Who we are
ReCart is operated by Urjacart Energy Labs Private Limited, registered in Mumbai, Maharashtra. Where this policy says we, us or ReCart, it means that company. We are the data fiduciary for the information described here under the Digital Personal Data Protection Act, 2023.
This policy covers the marketplace, the buyer account, seller onboarding and the support channels attached to them. It does not cover a seller's own systems once an order has been handed to them for fulfilment.
What we collect
We collect only what an order, an invoice or a support conversation needs.
We do not collect card numbers, UPI credentials or bank passwords. Payments are completed on Razorpay's checkout and we receive only the payment reference and status.
Why we hold it
- To fulfil an order: dispatch, e-way bill, delivery and the tax invoice.
- To meet statutory obligations: GST records are retained for eight financial years.
- To provide support: order history is visible to the agent handling your ticket.
- To improve the product: aggregated, de-identified usage patterns only.
Who we share it with
Sellers receive the delivery address, contact name and phone number for orders they fulfil, and nothing else. Logistics partners receive the same, plus the consignment details. Razorpay receives the amount, order reference and your contact details to raise the payment. Statutory authorities receive what the law requires, when it requires it.
We do not sell personal data, and we do not share it with advertisers.
How long we keep it
- Account data: until you close the account, then 90 days in backup.
- Invoices and GST records: eight financial years, as required by law.
- Support conversations: three years from the last message.
- Technical logs: 180 days.
Your rights
You can ask for a copy of your data, correct anything inaccurate, withdraw a consent you gave, nominate someone to act for you, or ask us to erase what we are not obliged to keep. Write to the grievance officer and we respond within thirty days.
Security
Data is encrypted in transit and at rest. Access is role-based and logged. Two-factor authentication is available on every account and required for seller accounts. If a breach affects you, we notify you and the Data Protection Board without undue delay.
Changes to this policy
Material changes are notified by email at least fourteen days before they take effect. The version number and effective date at the top of this page always reflect the current text.