Privacy Policy

1. Who is responsible

Devotrend ("we") runs DevoCatalog. For supplier account data we are the data fiduciary. When a buyer opens a supplier's catalogue link, the supplier is responsible for the buyer's data and we process it on the supplier's behalf.

2. What we collect

Suppliers: name, email and/or mobile number, business details, billing details (including GSTIN), and how you use the service.

Buyers: when you submit a shortlist or request access — your name, company, phone, and optionally email, country and message. While you browse a catalogue we record which products you view and shortlist, linked to a random device identifier stored in your browser, so the supplier can follow up on what interested you. We do not use advertising cookies or track you across other websites.

Technical data: IP address and browser details, used briefly for security and rate limiting.

3. Why we use it

To provide the service, keep it secure, send the messages you need (sign-in codes, inquiry notifications, invoices), bill subscriptions, and meet legal obligations. Buyers consent when they submit their details; marketing messages are only sent if a buyer separately opts in.

4. Who we share it with

Service providers that process data for us under contract: our hosting provider (servers and storage), Google Firebase (mobile number sign-in), our email provider, Razorpay (payments — card and UPI details go directly to Razorpay, never to us), and Sentry (error reports, without request bodies). Some of these providers are outside India; we transfer data only as permitted by law.

AI suggestions run on our own servers with open-source models unless a supplier switches on external AI. Then the supplier's product details and photos (names, notes, attributes, label text and images) are sent to OpenAI for DevoCatalog AI, or to the AI provider the supplier chose for their own API key, under that provider's business API terms. Buyers' personal data is never sent to an AI provider.

We never sell personal data, and we never share one supplier's buyers with another supplier.

5. How long we keep it

Supplier account data: while the account is active, and for 180 days after it becomes read-only, then deleted (tax invoices are kept for the period the law requires). Buyer browsing activity: up to 24 months. A supplier can erase a buyer's personal data at any time.

6. Your rights

You can ask for access to, correction of, or erasure of your personal data, withdraw consent, and nominate someone to exercise these rights for you. Buyers can contact the supplier who shared the link, or us, and we will help the supplier respond. Suppliers can export or correct their data in the app.

If you are not satisfied, contact our Grievance Officer (see the Grievance page). You may also complain to the Data Protection Board of India.

7. Security

Data is encrypted in transit; backups are encrypted; each supplier's data is isolated at the database level; access is limited to people who need it. No system is perfectly secure — if a breach affects you, we will notify you and the authorities as the law requires.

8. Changes and contact

We will post changes here with a new date. Questions: support@devoconnect.com.