Privacy Policy

Who we are

Upsway (“Oyklane”, “we”) runs an e-commerce platform for businesses in India: sellers build an online store on Oyklane, sell through it, and manage orders, payments, marketing and apps from the Oyklane admin. This policy covers oyklane.com, the seller admin (store.oyklane.com), stores on *.oyklane.com and on sellers' own domains, and our apps and APIs.

Sellers (and their staff) who create an Oyklane account: we decide how their data is used, so we are its data fiduciary.
Shoppers who buy from a store on Oyklane: the store is the seller you're buying from and decides how your data is used for your order — Oyklane processes it on the store's behalf. The store's own privacy policy also applies.

What we collect

From sellers

Account details: name, email, phone number, password (stored only as a one-way hash), two-step verification settings.
Business and store details: store name, address, GSTIN, policies, products, images, prices, discounts, theme and settings.
Billing: your plan, invoices and payment status. Card, UPI and bank details are handled by our payment partner (Razorpay); we don't store them.
Support: messages to our team and to the Help assistant.
Technical: IP address, browser, device type and activity logs, used to keep accounts secure.

From shoppers, for the store you buy from

Name, email, phone number, delivery and billing addresses, order history, reviews you write, and messages to the store.
Sign-in: one-time codes sent by email, SMS or WhatsApp, or a password you set (hashed), or Google sign-in.
Cart and visit information: products viewed, pages visited, device type and campaign links you arrived from, so the store can understand its sales.
Oyklane account: when you sign in to a store with something that proves who you are (an emailed code, Google or a phone code), your browser keeps a signed token with that proven email or phone. Another Oyklane store you visit uses it to sign you in to the account you already have there — and creates one only when you open your account, sign-in or checkout on that store. You can sign out at any time, which removes it from your browser.
Payments are made through the store's own payment gateway (such as Razorpay, Cashfree, PayU or Stripe). We receive the payment status, not your card or bank details.

From Google and Meta, when a seller connects them

A seller can sign in with Google and with Facebook once for their store (Settings ▸ Connected accounts). We then receive only what the seller's apps need:

Google: the account's email, name and profile picture; the Google Business Profile locations it manages and their reviews and rating (Google Reviews app); its Merchant Center accounts, the product data source we add and Google's processing reports (Google & YouTube app); if the seller uses it, its Google Analytics properties and web data streams, and its Tag Manager accounts and web containers (Google Analytics app); and its Google Ads accounts with their campaigns, ad groups, ads and images, budgets, conversion actions, billing status, linked Merchant Center accounts, search terms and performance reports (Google Ads app).
Meta: the Facebook user's name and id; the Pages they manage and the Instagram business accounts linked to them (profile and recent posts, for the Instagram Feed app); their businesses and product catalogues (Facebook & Instagram shop); their ad accounts and pixels (Facebook Pixel, Meta Ads); and their WhatsApp Business accounts and numbers (WhatsApp app).

How we use it

To run the service: host stores, take orders, send order and account emails and messages, show dashboards and reports, run the apps a seller installs.
To sign people in and keep accounts, stores and payments secure, and to prevent fraud and abuse.
To bill sellers for their plan and paid apps.
To answer support requests, including with the Help assistant (an AI model answers from our help articles and the seller's store settings).
To improve Oyklane, using aggregated information that doesn't identify anyone.
To meet legal obligations (tax and accounting records, lawful requests).

Google user data

Oyklane's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google data only to provide the features the seller turned on: showing their reviews on their store, listing their products in Merchant Center and reporting its status, setting up Google Analytics and Tag Manager on their store, and creating, reporting on and managing their own Google Ads campaigns.
Tag Manager: we list the seller's web containers and, if they ask, create one for their store. We add only the container ID to their store and don't change the tags inside it.
Google Ads: we never create campaigns, change budgets or spend on a seller's behalf unless they ask for that in Oyklane, including automatic rules they switch on. New campaigns start paused. If a seller has no Google Ads account, we can create one for them under Oyklane's manager account and invite them as its admin.
We don't sell it, don't use it to show ads to anyone or target ads for anyone else, and don't use it to develop or train generalised AI or machine-learning models.
Our staff don't read it, except with the seller's permission for support, for security, or where the law requires.
Google's access tokens are stored encrypted. Disconnecting Google in Settings ▸ Connected accounts deletes them and revokes our access at Google; you can also remove Oyklane at myaccount.google.com/permissions.

