Privacy policy

Backstock Bazaar is a B2B marketplace where Indian D2C brands sell RTO, customer-return and excess stock in graded bulk lots, and resellers buy those lots. “We” means the team that runs Backstock Bazaar.

This policy covers this website and the emails it sends. It applies to visitors, brands and resellers. Every account is a business account, but the people behind it are real, so we treat names, emails, phone numbers and bank details as personal data.

Everything we hold, itemised. Most of it you type in yourself during sign-up, onboarding, listing and ordering. We don’t buy data about you from anyone.

Run the marketplace

Create your account, publish your lots, carry offers between buyer and seller, reserve stock and track each order from Reserved to Completed.

Check who is trading

Confirm your email and check your GSTIN's format and checksum for the Verified badge. Verified resellers can see masked brands, verified-only prices and manifests.

Send you what you asked for

Emails for sign-in, offers, reservations, payments, saved-search alerts, the daily digest if you keep it on, and monthly commission statements.

Bill commission

Work out commission plus GST on completed orders and send brands one statement a month.

Keep trade honest

Compute grade accuracy, reservation completion and issue scores from real orders; act on lot reports; limit how often a form can be sent from one address.

Improve the product

Count visits, sign-ups, lots published and orders completed, and see which ads and links bring brands and resellers.

We use your data only for these purposes. We don’t sell it, and we don’t share it with anyone for their own advertising.

Brands choose how much of each lot is public. From the widest audience down to you alone:

1. Anyone, signed in or not

   Live lot pages: photos, quantities, grades, city, dispatch days, and price and brand name unless you restricted them. Your business name, badges and scores.

2. Verified resellers

   Prices set to 'verified resellers only', brand names masked until a buyer is verified, and manifests.

3. Your counterparty, after a reservation

   Masked brand names set to 'until offer accepted', each other's contact details, and the seller's UPI or bank details for payment.

4. Nobody but you

   Your private cost per unit, your floor price, saved lots and searches, and notification settings.

In offer messages, phone numbers, email addresses and UPI IDs are removed before they are saved until a reservation exists. After that, both sides see each other’s contact details on the order page.

These companies process data for us, only to provide their service. Some of them store data outside India.

Supabase

Database, sign-in and file storage for photos, manifests, invoices and payment proofs.

Vercel

Hosts the website and runs its server code.

PostHog

Product analytics: which pages and actions people use.

Resend

Sends our emails.

Google

Sign-in, only if you choose 'Continue with Google'. Google Ads, if you arrived from one of our ads.

We may also share data when the law requires it, for example with tax authorities or in reply to a valid legal order.

We use a few first-party cookies and browser storage. There are no third-party advertising cookies. Before an analytics event leaves your browser, we strip sign-in links, reset tokens and other secrets from it. Analytics knows a signed-in account by its account ID and a one-way hash of the email, not the email itself.

We keep account, profile and listing data while your account is open. When you ask us to delete your account, we erase your profile, payout details, photos, saved items and preferences.

Orders, invoices and commission records are tax records. Indian GST law requires them to be kept for 72 months from the due date of the annual return for that year, so we keep them for that period, then delete them. Payment screenshots and issue evidence are kept with the order they belong to.

India’s Digital Personal Data Protection Act, 2023 gives you these rights. Use any of them by writing to the Help page from the email address on your account.

See it

Ask for a summary of the personal data we hold about you and how we use it.

Correct it

Ask us to fix anything that is wrong or out of date.

Delete it

Ask us to close your account and erase your data. We keep only what the law requires, such as GST records of completed orders.

Withdraw consent

Set a saved search's alert to Off, ask us to stop digest emails, or block cookies other than the sign-in cookie in your browser. The site still works without analytics.

Complain

Write to us first. If we don't resolve it, Indian users can complain to the Data Protection Board of India.

Nominate

Name someone who can use these rights for you if you die or can no longer act.

The site runs only over HTTPS. Database rules let each account read only its own private rows, and payout details, manifests and gated prices are left out of pages and files that the viewer is not allowed to see. Passwords are stored as hashes by our sign-in provider. Forms that can be abused, such as lot reports, are rate-limited.

No system is perfectly safe. If a breach puts your data at risk, we will tell you and the Data Protection Board of India as the law requires.

When we change this policy, we update the date at the top. If a change affects how we use data you have already given us, we will email account holders before it takes effect.

Questions, requests or complaints about your data: write to the Help page. Tell us the email address on your account and what you need.