Privacy Policy
Effective 19 October 2026 · Last updated 20 October 2026
This policy explains what personal data DataPix collects, why, who we share it with, how long we keep it, and the rights you have under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and its Rules.
1. Who we are
DataPix is run by Datapix Intelligence Services ("DataPix", "we", "us"). We provide a retail-intelligence dashboard to consumer brands that sell on India's quick-commerce marketplaces (Zepto, Swiggy Instamart and Blinkit).
For the personal data described in this policy we decide why and how it is used, so we are the Data Fiduciary under the DPDP Act.
2. What this policy covers
It covers personal data of:
- people who visit datapix.pro or ask us for a demo;
- people who use the DataPix dashboard for a brand that is our customer; and
- people who contact us for support.
The marketplace reports we collect for a brand hold sales, advertising, stock, pricing and purchase-order figures. They do not identify the shoppers who bought the products, and we do not ask the marketplaces for shopper details.
3. What we collect and why
| What | Where it comes from | Why we use it |
|---|---|---|
| Demo requests — name, work email, mobile number, company or brand | You, through the demo form | To arrange the demo you asked for and follow up on it |
| Your DataPix account — username, display name, email, password (stored only as a one-way hash), your organisation's plan and the brands you can see | Your organisation, when it sets up your access | To sign you in, show you your brand's data and run the account |
| Marketplace access — the sign-in email or phone number and password for your brand's Zepto, Swiggy Instamart or Blinkit seller and ads portals, and access to the mailbox that receives their one-time passwords (OTPs) | Your organisation, during onboarding | To sign in to those portals on your brand's behalf and download its reports. With your instruction we also make changes you approve, such as campaign edits |
| Support requests — what you write, files you attach, and any email addresses you ask us to copy | You | To answer and fix what you raised |
| Sign-in records — IP address, browser type and the time you signed in | Your browser, when you sign in | To keep accounts secure, detect misuse and keep the records the law requires |
| Questions to our AI features — what you ask, and a record that the request ran | You | To answer your question about your brand's data |
| Website visits, only if you allow analytics cookies — the pages you view on our public website, the site that sent you, your device and browser type, and your approximate location (city or country) | Your browser, through Google Analytics | To count visits and see which pages people use, so we can improve the website. Never collected inside the dashboard |
We only collect what we need for these purposes. Please do not send us sensitive personal data (such as health or financial details) in support requests or AI questions.
4. Consent and lawful use
We process personal data only on one of these grounds under the DPDP Act:
- Data you give us for a purpose (section 7(a)). When you send a demo request or a support request, we use what you send only for that request.
- Your consent (section 6). Where we ask for consent, we tell you what it is for first, and you can withdraw it at any time by writing to us (see section 12). Withdrawing is as easy as giving it. It does not undo processing that already happened, and we may no longer be able to provide the part of the service that needs that data.
- The law (section 7). For example, to keep tax and accounting records or answer a lawful request from a government authority.
For dashboard users, your organisation agrees with us how its people's data is used for the service it has bought.
We do not sell personal data, and we do not use it for advertising.
7. How long we keep it
- Demo requests: until the enquiry is closed, unless you become a customer. You can ask us to delete them at any time.
- Account and marketplace access: while your organisation's subscription is active. When it ends, we delete it on request, except what the law requires us to keep.
- Support requests: while your organisation is a customer, so we can refer back to past issues.
- Sign-in records: at least one year, as the DPDP Rules require for security logs.
- Website visits (Google Analytics): up to 14 months, then Google deletes them.
When we no longer need personal data for its purpose and the law does not require us to keep it, we delete it.
8. How we protect it
- All traffic to our site and dashboard is encrypted in transit (HTTPS/TLS).
- Our database is encrypted at rest on Google Cloud.
- DataPix passwords are stored only as one-way hashes (bcrypt), never in readable form.
- Each customer's data is kept separate, and every request is checked against the account that made it.
- Only staff who need access to run the service have it.
- We keep sign-in and access logs so misuse can be detected and investigated.
9. If something goes wrong
If a personal data breach affects you, we will tell you without delay — what happened, what it could mean for you, what we are doing about it and what you can do — and we will report it to the Data Protection Board of India, as the DPDP Act and Rules require.
10. Where your data is processed
Our database and servers are in India (Google Cloud, Mumbai). Some service providers in section 5 — such as Vercel, Anthropic, OpenAI and Google — may process data outside India. We only use countries the Government of India has not restricted under section 16 of the DPDP Act.
11. Your rights
Under the DPDP Act you can ask us to:
- Tell you what personal data of yours we process, how, and who we have shared it with;
- Correct, complete or update it;
- Erase it, unless the law requires us to keep it;
- Withdraw consent you have given;
- Have a grievance resolved (see section 12); and
- Nominate someone to use these rights for you if you die or cannot act yourself.
To use a right, email us from the address we have for you (see section 12). We may ask you to confirm who you are, and we aim to respond within 30 days. If the data belongs to your organisation's DataPix account, we may involve the account's administrator.
You can also ask for this policy in Hindi or another language listed in the Eighth Schedule to the Constitution of India.
12. Grievances and contact
For any question, request or complaint about your personal data, write to our Grievance Officer at support@datapix.pro with "Privacy" in the subject line. We aim to resolve grievances within 30 days.
If you are not satisfied with our response, you may complain to the Data Protection Board of India under the DPDP Act.
13. Children
DataPix is a service for businesses and is not meant for anyone under 18. We do not knowingly collect personal data of children. If you think we have, write to us and we will delete it.
14. Changes to this policy
When we change this policy we update the date at the top. If a change affects how we use data you have already given us, we will tell you on this site or by email before it takes effect.