Privacy Policy

Information We Collect

Account information: your name, username, email address, phone number, and password (stored as an irreversible hash, never in plain text) when you register, plus the account role you sign up under (customer, store owner, or partner).

Profile information: date of birth, gender, and address details you optionally add during onboarding. If you provide an address, we convert it into map coordinates (via OpenStreetMap or Google Maps) so we can show you nearby stores.

Order information: items purchased, quantities, prices, shipping address, payment method, and any notes you add to an order.

Payment information: we do not store your card number, CVV, or UPI PIN — these are collected and processed directly by our payment partners, Razorpay and PayPal. We store the outcome of a transaction (amount, status, a payment reference ID) and, for store owners, the UPI ID or bank payout details described below.

Store owner payout details: if you register as a store owner, we collect your bank account number, IFSC code, beneficiary name, and PAN to verify your identity and pay you out for sales. These fields are encrypted before they are ever written to our database (see "How We Protect Your Information" below) and are never shown back to you or anyone else in full.

Verification codes: a one-time code sent to your email or phone to confirm it belongs to you. These expire shortly after they are issued.

Device and usage information: your device type, a push-notification token (mobile app only, so we can send you order and low-stock alerts), and basic request metadata such as IP address and timestamps, used for security and abuse prevention.

Content you provide: product photos, shop logos and banners, and messages you send us through support tickets.

Information from third-party sign-in: if you sign in with Google or Apple, we receive the name and email address associated with that account.

How We Use Your Information

To create and secure your account, verify your identity, and let you sign in.

To operate the core Services: browsing and listing products, placing and fulfilling orders, generating invoices, processing payments and payouts, and managing inventory, staff, and attendance for store owners.

To send you transactional communications — order confirmations, shipping and delivery updates, OTP codes, and low-stock or payout alerts — by email, SMS, WhatsApp, or push notification.

To respond to support requests you send us.

To detect, prevent, and investigate fraud, abuse, and security incidents.

To comply with legal and tax obligations, including maintaining order and invoice records as required under applicable Indian law (for example, GST record-keeping).

How We Share Your Information

We do not sell your personal information.

We share information with service providers who help us run the Services, and only to the extent needed for them to perform that function: Razorpay and PayPal (payment processing), an SMS/WhatsApp provider (delivering OTP and order-status messages), Google and Apple (if you use their sign-in), and cloud infrastructure providers who host our servers, database, and uploaded files.

If you place an order with a store on our platform, that store's owner and staff can see the order details, your name, contact number, and shipping address needed to fulfil it.

We may disclose information if required to by law, court order, or governmental request, or to protect the rights, property, or safety of ThunderStorm Galaxy, our users, or the public.

If ThunderStorm Galaxy is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction; we will notify you before your information becomes subject to a different privacy policy.

How We Protect Your Information

All traffic to our website, panels, and mobile app is encrypted in transit (HTTPS/TLS).

Sensitive financial fields — bank account number, IFSC code, beneficiary name, and PAN — are encrypted at rest using AES-256 before they are stored, with the decryption key held only in our application's server-side configuration, never in the database itself. This means the data cannot be read from a database copy or backup alone.

Access to personal information within our team is restricted to what each role needs to do its job, and every account requires authentication.

No method of transmission or storage is 100% secure. While we work to protect your information, we cannot guarantee its absolute security.

Data Retention

We keep your personal information for as long as your account is active and as needed to provide the Services. Order, invoice, and payment records are kept for as long as required by applicable tax and accounting law, even after an account is closed.

You can ask us to delete your account and associated personal information at any time; see "Your Rights and Choices" below. Some information may be retained where we have a legal obligation or legitimate business need to do so (for example, completed transaction records).

Your Rights and Choices

You can review and update most of your account information directly from your profile in the app or website.

You can request access to, correction of, or deletion of your personal information, or ask us to stop processing it, by emailing support.tsgalaxy@gmail.com or by raising a request from the Support section of the app or website. We will respond within a reasonable time and in line with applicable law.

Deleting your account will remove your profile information; some records (such as completed orders and invoices) may be retained as described under "Data Retention".

Cookies and Similar Technologies

Our website uses essential cookies to keep you signed in and to remember basic preferences, such as your selected language. We do not use these cookies for third-party advertising.

Children's Privacy

The Services are not directed at children under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at support.tsgalaxy@gmail.com and we will take steps to delete it.

International Users

We are based in India, and our infrastructure providers may process and store data on servers located in India and other countries. By using the Services, you consent to this transfer and processing.

Changes to This Policy

We may update this policy from time to time. If we make material changes, we will update the "Effective date" above and, where appropriate, notify you through the Services.

Contact Us

Questions about this policy or how we handle your information? Email support.tsgalaxy@gmail.com or call +91 97845 76500. You can also write to us at C 135 Old C 100 Shiv Marg, Singh Bhoomi, Khatipura, Jaipur, Rajasthan – 302012, India.