Privacy

Who we are

LyteCart is software for Indian sellers: it keeps one stock number across your channels (Amazon, Flipkart, Myntra, Meesho and the others you connect), and helps with orders, chats and marketing. You, the seller, sign up and choose what to connect.

For your buyers’ details, you decide what is collected and why; we hold and use them only to run LyteCart for you (in DPDP terms, you are the data fiduciary and we are your data processor).

What we keep

• About you and your team: mobile number and email (to register and sign in), a password (kept only as a salted hash), your name, your role, and when each person opened the shop.
• About your shop: products, prices, stock and its history, orders, returns, payouts and settlements, suppliers and purchase orders, and settings.
• From your channels: what each channel sends us about your listings and orders, and the keys that let us update them. Keys are stored encrypted.
• Messages: chats with buyers on WhatsApp and Instagram when you connect them, and the replies sent from LyteCart.
• Billing: your plan, our invoices to you and payment records. Card and UPI details stay with the payment gateway; we never see them.
• A record of changes: who changed what and when (your activity log), kept so you can see and undo changes.

Your buyers’ details

Orders include what the channel gives us: often a name, phone number and delivery address. Marketplaces may hide some of it. We use these details only for the order: packing, shipping, cash-on-delivery checks and the messages you choose to send.

Marketing messages go only to buyers who agreed to them, with a record of when and how they agreed. Anyone who replies STOP is not messaged again.

When a store platform asks us to delete a buyer’s details (for example Shopify’s privacy requests), we remove their name, phone, email and address from that store’s orders and keep only amounts, items and the state shipped to, which you need for your tax records. Tax invoices already issued to that buyer keep their details, as GST law requires.

What we use it for

• To run the features you use: stock sync, orders, labels, chats, campaigns and reports.
• To tell you what needs you: alerts in the app, and by email or SMS when you switch that on.
• To bill you for your plan and send GST invoices.
• To keep LyteCart working: finding problems, measuring how channels respond, and stopping misuse.
• The assistant: when you switch it on, buyer messages and your product facts are sent to our AI model provider to write the reply. It never offers discounts, refunds or cancellations on its own.

What we never do

• We never sell your data or your buyers’ data, and never share it for anyone else’s advertising.
• We never contact your buyers ourselves or use their details for any other seller.
• We never hold your sales money: payouts go from the channel or gateway straight to you.

Who at LyteCart can see it

By default, LyteCart staff see counts about your shop (plan, number of channels and orders), never your products, sales or buyers.

• With your yes only: if support needs to look inside your account, they ask; you approve or decline in the app. Access is read-only unless you also allow re-sending stock updates, ends after 24 hours, and every screen they open is listed in your activity log. Buyer names and phone numbers stay hidden from them.
• Emergencies: during an outage that affects many sellers, an engineer may look at the stock sync queue and channel status only (never buyers or orders) for up to 4 hours. You are told at once and can end it; a founder reviews every use.

Services we use

To run LyteCart we use a small number of providers, under contract, each only for its part:

How long we keep it

Your choices

• Download everything: the owner can download all the shop’s data (orders, products, stock history, customers, messages and photos) from Your account, at any time.
• Correct it: most details can be edited in the app; for your number, write to support.
• Delete it: close the account from Your account. The dates above apply.
• Alerts and messages from us: choose what reaches you, and how, under Alerts.
• Your buyers: if a buyer asks you for their data or to be deleted, write to us from Help and we will help you do it.

Keeping it safe

Each shop’s data is kept apart at the database level, so one seller can never see another’s. Channel, courier and payment keys are encrypted. Sign-in is by your mobile number or email and a password; a one-time code confirms your number and email when you register. Staff access follows the rules above and is logged.

If something goes wrong

If personal data we hold for you is accessed or lost without permission, we tell you without undue delay, and in any case in time for you to meet your own duties, with what happened, what was affected and what we are doing. Where the law requires us to report a security incident to CERT-In (within 6 hours of noticing it) or to the Data Protection Board, we do. We keep logs of our systems for 180 days within India, as the CERT-In directions require.

Reviewer (lawyer): confirm the notice period promised to sellers and the 180-day log statement match our actual setup.

Where data is processed

Our servers and database run in [hosting country/region, e.g. India (Mumbai)]. Some providers we use (for the AI model, email delivery or support tools) may process data outside India; we send them only what they need, under contract, and not to any country the Government of India has restricted for this purpose.

Children

LyteCart is for businesses and is not meant for anyone under 18. We do not knowingly collect data about children for ourselves. If your buyers include children, your own lawful basis and parental consent duties apply to you.

Cookies and the website

This website uses only the cookies it needs: to keep you signed in and to protect forms. We do not use advertising cookies or sell browsing data. If we add analytics, we will say so here first.

Your rights under the DPDP Act

Under India’s Digital Personal Data Protection Act, 2023, you (and your team members) may ask to access the data we hold about you, to correct or erase it, to withdraw consent, and to nominate someone to act for you if you cannot. We reply within 30 days. Write to us or to our grievance officer (see Contact); if you are still not satisfied you may complain to the Data Protection Board of India. For your buyers’ data, you decide the purpose and we act on your instructions; the Data processing terms explain how.

We keep some records longer than a request would otherwise allow when the law requires it (GST records: 8 years).

Reviewer (lawyer): confirm roles (processor for buyers’ data; fiduciary for sellers’ own data), the reply period and the one-year log retention rule under the DPDP Rules against our one-year erase after closing.

Changes and contact

If we change this page in a way that matters, we will tell you in the app before it applies. Questions or complaints: write to us from Help inside LyteCart, or use any way on our Contact page, which also names our grievance officer.

See also our Terms and Refunds and cancellation.