1. The short version
We collect what we need to sign you in, take your order and get it delivered. We do not sell your personal data. Your one-time codes are stored only as an irreversible hash, and your mobile number is never written to our application logs.
2. What we collect
- Your mobile number — it is how you sign in, and how we and the seller reach you about an order.
- Your name, and email if you give one — for receipts and delivery.
- Delivery addresses — district, city, street and any landmark you add.
- Orders, returns and Poshaak credit — what you bought, from whom, and what we owe you.
- Wishlist, cart and the shops you follow — so the site remembers where you were.
- Searches you run — to fix results that return nothing and to decide what to stock.
- Technical data — IP address, browser and device, used to rate-limit sign-in codes and to spot abuse.
If you open a shop we also collect your business details, PAN and VAT status where you provide them, and your payout information.
3. Why we are allowed to use it
We use your data to perform the contract you enter when you order, to meet legal duties such as tax records, and for our legitimate interest in keeping the marketplace safe and working. Marketing messages are sent only where you have asked for them, and every one has a way to stop.
4. One-time codes and SMS
When you sign in we send a six-digit code by SMS. We store only a bcrypt hash of that code, never the code itself, and it expires within minutes. We keep a record of each code requested — the number, the time and the requesting IP — because that record is what stops someone running up your SMS bill or guessing their way into your account. Those records are deleted after 7 days.
Sending the message means passing your number to an SMS provider. They may process it outside Nepal, and they are permitted to use it only to deliver our message.
5. Who else sees your data
- The seller you ordered from — your name, delivery address and phone number, so they can fulfil the order. Nothing more.
- Delivery partners — the same details, to bring the parcel to your door.
- Payment providers — eSewa, Khalti, IME Pay or a card processor. We never see or store your full card number.
- Our hosting and SMS suppliers — who process data on our instructions only.
- Authorities — where the law requires it.
We do not sell your personal data, and we do not share it for anyone else's advertising.
6. How long we keep it
Order and invoice records are kept as long as tax law requires. Sign-in code records are deleted after 7 days. Your account and its addresses are kept until you ask us to close it, after which we remove what we are not legally required to keep.
We keep a record of the mobile numbers previously attached to an account. Numbers are recycled quickly in Nepal, and that history is what stops a stranger who is issued your old SIM from reaching your account.
7. Your choices
- See and correct your details from your account settings at any time.
- Change the number you sign in with, verifying the new one first.
- Ask for a copy of your data, or ask us to delete it.
- Stop marketing messages without affecting order updates, which we must still send.
Write to privacy@poshaak.com and we will respond within 30 days.
8. Cookies
We use cookies to keep you signed in, to remember your cart, and to protect forms against cross-site request forgery. These are necessary for the site to work; turning them off will stop sign-in and checkout from functioning.
9. Security
Traffic is encrypted in transit. Passwords and one-time codes are stored only as hashes. Access to production data is limited to the people who need it. No system is perfect — if a breach ever affects you, we will tell you and the relevant authority promptly.
10. Children
Poshaak is not intended for children. If you believe a child has given us personal data, write to us and we will remove it.