Privacy policy
Suprfree is a profit and operations dashboard for commerce brands. This policy explains what personal data we handle, why, how long we keep it, and the rights you have under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the DPDP Rules, 2025.
1. Who we are and our role
Suprfree is operated by Suprfree (India) (“we”, “us”). We play two roles:
- Data Fiduciary for the people who use Suprfree: brand owners, their team members and our own staff (account data).
- Data Processor for each brand's customers. When a brand connects its store, marketplaces, courier or ad accounts, the brand decides what its customers' data is used for; we process it only on the brand's instructions, as set out in our Data Processing Addendum. If you bought from a brand that uses Suprfree, that brand is your first point of contact, though you can also write to us.
2. What we collect and why
| Data | Whose | Purpose |
|---|---|---|
| Name, work email, role, hashed password, sign-in times, IP address | Account users | Sign-in, access control, security monitoring and audit trail |
| Display preferences (theme, density) | Account users | Remembering how you like the app to look |
| Orders: items, amounts, payment method (COD or prepaid), delivery and billing address, the name, phone and email on the order, courier and tracking number, order notes and gift messages, delivery and return status | Brand customers | Profit, returns, courier and marketing reports for the brand |
| Customer name, phone number, email | Brand customers | The brand's customer list and, where the brand turns it on, WhatsApp order updates and marketing the customer agreed to |
| Abandoned checkout contact and cart contents | Brand shoppers | Cart recovery messages sent on the brand's behalf |
| WhatsApp message status (sent, delivered, read, failed) and consent records | Brand customers | Delivering messages, honouring opt-outs and frequency limits |
| Aggregated website and ad statistics (visitors, age bands, regions) | Nobody identifiable | Marketing reports. These come from Google and Meta in aggregate and never identify a person |
We do not sell personal data, use it to build profiles for advertising, or combine one brand's customers with another's. We don't collect payment card details. We don't knowingly process children's data; brands must not send us data they know belongs to anyone under 18 without verifiable parental consent.
3. Legal basis
We process account data to provide the service you signed up for (a legitimate use under s.7 of the DPDP Act) and on your consent. Customer data is processed on the brand's behalf; the brand is responsible for its notice to and consent from its customers. Marketing messages on WhatsApp are sent only to people with a recorded opt-in, and anyone who asks to stop is not messaged again.
4. How long we keep it
| Data | Kept for |
|---|---|
| Contact details on abandoned checkouts that never became orders | 90 days |
| Phone numbers and text of WhatsApp messages | 180 days (delivery counts are kept without them) |
| Customer name, phone and email | While the brand's account is active; erased after three years without an order, or on request |
| Names, phone numbers and addresses on individual orders | Erased with the customer — on request, or after three years without an order |
| Order records (amounts, items, city, state and pincode, with no name, phone, email or street address attached) | While the account is active, and as long as tax law requires the brand to keep sales records (up to eight years) |
| Security and access logs | At least one year, then deleted (DPDP Rules, 2025) |
| Everything for a brand that leaves | Deleted within 30 days of the account closing, or 48 hours after a Shopify store uninstalls, unless the brand asks for an export first |
These periods are enforced by an automatic daily job, not by hand.
5. Who we share it with
We use a small number of service providers, each bound by contract to process data only for us and to protect it:
- Cloud hosting and a managed PostgreSQL database, both in Singapore
- A Meta-authorised WhatsApp Business Solution Provider, and Meta's WhatsApp Business Platform, for messages a brand sends
- The platforms a brand connects (for example Shopify, Amazon, Flipkart, Shiprocket, Meta Ads, Google Ads and Google Analytics), which the brand already uses
The full list is in the Data Processing Addendum. We disclose data to authorities only when Indian law requires it.
6. Where data is stored
Data is stored in Singapore and moves only over encrypted connections. Section 16 of the DPDP Act allows transfers outside India except to countries the Central Government restricts; Singapore is not restricted. If that changes, we will move the data.
7. How we protect it
Encryption in transit (TLS) and at rest, AES-256-GCM encryption of every connected account's credentials, strong password hashing, sessions that expire and can be revoked, role-based access, an audit trail of every export, erasure and staff access, and security headers on every page. More in Security.
8. Cookies
The app sets only two first-party cookies, both strictly necessary. There are no advertising or third-party tracking cookies in the app.
cm_session: keeps you signed in; HTTP-only, secure, expires after 14 daysmos_look: remembers your theme so the page doesn't flash on load
9. Your rights
Under the DPDP Act you can:
- ask what personal data we hold about you and who we've shared it with
- have inaccurate data corrected or completed
- have your data erased when it's no longer needed, or withdraw consent (as easily as you gave it)
- nominate someone to exercise these rights if you die or become incapable
- get a response to a grievance, and then complain to the Data Protection Board of India
See Grievances & rights for how. We answer within 90 days, and usually much sooner. Customers of a brand can also ask the brand directly; brands can export or erase a customer's data from the customer's page in Suprfree.
10. If something goes wrong
If personal data is breached, we will tell affected brands and people without delay, and report to the Data Protection Board within 72 hours, as the DPDP Rules require.
11. Changes
If we change this policy in a way that matters, we'll tell account owners in the app or by email at least 14 days before it takes effect.
12. Contact
Grievance Officer, Suprfree, India. Email support@suprfree.com.