Privacy Policy

1.What this notice covers#

This notice explains how Nirmaan handles your personal data when you use our website, our Android and iOS apps, or talk to our team. Under the Digital Personal Data Protection Act, 2023 we are the Data Fiduciary for that data and you are the Data Principal.

2.Exactly what we collect, and why#

We collect only what the product actually needs. Here is the complete list — nothing is collected that is not on it.

3.Your consent, and how to withdraw it#

• We process the data above on the basis of the consent you give when you create an account and use the service, and — for orders, invoices and tax records — because the law requires us to keep them.
• Consent is never bundled or pre-ticked. Optional things — push notifications, analytics — are asked for separately and refusing them does not block you from buying.
• You can withdraw consent at any time — turn off notifications in your device settings, or write to our privacy contact to withdraw more broadly. Withdrawing is as easy as giving it. Where we can no longer provide part of the service without that data, we will tell you plainly which part.
• Withdrawal is not retrospective — it does not undo processing that already lawfully happened, and it does not delete records the law requires us to keep.

4.Who else sees your data#

Suppliers. When you post a requirement, matching suppliers in your area see the material, quantity, unit and area — not your identity. When you place an order or accept a quote, the supplier fulfilling it sees your name, delivery address and phone number, because they cannot deliver without them. Suppliers may use those details only to fulfil your order.

Service providers. These companies process data on our instructions, for the purposes below and nothing else:

Law enforcement and courts. We disclose data only against a lawful order or a legally valid request, and only what that order actually requires. Where we are permitted to tell you, we will.

Business transfer. If Nirmaan is ever acquired or merged, your data may transfer to the new owner, who will remain bound by this notice. We will tell you before that happens.

5.Cookies, app storage and notifications#

• Essential cookies keep you signed in and remember your area, language and theme. The site does not work without them.
• Analytics measure aggregate usage so we can see which categories and areas have unmet demand. This is measurement, not profiling for ads.
• Push notifications are sent only after you allow them, and only for things that matter to you — a quote arriving, an order status change, a payment confirmation. Turn them off any time in your device settings.
• The mobile app stores your session and preferences locally on your device so it opens fast and works on a weak connection.

6.How long we keep it#

7.How we protect it#

• All traffic between your device and us is encrypted in transit (HTTPS/TLS).
• Sign-in uses one-time codes and short-lived session tokens. We do not store passwords, because there are none.
• Supplier identity documents go into a private storage bucket reachable only through short-lived signed links — never a public URL.
• Access to production data is limited to the people who need it, and sensitive administrative actions are written to an audit log.
• Payment webhooks are accepted only after a cryptographic signature check — an unverified payment message is never acted on.

No system is perfectly secure. If a personal data breach occurs, we will notify each affected person and the Data Protection Board of India as required by the DPDP Rules, 2025, describing what happened, what data was involved and what you should do.

8.Your rights over your data#

Under the DPDP Act, 2023 you have the following rights. Write to our privacy contact below and we will act on a valid request within 30 days.

• Access — a summary of the personal data we hold about you and who we have shared it with.
• Correction — fix anything inaccurate, complete anything missing, update anything stale. Most of this you can do yourself in Profile.
• Erasure — ask us to delete your personal data where we no longer need it and no law requires us to keep it.
• Grievance redressal — a readily available means of complaining to us about how we handled your data.
• Nomination — nominate another person to exercise these rights on your behalf if you die or become incapacitated.

If you are not satisfied with how we handle your request, you may complain to the Data Protection Board of India.

9.Children#

Nirmaan is a trade platform for adults and is not directed at anyone under 18. We do not knowingly collect a child’s personal data. Under the DPDP Act we would need verifiable parental consent to do so, and we do not track or profile children or show them behavioural advertising. If you believe a child has created an account, tell us and we will delete it.

10.Where your data is stored#

Our database and file storage are hosted in India or Singapore. A few service providers listed above operate outside India — crash diagnostics and email delivery in particular. Where data leaves India we transfer it only to countries not restricted by the Central Government under section 16 of the DPDP Act, and only under contractual terms that keep our obligations intact.

11.Changes to this notice#

The version number and effective date at the top of this page tell you which version applies. If we change what we collect or why, we will tell you in the app and by email before the change takes effect, and where the law requires it we will ask for your consent again.

12.Contact#