Privacy Policy

Last updated: 21 October 2026

gopozz is software that shops use to bill customers and to run their own online store. This policy explains what personal data we collect, why, who we share it with, how long we keep it and the rights you have. It is written to meet the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules made under them.

1. Who we are and our role

gopozz ("we", "us") provides a point-of-sale, inventory and online-store platform to businesses ("merchants") at https://gopozz.com.

  • For merchants and their staff who sign up and use gopozz, we decide why and how your account data is used, so we are the Data Fiduciary for it.
  • For the customers of a merchant (the people who buy at the counter or on the merchant's online store), the merchant decides why and how that data is used. The merchant is the Data Fiduciary and we process that data on the merchant's behalf as a Data Processor, only to provide the service.

2. What we collect

From merchants and staff

  • Account details: name, email, phone number, password (stored only as a one-way hash), language.
  • Business details: business name, category, address, GST number, logo, currency and settings.
  • Verification (KYC): legal or trade name, licence number and the documents you upload so we can approve an online store before it goes live.
  • Business records you enter: products, stock, prices, sales, purchases, expenses, customers and suppliers, invoices and reports.
  • Payment for your plan: the plan, amount, date and the reference the payment gateway returns. Card, UPI and bank details are entered on the gateway's own page; we never see or store them.
  • Payment-gateway and courier keys: the API keys you connect for your own Razorpay, Cashfree, PhonePe, Paytm, Shiprocket, Delhivery or similar account. They are stored encrypted and used only to take your payments and book your shipments.
  • Usage and device data: IP address, browser and device type, pages used, log-in times and error logs, collected automatically to run and secure the service.
  • Support conversations: what you send us by email, WhatsApp, phone or the contact form.

From visitors to our website

Contact-form and demo-request details (name, phone, email, business, message) and basic analytics about how the site is used.

3. Why we use it

We process personal data only for a clear, lawful purpose, on the basis of your consent or for the legitimate uses the DPDP Act allows (for example, to provide a service you asked for or to meet a legal obligation):

  • to create and run your account, store and billing;
  • to take payment for your plan and issue GST invoices;
  • to verify a business before its online store is published and to prevent fraud and misuse;
  • to send service messages: one-time codes, order and payment alerts, plan reminders, security notices;
  • to give support, fix problems and improve the product;
  • to send product news and offers, only if you have not opted out (every such email has an unsubscribe link);
  • to comply with law, tax and accounting rules, and lawful requests from authorities.

We do not sell personal data, and we do not use merchants' customer data for our own marketing.

4. Shoppers of stores built on gopozz

When you buy from a shop that uses gopozz, the shop collects your name, phone number, email, delivery address, order details and any message you add, so it can process and deliver your order. gopozz stores that data for the shop and does not use it for anything else.

  • Online payments go directly to the shop's own payment gateway; we do not receive your card or UPI details.
  • Questions about an order, or requests to see, correct or delete your data, should go to that shop first. Each store also has a self-service "delete my data" page, and you can find it through our data deletion page.
  • If the shop does not respond, write to our Grievance Officer and we will help.

5. Who we share it with

We share personal data only with service providers that help us run gopozz, under contracts that require them to protect it and use it only for that work:

  • Hosting and storage (our servers and backups are with our hosting provider).
  • Email and SMS delivery (for one-time codes and notifications).
  • Payment gateways, for paying for your plan; and, for your own store, the gateway and courier accounts that you connect.
  • AI providers, only when you use an AI feature (see below).
  • Professional advisers (accountants, lawyers) where needed, and government or law-enforcement authorities when the law requires it.
  • A buyer or successor of our business, if gopozz is merged or sold, under this same policy.

6. AI features

Some features (such as writing a product description from a photo, translations, captions, a shopping assistant or social posts) send the text or images you choose to an AI provider (Anthropic's Claude) to produce a result. We send only what the feature needs, the provider does not use it to train its models under our agreement, and you should review AI output before publishing it. AI features are optional.

7. How long we keep it

  • Account and business data: for as long as your account is active.
  • After your plan expires or you close your account: we keep your data for 90 days so you can come back or export it, and then delete or anonymise it, unless the law requires us to keep it longer.
  • Invoices, payments and tax records: for 8 years, as Indian tax and accounting law requires.
  • Server logs: up to 180 days, for security.
  • Backups: overwritten on a rolling basis, normally within 90 days.

8. Your rights

Under the DPDP Act you have the right to:

  • get a summary of the personal data we hold about you and how it is used;
  • have it corrected, completed or updated;
  • have it erased when it is no longer needed, and withdraw consent at any time (this does not affect what was done before you withdrew it);
  • nominate another person to exercise your rights if you die or become unable to;
  • complain to our Grievance Officer and, if you are not satisfied, to the Data Protection Board of India.

Most details can be changed in your account. For anything else, email our Grievance Officer from your registered email. We may ask you to confirm your identity before acting.

9. How we protect it

We use reasonable security practices, including HTTPS encryption for all traffic, hashed passwords, encrypted storage of payment and courier keys, access limited to staff who need it, separation of each business's data, regular backups and monitoring. No system is perfectly secure; if a breach affects your personal data we will inform you and the Data Protection Board as the law requires.

10. Storage and transfer outside India

Data may be processed outside India by our service providers (for example email delivery or AI processing), only to countries not restricted by the Government of India and with safeguards in place.

11. Cookies

We use essential cookies to keep you signed in, remember your cart and language, and protect forms from abuse; and basic analytics cookies to understand how the site is used. You can block cookies in your browser, but signing in and checkout need the essential ones.

12. Children

gopozz is a business tool for adults. Merchant accounts are for people aged 18 or over. We do not knowingly collect children's data; if you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy as the product or the law changes. We will change the "Last updated" date above and, for significant changes, notify merchants by email or in the dashboard before they take effect.