Privacy policy

Last updated 18 October 2026

This policy explains how StudioCb Private Limited ("SellCraz", "we") handles personal data when you use SellCraz. We act as the Data Fiduciary under India's Digital Personal Data Protection Act, 2023.

1. What we collect

Account: email address, handle, display name, city, and profile and banner images you upload. If you sign in with Google, we receive your email and basic profile from Google.
Delivery: the addresses and phone numbers you save for orders.
Activity: bids, purchases, orders, follows, chat messages in live shows, reports you file, and your CrazCash balance and history.
Sellers only: business or individual details for verification, such as PAN, GSTIN, company details, a GST certificate, and for individuals the last four digits of Aadhaar plus a one-way keyed fingerprint of the number. We do not store full Aadhaar numbers.
Live video: sellers' camera and microphone while they are broadcasting a show.
Technical: IP address, device and browser details, and request logs, used for security, rate limiting and fixing problems.

2. Why we use it

To run your account and the marketplace (auctions, orders, delivery, notifications), to verify sellers, to keep SellCraz safe (fraud and abuse prevention, moderation, enforcing our terms), to provide support, and to meet legal obligations. We do not sell your personal data and we do not use advertising trackers.

3. What others can see

Your handle, display name, avatar and city are public on your profile. Your bids are visible to other people taking part in the same auction. Chat messages are visible to viewers of that show. Addresses, email, phone numbers, balances and verification details are never shown publicly. Sellers see the delivery details needed to ship your order.

4. Service providers

We use trusted providers to run SellCraz: Supabase (database, sign-in and file storage), Vercel (hosting), LiveKit (live video) and Google (optional sign-in and web fonts). They process data on our behalf under their own security and confidentiality commitments, and some of them may process data outside India.

5. How long we keep it

We keep account data while your account is open. Verification details from rejected seller applications are deleted 180 days after the decision. Order and transaction records may be kept longer where tax or consumer law requires. Server logs are kept for a short period by our hosting provider.

6. Security

Data is encrypted in transit. Access is restricted by per-user database rules, and sensitive operations run only on our servers. Your sign-in session is stored in your browser on your device. If a breach affects you, we will notify you and the Data Protection Board as the law requires.

7. Your rights

You can ask for a summary of the personal data we hold about you, ask us to correct or complete it, ask us to erase it (subject to records we must keep by law), withdraw consent, and nominate someone to exercise your rights if you die or become incapacitated. Contact our grievance officer; we respond within the time the law sets.

8. Children

SellCraz is only for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has an account, contact us and we will remove it.

9. Changes and contact

We will post updates here with a new date. Questions or complaints: sellcraz.app@gmail.com, or see the grievance officer page. You may also complain to the Data Protection Board of India.