1. Who we are

KartMojo is a commerce platform for Indian D2C brands, operated by Quickmerce Internet Pvt. Ltd. (“KartMojo”, “we”, “us”), registered office ANR/162, New Ashutosh Nagar, Lucknow, Uttar Pradesh, India, Pincode: 226023. This policy explains how we handle personal data on kartmojo.com, in the merchant dashboard and across our platform services. It is written to meet the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000 (“IT Act”) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”).

2. Scope and our two roles

We play two different roles, and your rights run to the right party:

Data fiduciary, for merchants and visitors. For personal data of merchants, their staff, and visitors to our website, we decide why and how the data is processed. This policy governs that data.
Data processor, for shoppers on merchant stores. When someone buys from a store built on KartMojo, the merchant who runs that store is the data fiduciary for the shopper’s data (name, address, phone, order history). We process it only on the merchant’s instructions, to host and run their store. Section 12 explains what this means for shoppers.

3. Personal data we collect

Data you give us

Account data: your name, email address, phone number and password (stored only as a secure hash). If you use Sign in with Google, we receive your name, email address and profile picture from Google.
Business and KYC data: business name, address, GSTIN, and, where you provide them for payouts or invoicing, PAN and bank account details.
Store content: products, images, pages, brand assets and any customer lists you import.
Communications: messages you send our support team, feedback, and emails you exchange with us.

Data created when you use KartMojo

Billing and payment data: your plan, invoices, and references to your payment method and autopay mandate (such as card type and last four digits, or a masked UPI ID). Card and UPI credentials are entered directly with our payment gateway. We never receive or store full card numbers, CVVs or UPI PINs.
Usage and log data: pages and features used, actions taken, IP address, browser and device type, and error and security logs.
Cookies and similar technologies: see our Cookie Policy.
AI interaction data: the prompts you give our AI features, the store data used to answer them, and the responses produced.

Data from services you connect

When you connect a payment gateway, WhatsApp provider, logistics partner or Meta catalogue, we receive the data needed to run that feature, such as payment status, customer messages and shipment status. Section 6 lists what we receive when you connect an Instagram account.

Passwords and financial information such as bank account and payment instrument details are sensitive personal data under the SPDI Rules. We collect them only with your consent and only for the purposes below.

4. Why we use it and on what basis

We process your personal data on the basis of your consent, given when you sign up or choose to use a feature, and for the legitimate uses the DPDP Act allows, including where you have voluntarily provided data for a specified purpose and where the law requires us to process it. We use it to:

create and run your account and store, and provide the features you use;
bill plan fees and commission, collect payments and follow up on unpaid invoices;
send service messages, such as security alerts, invoices, billing notices and changes to our terms. These are part of the service and continue while your account is active;
send product news and marketing, which you can opt out of at any time through the link in the email or by writing to us;
answer support requests and complaints;
detect, prevent and investigate fraud, abuse and security incidents;
understand how the Platform is used and improve it; and
meet legal obligations, such as tax, accounting and record-keeping, and respond to lawful requests from authorities.

You can withdraw consent at any time by writing to support@kartmojo.com. Withdrawing is as easy as giving consent. It does not affect processing already done, and if the data is needed to provide the service, we may no longer be able to provide it.

5. AI features

The Otto assistant, AI product copy and WhatsApp AI replies send your prompt and the store data needed to answer it to a third-party AI model provider, Anthropic (Claude API). The provider processes this data to generate the response. KartMojo does not use your content to train AI models. Otto changes your store only after you approve the action. AI outputs can be wrong; review them before you rely on them. Section 6 explains what Instagram reply drafts send to the AI provider.

6. Instagram and Meta data

A store on KartMojo can connect its Instagram professional account through Instagram Login (the Instagram API with Instagram Login). The merchant decides whether to connect, and can disconnect at any time. For people who message or comment on a store’s Instagram account, the store is the data fiduciary and we process their data for the store, as section 12 explains.

