Terms
Privacy Policy
What GFX collects, why, who it goes to, how long it is kept and what you can ask us to do with it.
This document is published for review and has not been settled with counsel. It does not yet bind GFX or anyone else. The version that takes effect will carry a version number and an effective date in the stamp above.
Counsel must review this page before it takes effect. India's data protection regime has specific requirements for notice, consent, grievance handling and children's data, and a privacy policy written from general principles will not satisfy them. This draft sets out what GFX actually does so the binding version can be written against the real processing.
Who we are
[FILL IN: legal entity, registered address] operates gfx.network and is responsible for the personal data described here.
Data protection contact: [FILL IN: name or role, email, address] [FILL IN: counsel to confirm whether a Data Protection Officer must be appointed and named]
What we collect
When you buy Name, delivery address, email, phone. Order contents and history. Payment status — not your card number, which goes to the payment provider and never to us.
When you create an account Login credentials, and anything you choose to save such as saved addresses.
When you sell Business name and legal entity details, GSTIN and PAN, bank account details, pickup addresses, the identity of the people who operate the account, and the documents supplied for verification.
When you contact us Whatever you put in the message, your contact details, and the IP address and browser the message came from.
Automatically IP address, device and browser, pages visited, and cookies. [FILL IN: counsel and engineering to complete the cookie inventory — analytics, advertising pixels, session]
Why we use it
| Purpose | What it covers |
|---|---|
| Fulfilling your order | Passing your name, address and phone to the seller and the carrier so it can be delivered |
| Payments and refunds | Processing payment, issuing refunds, reconciling settlements |
| Support | Answering you, and investigating what went wrong |
| Verifying sellers | Checking GST, PAN and bank details before an account can sell |
| Warranty and authenticity | Tying serial numbers to orders so a purchase can be proved years later |
| Safety and fraud | Detecting counterfeit listings, fraudulent orders and account takeover |
| Legal obligations | Tax records, invoices, statutory retention |
| Improving the platform | Understanding what works. Aggregate wherever aggregate will do |
[FILL IN: counsel to map each purpose to a lawful basis and set out the consent mechanics]
Who it goes to
Sellers receive your name, delivery address and phone — only what is needed to fulfil the order. The Seller Agreement forbids them using it for marketing, adding you to a list, selling it on, or contacting you about anything other than your order.
Carriers receive what is needed to deliver: name, address, phone.
The payment provider handles the payment. Your card details go to them, not to us.
Service providers who run parts of the platform — hosting, search, email delivery, analytics — under contract, for those purposes only.
Authorities, where the law requires it.
We do not sell your personal data. Not to sellers, not to advertisers, not to anyone.
Where it is stored
Primarily in India. [FILL IN: confirm regions across Firebase, Firestore, BigQuery, search and email providers, and whether any transfer leaves India]
How long we keep it
| Order and invoice records | As long as tax and company law requires — [FILL IN: period] |
| Warranty and serial records | Long. The point of the vault is that it is there years later |
| Seller KYC documents | [FILL IN] |
| Support messages | [FILL IN] |
| Account data | Until you close the account, then [FILL IN] |
Your rights
Subject to what the law provides, you can ask us to: tell you what we hold about you, correct it, delete it, stop using it for a particular purpose, or give you a copy.
How to ask: [FILL IN: email address], or the contact page. How long we take: [FILL IN: confirm the statutory period]
If you are not satisfied with how we handled a request, escalate to the Grievance Officer on the contact page.
Children
GFX is not intended for anyone under 18 and we do not knowingly collect their data. [FILL IN: counsel — India's regime has specific obligations here that go beyond a statement of intent]
Security
Access is restricted to the people who need it. Data in transit is encrypted. Payment details never reach our systems. Seller KYC documents are held with restricted access and an audit trail.
No system is perfectly secure, and anyone who tells you otherwise is selling something. [FILL IN: counsel to add breach notification obligations and timelines]
Changes
Every version of this page stays readable, with what changed and when. Material changes are announced before they take effect.
Version 1, effective 18 September 2026. Every version of this page, with what changed and when.
Questions about this page: contact us.