Privacy Policy
Version 1, published Sep 15, 2026
This policy explains what personal data Nmjoy collects, why we collect it, who we share it with, how long we keep it, and the rights you have over it under the Digital Personal Data Protection Act 2023 ("DPDP Act").
1. Who we are
Nmjoy
India
Grievance Officer: Nmjoy Grievance Officer (grievance@nmjoy.com)
Nmjoy ("we", "us") operates the Nmjoy marketplace and is the data fiduciary for the personal data described in this policy; you are the data principal. Privacy requests and questions go to privacy@nmjoy.com. Our Grievance Officer, Nmjoy Grievance Officer (grievance@nmjoy.com), is the contact for grievances about personal data.
2. What we collect
Account data. Your email address, display name, optional avatar, and how you sign in: your password, which we keep only as a one-way hash we cannot reverse, and, if you sign in with Google, the account identifier and verified email address Google gives us. We do not receive access to your Google account.
Sign-in data. For each device you are signed in on: when you signed in and last used it, and its IP address and browser user agent, so that you can see your sessions and end them. It is deleted when the session ends or expires. If you turn on two-step sign-in, we also keep your authenticator key, encrypted, and one-way hashes of your recovery codes, until you turn it off.
Seller data. If you open a store: your name, your email address, store name, description, and the recipient identifier returned by our payout provider. We do not collect PAN or GSTIN, and we do not store your bank account or UPI details; the payout provider holds them.
Transaction data. Orders and the products in them, amounts in rupees, payment status, and the payment identifier from our payment provider. We keep this as a business and tax record.
Content you post. Reviews, questions, answers, and any reports you file, including the evidence links you attach.
Moderation and support data. Messages you send us, reports about you or your content, and the outcome and reason of any moderation decision.
Acceptance records. Which version of each agreement you accepted, when, and the IP address and browser user agent at that moment. We keep this so that both of us can prove what was agreed.
Technical data. Server logs, and an audit record of administrative actions taken on your account or content.
We do not collect precise location, biometric data, or any other data beyond what is listed here, and we do not build profiles of your browsing.
3. Why we use it, and on what basis
We use personal data to create and run your account, process orders and deliver purchases, pay sellers, issue invoices and keep tax and accounting records, record which agreements you accepted, moderate content and handle reports, prevent fraud and abuse and handle payment disputes, send service email about your orders and account, and keep the marketplace secure and running.
Under the DPDP Act we process personal data either with your consent or for a legitimate use recognised by section 7 of the Act:
| Purpose | Basis |
|---|---|
| Creating and running your account, delivering purchases, paying sellers, service email | Your consent, given when you create an account and accept our terms, and your voluntary provision of the data for the purpose you asked us to fulfil |
| Keeping tax and accounting records and GST invoices | Compliance with law |
| Recording which agreement version you accepted | Compliance with law, and establishing what was agreed |
| Moderating content, handling reports, responding to lawful orders | Compliance with law and with court or government orders |
| Preventing fraud, abuse and payment disputes; keeping the marketplace secure | Consent given when you accept our terms; where the law recognises it, protection against fraud and security incidents |
Where we rely on your consent, it is specific to the purposes in this policy, and you may withdraw it at any time as described in section 9. Withdrawing consent stops future processing for that purpose but does not undo processing already done, and if the processing is necessary to run your account we will close it.
4. Who we share it with
We share the minimum each provider needs to do its job. Each provider acts as our data processor and is bound by a written contract that limits what it may do with the data.
| Provider role | What it receives | Why |
|---|---|---|
| Payment provider | Order amount and the payment details you enter directly with it (UPI, card, net banking or wallet) | To take payment and handle refunds and chargebacks |
| Payout provider | Store name, seller earnings, and the bank account or UPI details you enter directly with it | To pay sellers their earnings |
| Email provider | Email address, display name, and the content of service email | To deliver receipts, notices and account email |
| Hosting and database provider | All data described in section 2 | To store the data and run the marketplace |
We also share data with the following recipients, who are not our processors:
- Sellers. A seller sees that a sale of their product occurred, its value, and your display name where you have posted a review or question on their product. Sellers do not receive your email address, payment details, or any other account data.
- Google, if you sign in with it. Google learns that you signed in to Nmjoy, as with any site that offers Google sign-in. We send Google nothing else; its own privacy policy governs what it does with that.