What we receive and store

The connected account: its Instagram account ID, username, name, profile picture link and account type; its follower, following and post counts; the permissions granted; and the access token Instagram issues. We encrypt the token at rest and never show it in the dashboard.
Posts and reels: the media ID, type, caption, link to the post, a link to the media file on Instagram’s servers, a copy of the thumbnail in our file storage, like and comment counts, the time it was posted, and the products the store links to it.
Insights: counts Meta reports for each post (such as views, reach, likes, comments, saves, shares, profile visits and follows, and for reels the average watch time and skip rate) and for the account each day (reach, views, profile visits, accounts engaged, interactions and new followers). These are totals and do not identify the people behind them.
Messages and comments sent to the account: direct messages, comments, story mentions and replies, and reactions, with any attachments. With each one we keep the sender’s Instagram-scoped ID, and we look up their name and username through Instagram’s profile API. We also keep the replies the store’s staff send from KartMojo.
Posts the store creates in KartMojo to publish on Instagram: the media, caption, scheduled time and linked product, and the ID and link of the published post.
The raw notifications Meta sends us about new messages and comments, which we keep for 30 days to process them and investigate problems.

How we use it and who sees it

We use this data only to run the Instagram features for the store that connected the account: showing its posts, reels and insights, letting its staff read and answer messages and comments in the inbox, publishing and scheduling the posts it creates, and linking posts to its products. Only that store’s staff can see it in the dashboard. Other stores on KartMojo cannot. Authorised KartMojo staff can access it when needed to support the store or fix a fault, under the controls in section 10.We do not sell Instagram data, use it for advertising, or combine it across stores.

AI reply drafts

When a staff member asks Otto to draft a reply in the inbox, we send the AI provider the latest messages in that conversation (up to 16), the customer’s name or Instagram username, up to 40 of the store’s products with prices and stock, the store’s cash on delivery and free shipping settings, and, if the conversation is linked to a customer, their three most recent paid orders. The provider is Anthropic (Claude API), as described in section 5. The provider returns a draft. A staff member reads it, edits it if needed, and decides whether to send it. Otto does not send Instagram replies on its own, and we do not use Instagram data to train AI models.

Service providers

Amazon Web Services stores and processes this data in the AWS Mumbai region (India). Anthropic receives the conversation data described above when staff ask for a draft. Meta receives the replies and posts the store sends through KartMojo. Section 7 lists our other service providers.

How long we keep it

While the account is connected, we keep this data and refresh it from Instagram.
We delete the access token as soon as the account is disconnected.
After a disconnect, the posts, insights, conversations and scheduled posts already stored stay in the store’s account so it keeps its history. We delete them when the store’s account is closed (see section 9) or when someone asks us to, as described below.
We delete Meta’s raw notifications after 30 days.

Disconnecting and deleting your data

Disconnect in KartMojo: under Sales channels, Instagram, the merchant can disconnect the account. We delete the access token straight away and stop reading from the account.
Remove KartMojo in Instagram: when you remove KartMojo from the apps connected to your Instagram account, Meta notifies us. We disconnect the account and delete the access token as soon as the notice arrives.
Data deletion request through Meta: when Meta sends us a deletion request for an Instagram account, we carry it out at once, before we reply to Meta. We delete the connected account’s token and profile details; its synced posts and their thumbnails in each store it was connected to, unless another Instagram account is still connected to that store; every contact, conversation and message received through it; stored Meta notifications that contain its ID; and the Instagram ID on any customer record. If the request is for a person who messaged a store, we delete their contact record, conversations and messages in every store, and the stored notifications that contain their ID. Meta shows you a confirmation code and a link where you can check the status. We keep a record of the request with that code and a one-way hash of the Instagram ID, not the ID itself.
By email: to delete everything we hold for an Instagram account, including the daily account insights and the posts created in KartMojo for publishing, write to support@kartmojo.com from the email address on your KartMojo account with the subject “Instagram data deletion”. We acknowledge your request within 24 hours and complete it within 15 days.

