transferred directly between the customer’s banking application and the merchant’s registered bank account.
- Zero Financial Storage: Applicaz never receives, handles, or stores sensitive financial credentials such as bank passwords, debit/credit card CVVs, or UPI PINs.
- Subscription Processing: Merchant subscription plans (Starter, Pro, Yearly VIP) are processed through PCI-DSS Level 1 certified payment gateways. Card credentials are tokenized in compliance with RBI guidelines.
7. Cloud Security, Architecture & Encryption Standards
Applicaz applies multi-layered cryptographic safeguards conforming to Section 8 of the DPDP Act 2023 and modern cybersecurity standards:
- Encryption in Transit: All data transmitted between browsers, mobile devices, and server endpoints is secured using Transport Layer Security (TLS 1.3 / HTTPS) with mandatory HTTP Strict Transport Security (HSTS).
- Encryption at Rest: Cloud databases employ AES-256 disk encryption, isolated virtual private networks, and regular automated backups.
- Strict Merchant Data Isolation: Every store configuration is cryptographically isolated so that only the authenticated merchant can access or modify their store settings.
- High-Availability Edge Delivery: Public storefront assets are served through a global Content Delivery Network (CDN) to ensure fast loading and protection against service disruptions.
8. Rights of Data Principals under India's DPDP Act, 2023
Under Chapter III of the Digital Personal Data Protection Act, 2023, users in India are entitled to statutory rights:
You can obtain a summary of your personal data processed by Applicaz and export your business catalog in standard format.
You can update or rectify any inaccurate or incomplete personal information directly through your dashboard.
You have the right to request permanent deletion of your business profile, apps, and stored logs at any time.
You have the right to have grievances resolved promptly through our designated Grievance Redressal Officer.
Applicaz is a business software platform intended exclusively for merchants aged 18 and older. We do not knowingly collect personal data from or conduct targeted tracking of individuals below 18 years of age.
9. Global Data Protection Standards (GDPR, CCPA & International)
For users and visitors accessing Applicaz from outside India, we uphold equivalent data protections conforming to major international privacy frameworks:
Residents of the EEA and UK enjoy enforceable statutory rights including the Right of Access, Rectification, Erasure, Restriction of Processing, Data Portability, and Right to Object. Lawful bases for processing include performance of a contract and legitimate interests. Cross-border data transfers utilize Standard Contractual Clauses (SCCs).
Notice at Collection & “Do Not Sell or Share My Personal Information”: Applicaz does NOT sell, rent, or share personal information with third parties for cross-context behavioral advertising, and has not done so in the preceding 12 months. California consumers have the right to request disclosure, deletion, and correction of their personal data without discrimination.
We align our privacy practices with Brazil (LGPD), Canada (PIPEDA), Australia (Privacy Act 1988), Singapore (PDPA), South Africa (POPIA), UAE, and Saudi Arabia privacy regulations.
10. Cookies & Local Storage Transparency
Applicaz utilizes modern browser local storage and essential session tokens exclusively to:
- Persist active shopping cart items so customer cart contents are not lost while browsing;
- Store Studio preferences such as canvas zoom and selected view mode;
- Maintain secure authentication sessions.
We do not employ third-party cross-site advertising cookies or behavioral tracking beacons.
11. Mobile Application Safety Standards
When mobile applications or Progressive Web Apps are created on Applicaz:
- Applications are built with verified digital signatures meeting standard mobile operating system requirements;
- Permissions are strictly limited to standard network access required to load your live store;
- Applications do not request intrusive device permissions such as background microphone access, contact scraping, or device storage scanning.
12. Statutory Grievance Redressal Officer (DPDP Act & IT Rules)
In accordance with Section 13 of the Digital Personal Data Protection Act, 2023 and Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, any privacy complaint, data access request, or statutory notice may be directed to our designated officer:
Statutory SLA: Acknowledgment within 48 hours; complete resolution within 30 days from the receipt of written grievance.