Privacy policy

NepalShop is an online platform that lets businesses in Nepal run an online store, manage products and orders, and answer customer messages from WhatsApp, Messenger, Instagram and TikTok in one place. NepalShop is operated by [Registered business name], [Business address] (“NepalShop”, “we”, “us”).

This policy explains what personal information we collect, why, who we share it with, and the choices you have. We handle personal information in line with the privacy laws that apply to us and to the stores using NepalShop, including Nepal's Individual Privacy Act, 2075 (2018), and where it applies, Australia's Privacy Act 1988.

Who this policy covers

• Store owners: businesses and people who have a NepalShop account and run a store on it.
• Shoppers: people who order from, or send a message to, a store that uses NepalShop.

Each store on NepalShop is run by an independent business. When you order from or message a store, that store is the seller you are dealing with and decides how to use your order and messages to serve you. NepalShop stores and processes that information on the store's behalf so the store can run its business.

Information we collect

From store owners

• Your name, email address and password. Passwords are stored only as a secure one-way hash; we can't read them.
• Store details you enter: store name and web address, logo, description, phone number, email, address, social media handles, delivery fees, products, photos, prices and stock.
• Settings for connected services, such as WhatsApp, Messenger, Instagram or TikTok account IDs and access tokens, and eSewa or Khalti merchant keys. Tokens and keys are stored encrypted.
• Account activity, such as when you last signed in.

From shoppers

• When you place an order: your name, mobile number, email (if you give it), delivery address (province, city, street or landmark), the items you order, any note you add, and how you choose to pay.
• When you pay online with eSewa or Khalti: the payment status and transaction reference sent to us by the payment provider. You pay on the provider's own page; we never receive your wallet ID, password, PIN or OTP.
• When you message a store on WhatsApp, Messenger, Instagram or TikTok, and the store has connected that account to NepalShop: the ID the platform uses for you (for WhatsApp, your phone number), your display name where the platform provides it, and the messages and the store's replies, with their times.

Collected automatically

• Your IP address, used briefly to protect sign-in, checkout and payments from abuse (for example, limiting repeated attempts). We don't keep it in our database.
• A sign-in cookie for store owners, which keeps you logged in for up to 30 days and is removed when you log out.
• Your shopping cart and your light/dark display preference, saved only in your own browser's storage. They aren't sent to us until you place an order.

We don't use advertising or third-party tracking cookies, and we don't sell personal information.

How we use information

• To provide store owners' accounts and stores, and to show their products to shoppers.
• To take orders and let the store confirm, deliver and collect payment for them, including contacting you about your order.
• To show customer messages to the store, and to send the store's replies back through the same messaging app.
• To confirm online payments directly with eSewa or Khalti before marking an order as paid.
• To keep NepalShop secure, prevent fraud and abuse, and fix problems.
• To provide support and to meet our legal obligations.

Who we share information with

• The store you order from or message. It sees your order details and your conversation with it.
• Meta Platforms (WhatsApp, Messenger and Instagram) and TikTok, when a store uses them to talk with you. Messages travel through those services and are covered by their own privacy policies.
• eSewa and Khalti, when you choose to pay with them. We send the amount and an order reference, and receive the payment result.
• Service providers who host our servers, database and image storage for us, under obligations to protect the data.
• Authorities, when we are required to by law or to protect people's rights and safety.

NepalShop's operator and some of these services, including Meta and TikTok, may store or process information outside Nepal. We share only what each service needs to do its job.

How long we keep information

• Store owner accounts and store content are kept while the account is active.
• Orders are kept so the store can manage deliveries, returns and its accounts, and for as long as the law requires transaction records to be kept.
• Conversations are kept while the store uses NepalShop, unless deletion is requested sooner.
• Sign-in sessions expire after 30 days.

You can ask us to delete your information at any time. See how to request data deletion.

How we protect information

We use encrypted connections (HTTPS), store passwords only as secure hashes, encrypt the access tokens and payment keys stores give us, and limit each store's data to that store's owner and the NepalShop team members who need it to run the service. No system can be completely secure, but we work to protect your information and will act promptly if something goes wrong.

Your rights and choices

You can ask to:

• see the personal information we hold about you;
• correct information that is wrong or out of date;
• delete your information, or stop receiving messages from a store;
• object to how we use your information.

Shoppers can also contact the store directly. To make a request to us, email hello2shishir.com.au. We may ask you to confirm your identity, and we respond within 30 days.

Children

NepalShop is not meant for children under 16, and store accounts are only for adults running a business. If you believe a child has given us personal information, contact us and we will delete it.

Changes to this policy

We may update this policy as NepalShop changes. We will post the new version here with a new “last updated” date, and tell store owners about significant changes.

Contact us

[Registered business name]
[Business address]
Email: hello2shishir.com.au