Deleted data can remain in encrypted backups until they are overwritten, as section 9 explains. Posts already published on Instagram stay there; delete them in Instagram. Our data deletion instructions give the steps for each option.

8. Transfers outside India

We store platform data in India, in the AWS Mumbai region. Some service providers, including Google, Anthropic, Resend and the third-party services you connect, may process data outside India. We transfer personal data outside India only as the DPDP Act permits, and not to any country the Government of India restricts.

9. How long we keep it

Account and store data: kept while your account is active. After you close your account, it remains available for 30 days so you can ask for an export, then we delete or anonymise it.
Registration information: kept for 180 days after your account is cancelled or withdrawn, as Rule 3(1)(h) of the IT Rules, 2021 requires.
Invoices, tax and accounting records: kept for at least eight years, as the Companies Act, 2013 and GST law require.
Content we remove under our Terms, and related records: kept for 180 days, or longer if a court or authorised agency requires.
Marketing preferences: kept until you opt out, and a record of the opt-out after that, so we respect it.
Backups: deleted data can remain in encrypted backups until they are overwritten in the normal rotation cycle.

We may keep data longer where needed to resolve a dispute, enforce our terms or meet a legal obligation.

10. Security

We follow reasonable security practices as required by the SPDI Rules and the DPDP Act: all traffic is encrypted in transit with TLS, passwords are hashed, merchant secrets such as gateway and messaging keys are encrypted at rest and never shown back in full, and access to production data is restricted to authorised staff and logged. No internet service can be fully secure. If a personal data breach affects you, we will notify you and the Data Protection Board of India as the DPDP Act requires.

11. Your rights and how to use them

Under the DPDP Act and the SPDI Rules, you have the right to:

get a summary of your personal data we process and the processing activities;
learn the identities of the data fiduciaries and processors we have shared it with;
have inaccurate or misleading data corrected, incomplete data completed, and data updated;
have your data erased when it is no longer needed for the purpose it was collected for, unless the law requires us to keep it;
withdraw consent at any time;
nominate another person to exercise your rights if you die or become incapable; and
have your grievances about our handling of your data addressed.

To use any of these rights, use our data request form, or email support@kartmojo.com from the email address on your account, with the subject “Data request”. We may ask you to verify your identity first. We will respond within the time the law sets. You can also download order and report exports from the dashboard at any time.

If you are not satisfied with our response, you may complain to the Data Protection Board of India. Under the DPDP Act, you should first use our grievance process in section 16.

12. If you are a shopper on a KartMojo store

If you bought from a store built on KartMojo, the merchant who runs that store decides how your data is used, and their privacy policy (published on their store) applies. Please send requests about your data to that merchant first. We process shopper data only on the merchant’s instructions and help merchants respond to such requests. If you cannot reach the merchant, use our data request form or write to support@kartmojo.com, and we will pass your request on.

13. Children

KartMojo is for people aged 18 and over. We do not knowingly collect personal data from children, and we do not track, monitor the behaviour of, or target advertising at children. If you believe a child has given us personal data, write to support@kartmojo.com and we will delete it.

14. Cookies

We use cookies and similar technologies on our website and dashboard. Our Cookie Policy lists them and explains how to control them.

15. Changes to this policy

We may update this policy when our practices or the law change. We will tell you about material changes by email or in the dashboard before they take effect, and the date at the top of this page always shows the current version.

16. Contact and Grievance Officer

For privacy questions, data requests and complaints, contact our Grievance Officer, who is also the contact for data principal requests under the DPDP Act:

Grievance Officer, Quickmerce Internet Pvt. Ltd.
ANR/162, New Ashutosh Nagar, Lucknow, Uttar Pradesh, India, Pincode: 226023
Email: support@kartmojo.com

You can also file a complaint with our grievance form, which gives you a reference number straight away.

We acknowledge complaints within 24 hours and resolve them within 15 days of receipt. If you are not satisfied with the outcome, you may approach the Data Protection Board of India.

Privacy Policy