Privacy Policy

1. Who this covers

This Privacy Policy is a notice under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025, where they apply. Youbairia (“we”, “us”) is the Data Fiduciary for personal data processed on youbairia.com and related apps. Other Indian laws may also apply, including the Information Technology Act, 2000 and the Consumer Protection Act, 2019.

It applies to seller and buyer accounts, checkout, campaigns, communities, the AI store builder, admin tools, and Youbairia Pay demo forms. Our Terms and Conditions describe the services. If you do not agree, do not use the Platform.

You may exercise DPDP rights (access, correction, erasure, withdraw optional consent, grievance, nomination) on the Privacy requests page or by emailing sajjad@youbairia.com.

2. Data we collect

We collect only what we need for the purpose you used. Depending on features, that may include:

• Account data: name, email, phone, password hashes, age (to confirm you are 18+), profile and store details, and timestamps of Terms / Privacy acceptance.
• Commerce data: orders, products, prices, licences, payout preferences, GST or business details you choose to give us.
• UPI checkout data: amount, published UPI ID you paid to, submitted UTR / bank reference, payment status, and related support messages. We do not ask you to send us your UPI PIN, full card number, or CVV.
• Campaign and community data: joins, submissions, messages, and moderation notes.
• AI and product-improvement data: store-builder prompts and marketplace searches, including before you create an account. If you later sign in from the same browser, we may attach that history to your account so drafts are not lost.
• Pay demo data: name, work email, phone, company, business type, customer region, volume notes, and free-text messages you submit on /pay.
• Technical data: device and browser type, approximate location from network metadata, essential cookies for login and security, and anti-abuse signals (including Cloudflare Turnstile where enabled). If you allow analytics cookies, our site analytics tool may collect coarse usage data.
• Communications: emails, in-app notices, and messages you send via Telegram or WhatsApp when you choose those channels for verification or support.

We do not require a physical shipping address for digital goods. If you type an address into a form, we will store it as you provided it.

3. Why we use it (specified purpose)

We process personal data for these specified purposes, with your consent where the DPDP Act requires it, or as otherwise permitted (for example to honour a contract, detect fraud, or comply with law):

• Create and secure your account (name, email, password hash, optional Google sign-in).
• Complete checkout and match UPI payments (name, mobile, email, order, UTR / bank reference).
• Deliver digital access, licences, invoices, refunds, and seller or campaign fulfilment.
• Prevent fraud, fake UTRs, spam, abuse, and unauthorised access.
• Comply with tax, accounting, law-enforcement, and intermediary due-diligence duties.
• Send transactional messages (receipts, security, order status).
• Improve the Platform using aggregated or de-identified insights where practical.

Optional processing (you may refuse or withdraw):

• Marketing emails or product updates (only if you opt in; you can withdraw anytime).
• AI store-builder prompts and pre-account drafts, if you use those features.

We do not sell personal data. We do not use children’s data for tracking or targeted advertising.

4. Who we share it with

• Sellers, buyers, campaign owners, community hosts: only what the other party needs to fulfil that relationship (for example a buyer email for digital delivery). Recipients must not sell or spam that data.
• Processors: hosting and database (including Supabase / infrastructure that may be outside India), email and admin notification tools, Cloudflare or similar bot checks, our website host and optional analytics provider, and AI model APIs behind the store builder. They may use data only to provide their service to us.
• Banks / UPI apps: you already share payment data with them when you pay. We share order references as needed to confirm funds.
• Potential Pay partners: if you ask for a demo, we may share relevant business contact details under confidentiality. A demo form is not consent to unrelated marketing.
• Legal and safety: courts, government, or professional advisers when required or to protect users, Youbairia, or the public from harm or fraud.
• Business transfer: if we restructure, merge, or sell assets, data may move with the business under this Policy or a successor policy.

5. Storage, security, and location

We use access controls, encrypted transport (HTTPS), and least-privilege admin access. No method of storage or transmission is perfectly secure. You are responsible for your password and devices. If we become aware of a personal-data breach likely to affect you, we will notify the Data Protection Board of India and affected Data Principals as the DPDP Act and Rules require.

Servers and vendors may process data in India and in other countries (for example the United States or the European Union) where our hosts or AI providers operate. Those transfers are needed to deliver the service unless the Central Government later restricts a country. We take contractual and technical steps that are reasonable for a business of our size.

6. Retention

Account data is kept while the account is active. After closure we delete or irreversibly anonymise profile fields that we no longer need. We keep order, UTR, invoice, and payout records for as long as tax, accounting, dispute, and anti-fraud law require (typically several years). AI drafts and demo leads are kept while useful for the purpose you submitted them, then deleted or archived. Limited security logs may be retained to investigate abuse.

7. Cookies and similar technology

Essential cookies and similar storage are required for authentication, security, load balancing, and remembering drafts. You can refuse optional analytics in the cookie bar; checkout still works. Blocking essential cookies will stop sign-in from working. We do not require marketing pixels to complete a purchase.

8. Your rights (DPDP)

Subject to the DPDP Act and its rules, you may:

• Access a summary of personal data we hold about you and the processing activities.
• Correct inaccurate or incomplete data.
• Request erasure when we no longer need the data and no legal retention applies.
• Withdraw consent for optional processing (this may limit marketing or similar features).
• Nominate another person to exercise rights in case of death or incapacity, as the Act allows.
• Raise a grievance with our Grievance Officer, and approach the Data Protection Board if unresolved.

Use /privacy-requests or email sajjad@youbairia.com. Signed-in users can also download an account export from that page. We may verify you and refuse requests that are unlawful, excessive, or would break another person’s privacy or our legal duties (for example keeping an invoice). If you are in the EEA/UK and those laws apply, contact us and we will handle the request in good faith.

9. Children

Youbairia is only for users who are 18 years or older. Under the DPDP Act a child is a person under 18. We do not knowingly create accounts for children, track them, or show them targeted advertising. If you believe a minor has given us data, contact us. We will close the account and delete personal data except where law requires a limited record.

10. Sellers and other data fiduciaries

If you operate a store, campaign, or community, you may receive buyer or member data. You must use it only to fulfil that relationship, keep it secure, not sell or spam it, and honour DPDP duties where you are a separate Data Fiduciary. Youbairia may suspend access if you misuse personal data.

11. Changes

We may update this Policy. The “Last updated” date will change. Continued use after an update means you accept the revised Policy for subsequent processing. We will seek fresh consent where the DPDP Act requires it.

12. Grievance officer and contact