Privacy Policy

Cratejet is a marketplace connecting buyers, vendors and travellers for cross-border purchases and delivery. It is operated by Zelicra Technologies Private Limited, a company incorporated in India with its registered office in Kochi, Kerala [FULL REGISTERED OFFICE ADDRESS AND CIN], which is the data controller responsible for your personal data.

This policy explains what personal data we collect when you use Cratejet, why we collect it, who we share it with, how long we keep it, and what you can ask us to do with it.

Account data: your name, email address, password (stored only as a cryptographic hash, never in readable form), the role you chose (buyer, vendor or traveller), and optionally a phone number and profile photo.

Sign-in data: if you sign in using Google or Facebook, we receive the name, email address and profile picture held by that service. We never receive your password for it.

Identity and trust data: where you request verification or payouts, the government identity document you upload (for example a passport, Aadhaar card, driving licence or PAN card), any selfie provided for liveness checking, purchase receipts, and the resulting verification status.

Transaction data: your listings and their photographs, trips, orders, delivery addresses and meeting arrangements, delivery confirmation codes, disputes, and messages exchanged with a counterparty.

Payment data: no payment processor is connected yet, so Cratejet does not currently collect card, UPI or bank details for orders. Once payments are enabled they will be processed by a licensed payment partner, [PAYMENT PARTNER NAME]. We will receive confirmation of payment, the amount and a masked reference, and we will not receive or store your full card number.

Technical data: IP address, browser and device type, pages visited, and error diagnostics, collected so the service works and can be kept secure.

To perform our contract with you: creating your account, publishing listings, matching buyers with travellers, running each order through escrow and delivery confirmation, and handling disputes and refunds.

To meet legal obligations: verifying identity, preventing fraud and money laundering, keeping tax and accounting records, and responding to lawful requests from authorities.

For our legitimate interests: keeping the marketplace safe, detecting fraudulent accounts and listings, debugging, and improving the product. We weigh these against your rights and use the least intrusive option that works.

With your consent: optional marketing messages and any non-essential cookies. You can withdraw consent at any time without affecting your use of the service.

Other users, only as far as a transaction requires. A vendor or traveller you transact with sees your name, profile photo, verification status, the delivery details needed to complete the handover, and your messages. Buyers see the equivalent about them. Your email address, your identity documents and your payment details are never shown to another user.

Service providers who process data on our instructions: Supabase (database, authentication and file storage) and Vercel (application hosting). Our pages also load fonts and icons from Google Fonts and cdnjs (Cloudflare), which receive your IP address and browser details when your browser requests them. We do not currently use third-party analytics, advertising or marketing email services. Once payments are enabled, our licensed payment partner, [PAYMENT PARTNER NAME], will process payment data.

Authorities and professional advisers, where we are legally required to disclose data, or where it is necessary to establish or defend a legal claim.

We do not sell your personal data, and we do not share it with advertising networks.

Our database and uploaded files are hosted in Mumbai, India. The application is served from a global content delivery network, so technical data such as your IP address may be processed in the region closest to you.

Because Cratejet operates across borders, completing a transaction can involve transferring your data to another country — for example sharing a delivery address with a traveller abroad. Where data leaves the UK or the European Economic Area we rely on appropriate safeguards, such as the UK International Data Transfer Agreement or the European Commission’s Standard Contractual Clauses.

We set a strictly necessary cookie to keep you signed in and to protect your session. Without it the service cannot work, so it is not optional.

We store your light or dark theme preference in your browser’s local storage. It stays on your device and is never sent to us.

We do not currently run advertising or third-party tracking cookies. If that changes we will ask for your consent first and update this policy.

Account data is kept while your account is open. After you close it we delete or anonymise your profile, keeping only what we must.

Transaction and payment records are kept for as long as tax, accounting and anti-money-laundering law requires, typically several years after the transaction.

Identity documents are kept only as long as needed to support the verification decision and to meet legal obligations, then deleted. [CONFIRM: exact retention periods.]

Records connected to an open dispute, chargeback or legal claim are kept until it is resolved.

Depending on where you live you may have the right to: obtain a copy of the data we hold about you; correct data that is wrong; ask us to delete it; object to or restrict how we use it; receive it in a portable format; and withdraw consent you previously gave.

If you are in India, the Digital Personal Data Protection Act gives you rights of access, correction, erasure and grievance redressal, and the right to nominate someone to exercise your rights if you die or become incapacitated.

To exercise any of these, contact us using section 12. We will respond within the period the applicable law requires. You can also complain to your data protection regulator — in the UK the Information Commissioner’s Office, and in India the Data Protection Board.

Some requests have limits. We may not be able to delete records we are legally required to keep, or data needed to resolve an open dispute.

Data is encrypted in transit using HTTPS and encrypted at rest by our hosting providers. Passwords are stored only as hashes. Access to the production database is restricted, and row-level security rules in the database limit each account to its own records.

Uploaded files are restricted by size and file type, and permission rules control who may write to or modify them.

No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will notify you and the relevant regulator as the law requires.

Cratejet is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy. The date at the top shows when it last changed, and we will give notice in the product or by email before a material change takes effect.

Privacy questions and rights requests: hello@zelicra.com. Postal address: Zelicra Technologies Private Limited, Kochi, Kerala, India [FULL REGISTERED OFFICE ADDRESS].

Users in India may contact our Grievance Officer, [GRIEVANCE OFFICER NAME], at hello@zelicra.com, as required by the Digital Personal Data Protection Act.