Privacy Policy
Last updated: 2 November 2026
This policy explains what personal data QiShoppie collects, why, who we share it with, how long we keep it and how you can have it deleted. It also covers the data we receive when a seller connects a social media account.
1. Who is responsible for your data
QiShoppie is operated by Mohammad Shakeer, 2-135/64, Lahari Enclave Phase 2, Gajularamaram, Hyderabad, Telangana 500055. Contact: support@qishoppie.com.
- Seller accounts: for the data of sellers and their staff (account, store, billing, connected accounts), QiShoppie decides how it is used (we are the "data fiduciary" under the Digital Personal Data Protection Act, 2023).
- Shoppers: for the data of people who buy from a seller's store, the seller is responsible and QiShoppie processes it only on the seller's instructions to run their store. If you bought from a store on QiShoppie, contact that store first; we will help them answer you.
2. Data we collect
- Account: name, email, password (stored only as a hash), sign-in codes, country, the date you accepted our terms, marketing choice.
- Store and billing: store name and address, legal and GST details, plan, bills and payments for our fees.
- Store data you add or receive: products, orders, customers, staff, content and settings.
- Connected accounts: see section 3.
- Usage and security: sign-in times, IP address, browser, staff activity log, error logs.
- Cookies: a session cookie to keep you signed in and a cookie that remembers your store. The admin uses no advertising cookies. Stores show shoppers a cookie choice where it is needed.
4. YouTube and Google data
QiShoppie uses the YouTube API Services to publish videos and read channel statistics and comments for sellers who connect a YouTube channel. By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google's use of your data is described in the Google Privacy Policy.
QiShoppie's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can remove QiShoppie's access at any time in your Google Account at myaccount.google.com/permissions. We delete stored YouTube data within 30 days of a disconnection, and refresh stored YouTube statistics at least every 30 days or delete them.
5. Why we use data
- to provide the service you signed up for: your store, admin, connected accounts and support (contract);
- to bill our fees and keep GST and accounting records (legal obligation);
- to keep the service secure, prevent fraud and fix errors (legitimate use);
- to send you service emails (sign-in codes, invites, bills, notices) and, if you opted in, product news (consent; you can opt out at any time).
7. How long we keep data
- Account and store data: while the account or store is open.
- Social tokens: until you disconnect the account or close the store; then deleted at once.
- After a store is closed and purged, its data is deleted. Our bills, credit notes and audit records are kept for the period Indian tax and accounting law requires.
- Security and error logs: only as long as needed to keep the service secure.
8. Security
Each store's data is kept apart from every other store's in the database. Connections use HTTPS, passwords are hashed, tokens and payment credentials are encrypted, and staff access follows roles and permissions. No system is perfectly secure; if a breach affects your data we will tell you and the authorities as the law requires.
9. Your rights
Under the Digital Personal Data Protection Act, 2023 you can ask to access, correct, complete or erase your personal data, withdraw consent, and nominate someone to act for you. Write to support@qishoppie.com. We answer within 30 days. To delete data, see our data deletion instructions.
Grievance Officer: Mohammad Shakeer, support@qishoppie.com. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.
10. Children
QiShoppie is for sellers aged 18 or over. We do not knowingly collect data from children for our own purposes.
11. Changes to this policy
We will post any change here with a new date, and tell sellers by email or in the admin before a significant change takes effect.
3. Connected social accounts
A seller can connect their own social accounts to publish to them and see their results from the QiShoppie admin:
How you connect
You connect each account yourself through the platform's own sign-in and permission screen (OAuth). We never see your password for that platform. You choose which Page, profile or channel to connect, and the platform shows you the permissions we ask for.
What we receive
What we do with it
We use this data only to provide these features to that seller. We do not sell it, we do not share it with other sellers, we do not use it for advertising of our own, and we do not use it to train AI models.
How we store it
Tokens are stored for each store separately and encrypted (sealed, AES-256-GCM) with a server key that is kept apart from the database. They are never shown in the admin, in exports or in logs. Only the store they belong to can use them. Our publishing service, a self-hosted copy of Postiz run only by us and not shared with anyone, keeps the tokens it needs in its own private database.
Disconnecting
When you disconnect an account in the admin, we delete its tokens at once and stop all access. You can also remove QiShoppie in the platform's own settings; see our data deletion instructions.