- Authorities and professional advisers. Where the law requires it, in response to a lawful order from a court or government agency, or to establish, exercise or defend legal claims.
- A successor business. If we sell or reorganise the business, the data may transfer to the new operator, who must honour this policy.
We do not sell personal data, and we do not share it for advertising.
5. Processors
Our processors fall into the categories listed in section 4: payment, payout, email, and hosting and database services. A current list naming each provider, its role and where it processes data is available on request from privacy@nmjoy.com. We will tell you before adding a new category of processor by publishing a new version of this policy.
6. Our role and the role of sellers
We are the data fiduciary for the data described in this policy. Sellers are independent businesses. Where a seller receives your display name through a review or question, or the sale data described in section 4, the seller is a separate data fiduciary for that data and must handle it in accordance with the DPDP Act and our Seller Data Addendum, which forms part of our Seller Agreement. We do not act as a processor for sellers, and sellers do not act as our processors.
7. Where data is processed
The marketplace serves India, and our providers may store or process data on servers outside India. The DPDP Act permits this except to countries the Central Government restricts by notification; we do not transfer personal data to any such country. Our payment provider keeps payment data in India as the Reserve Bank of India requires. You may ask us at privacy@nmjoy.com where each provider processes data.
8. How long we keep it
- Account and store data. While your account is open, then 30 days after closure.
- Orders, payments, earnings and payouts. 8 years from the end of the financial year of the transaction, because the Income-tax Act 1961 and the Companies Act 2013 require it.
- Agreement acceptance records. 8 years, for the same reason.
- Moderation decisions and audit logs. 2 years from the decision or action.
- Content you posted. Until you delete it or your account closes.
- Server logs. 180 days, as rule 3(1)(h) of the IT Rules 2021 requires; account registration records are also kept for 180 days after closure under the same rule.
Closing your account removes it and your store from the marketplace. Records we are legally required to retain are kept for the periods above and then deleted. Where you have not used your account for 3 years, we will remind you and then delete data that we are not required to keep.
9. Your rights
Under the DPDP Act you have the right to:
- access a summary of the personal data we hold about you, how we use it, and who we have shared it with;
- correct, complete or update inaccurate or incomplete data;
- erase data that we no longer need for the purpose it was collected or that we are not required by law to keep;
- withdraw consent at any time, as easily as you gave it;
- nominate another person to exercise these rights on your behalf if you die or are incapacitated; and
- have a grievance heard through our Grievance Officer and, if you are not satisfied, by the Data Protection Board of India.
To exercise a right, email privacy@nmjoy.com from the email address on your account, or use your account settings, where you can correct your details and close your account yourself. We respond within 30 days. We may ask you to verify your identity before acting. Grievances go to our Grievance Officer, Nmjoy Grievance Officer (grievance@nmjoy.com); we acknowledge within 7 days and resolve within 15 days. You may approach the Data Protection Board of India once you have exhausted this route.
You must give us accurate information and not impersonate anyone or file a false or frivolous grievance; the DPDP Act treats these as duties of a data principal.
10. Security and breach notification
We restrict access to personal data to the people who need it, encrypt it in transit, and keep an audit log of administrative actions. No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and each affected data principal in the manner and within the time the DPDP Act and its rules prescribe, and we report cyber security incidents to CERT-In where the Information Technology Act 2000 requires.
11. Automated decisions
We do not make any decision about you that is based solely on automated processing and that has legal or similarly significant effects on you. Every moderation decision, account suspension and ban is made or reviewed by a person.
12. Children
The marketplace is for people aged 18 and over. The DPDP Act requires verifiable parental consent before a child's personal data is processed, and we have no way to obtain it, so we do not open accounts for anyone younger. We do not knowingly collect data about a child and will delete it promptly if we learn we have.
13. Cookies
We use only cookies that are strictly necessary to sign you in and keep your session. We do not run advertising or third-party analytics cookies. Our Cookie Policy lists each cookie we set and its purpose.
14. Changes and version history
We publish every version of this policy, numbered and dated, so you can read the exact version that applied at any time. Where a change is material, we will notify you by email or by a notice on the marketplace before it takes effect. This is version 1.
15. Contact
Privacy requests and questions: privacy@nmjoy.com. Grievance Officer: Nmjoy Grievance Officer (grievance@nmjoy.com). Our postal address, where set out, is in section 1 and in our Legal Notice.