Meta (Facebook, Instagram, WhatsApp) data

We use data from Meta only for the seller's Meta apps: showing their Instagram posts on their store, keeping their catalogue in sync, listing their pixels, running the ads and WhatsApp messages they create.
We never post, message or spend on a seller's behalf unless they ask for that in Oyklane.
Access tokens are stored encrypted. Disconnecting Facebook in Settings ▸ Connected accounts deletes them; you can also remove Oyklane in Facebook ▸ Settings ▸ Apps and websites. See Data deletion.

We don't sell personal data. We share it only:

With the store you buy from — your order and account details, so they can fulfil and support your order.
With service providers who run parts of Oyklane for us under contract: hosting and databases (Railway, Vercel, Supabase), image storage (ImageKit), email (ZeptoMail), SMS and WhatsApp (Zoho, Twilio, MSG91, Meta), AI models for the Help assistant and writing tools, and our billing partner (Razorpay).
With services a seller connects — their payment gateway, couriers, Google, Meta, analytics — as needed for what they turned on.
When the law requires it, or to protect people, our users or Oyklane from fraud or harm.
If Oyklane is sold or merged, with the new owner, who must keep this policy's promises.

Where it's kept and how it's protected

Our main database is in Mumbai, India. Some providers (such as email, AI and hosting edge networks) may process data outside India, with appropriate safeguards.
All traffic uses HTTPS. Passwords are hashed; access tokens and payment-gateway keys are encrypted at rest; staff access is limited and logged; sellers can turn on two-step verification.

How long we keep it

Seller accounts and store data: while the account is open, then deleted within 30 days of a deletion request or account closure (backups within 90 days).
Order and invoice records: as long as tax and accounting law requires (generally 8 years in India).
Sign-in codes expire within minutes; security logs are kept up to 1 year.
Data from Google or Meta: until the seller disconnects the account or uninstalls the app, then deleted.

Your rights

Under the Digital Personal Data Protection Act, 2023 you can:

get a summary of the personal data we hold about you and how it's used;
have it corrected, completed or updated;
have it erased when it's no longer needed (see Data deletion);
withdraw consent you gave (for example to marketing messages) — as easily as you gave it;
nominate someone to act for you; and
complain to our Grievance Officer, and then to the Data Protection Board of India.

Sellers can change most details in the admin. Shoppers can edit their details in their account on the store, and should contact the store first for their orders; you can also write to us at support@oyklane.com.

Cookies

Needed to work: your sign-in session, your cart, the Oyklane account sign-in described above, and security protections.
Preferences: for example light or dark mode on oyklane.com.
Our own measurement: on oyklane.com and the seller admin we use Google Analytics and the Meta pixel to count visits and sign-ups and see which setup steps sellers finish (such as adding a first product or connecting a payment gateway). They don't receive order, payment or shopper details.
The store's own tools: a store may add analytics or advertising tags (such as Google Analytics or the Meta pixel). Those are the store's choice and covered by its policy.

Children

Oyklane is for businesses and adults. We don't knowingly collect personal data from children under 18 without verifiable consent from a parent or guardian; if you believe we have, write to us and we'll delete it.

Changes to this policy

We'll post any changes here and update the date at the top. If a change matters, we'll tell sellers by email or in the admin before it takes effect.

Contact and grievances

Upsway
Mansarovar, Jaipur, Rajasthan 302020, India
GSTIN: 08GFBPP1123R1Z2
Email: support@oyklane.com · WhatsApp: +91 89554 87847

Grievance Officer (Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023): support@oyklane.com. We acknowledge complaints within 48 hours and resolve them within 30 days.