Welcome to House of Aroma (“we,” “us,” “our”). We are a technology aggregator connecting suppliers, resellers, payment processors, and logistics providers (“Third-Party Services”). By using our website, app, dashboards, or APIs (the “Platform”), you automatically consent to this Privacy Policy, our Terms of Service, and all linked policies. If you disagree, do not use the Platform.

1) Our Role (Aggregator • Data Stewardship)

• House of Aroma facilitates transactions between independent parties; we do not own or control third-party systems.

• For privacy purposes, we generally act as a data processor/service provider to Suppliers/Resellers (who act as data controllers/fiduciaries for buyer data).

• Each Third-Party Service (payment, courier, Shopify/WhatsApp integrations) has its own privacy policy — please review those separately.

2) Personal Data We Collect

You provide: name, email, phone, business profile, addresses, GST/PAN/KYC, payout bank/UPI, product content, and support communications.
We collect automatically: device & browser info, IP, approximate location, timestamps, clickstream, session logs; cookies/pixels for auth, preferences, analytics, and fraud prevention.
We receive via integrations (scope-limited): order IDs, product/catalog meta, buyer contact fields necessary for fulfillment; we request only what’s needed and permitted by you.

3) Why We Use Data (Purposes)

• Operate the Platform; route orders, tracking, payouts; provide support.

• Fraud/risk checks, security logging, and compliance (KYC/AML, tax/audit).

• Service communications (order status, policy updates); optional marketing (opt-out anytime).

• Product improvement, analytics, and debugging (aggregated or pseudonymized where possible).

We do not sell personal data.

4) Legal Basis (DPDP 2023 / GDPR-style)

• Consent: cookies/marketing; certain integrations.

• Performance of contract: order processing, payouts, support.

• Legal obligation: tax, audit, KYC/AML, law-enforcement requests.

• Legitimate interest: security, fraud prevention, product analytics (balanced and minimal).

5) Sharing of Data (Categories, not buyers)

We share data only with:

• Suppliers/Resellers (to fulfill orders and resolve issues).

• Shipping Partners (dispatch, delivery, returns).

• Payment Processors/Banks (charges, settlements, reversals).

• Security/IT vendors (hosting, storage, analytics, email/SMS/WhatsApp delivery) under confidentiality and DP terms.

• Regulators/Courts when lawfully required.
  We do not permit vendors to use data for their own advertising.

6) WhatsApp / Shopify / API Integrations

• If you connect WhatsApp/Shopify/Instagram or other apps, we access only scoped data needed to sync products and orders.

• Buyer notifications via WhatsApp/SMS/email use pre-approved, transactional templates; marketing on those channels requires consent.

• Disconnections revoke future access; previously synced data may be retained per retention laws.

7) Cookies, Pixels & “Do Not Track”

• We use necessary cookies (login, security) and optional analytics/marketing cookies (consent-based).

• Manage preferences via our cookie banner and your browser settings; disabling may degrade features.

• Some browsers send “Do Not Track” signals; we currently do not alter behavior solely on DNT but honor explicit consent choices in our banner.

8) Data Retention (with SLAs)

• KYC/Finance/Tax records: up to 8 years (or longer if legally required).

• Operational logs: 12–24 months (aggregated thereafter).

• Support tickets: 24 months.

• Marketing lists: until you unsubscribe or request deletion.

• Where deletion isn’t possible due to legal holds, we restrict access and pseudonymize when feasible.

9) Your Rights

Subject to law, you may access, correct, update, export, object, withdraw consent, or request deletion. We verify identity and may retain limited records to comply with law or resolve disputes.
Contact: privacy@[yourdomain].com.

10) Security

• TLS encryption, access controls, least-privilege roles, audit logs, and periodic vulnerability reviews.

• No system is perfectly secure; transmission is at your own risk. Promptly notify us of suspected compromise: security@[yourdomain].com.

11) Data Breach Response

• We investigate material incidents, contain exposure, and notify impacted users and/or authorities without undue delay (GDPR benchmark: within 72 hours where applicable).

• We document root cause and remediation.

12) Children’s Data

Platform is for 18+. We do not knowingly collect data from minors; if identified, we delete it.

13) Cross-Border Storage & Transfers

Data may be stored in India and/or with reputable cloud providers in other jurisdictions using contractual safeguards (e.g., SCC-style or DPDP-aligned clauses). By using the Platform, you consent to such transfers for service provision.

14) Automated Decision-Making / Profiling

We may use limited automated checks (e.g., fraud/risk signals, duplicate accounts, suspicious payout patterns). These do not produce solely automated decisions with legal or similarly significant effects; manual review is available upon request.

15) Marketing Choices

• Opt-out of marketing emails/SMS/WhatsApp anytime via unsubscribe links or support@[yourdomain].com.

• Transactional messages (order status, security alerts) are necessary and cannot be opted out.

16) Third-Party Links

External sites or apps linked from the Platform are outside our control. Review their privacy policies separately.

17) Data Subject Requests (Process)

Email privacy@[yourdomain].com with your request and proof of identity. We typically respond within 30 days (extendable where permitted). Certain requests (e.g., deletion) may be limited by tax/audit retention duties.

18) Changes to this Policy

We may update this Policy; changes are effective upon posting with an updated “Last Updated” date. Continued use of the Platform = automatic acceptance of updates.

19) Contact

Privacy: privacy@dropspot.in
Security: security@dropspot.in
Support: support@dropspot.in
Phone: +91-[7892304194]