1. Introduction
Nepfa Group Private Limited("we," "us," or "our") operates the Nepfa Seller Hub web application and mobile application (iOS and Android), collectively referred to as the "Platform." This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Platform as a vendor/seller.
2. Information We Collect
2.1 Account & Identity Information
When you register or manage your seller account, we collect:
- Full name (account owner) and business/store name
- Email address and phone number
- Business registration details: PAN number, VAT number (where applicable)
- Business type and authorization model (brand owner, authorized distributor, official importer)
- Business address, warehouse address, and pickup locations
2.2 Financial Information
- Bank account details: account number, account holder name, bank name, branch name — required for weekly payment disbursements
- Sales revenue, commission amounts, payout records, and settlement history
2.3 KYC & Verification Documents
- PAN card image
- Citizenship document (front and back)
- Brand authorization letters (for authorized distributors/importers)
- These documents are stored encrypted on Cloudflare R2 and accessed only during verification
2.4 Product & Business Data
- Product listings: names, descriptions, images, pricing, SKUs, variants, and inventory levels
- Order fulfillment records: order IDs, statuses, customer delivery details (name, address, phone)
- Sales analytics: revenue, order counts, conversion metrics
2.5 Device & Technical Data
- Device type, operating system version, app version, screen resolution
- Push notification tokens (Firebase Cloud Messaging / Apple Push Notification)
- Authentication tokens stored locally on your device
2.6 Authentication Data
- Google account information (name, email, profile picture) if using Google Sign-In
- Apple account information (name, email) if using Apple Sign-In
- Session tokens and encrypted authentication credentials
2.7 Information We Do NOT Collect
- Location data (neither precise GPS nor IP-based geolocation)
- Contact list or address book
- Health, fitness, or biometric data
- Browsing history outside the Platform
- Advertising identifiers (IDFA) — we do not request App Tracking Transparency permission
- Crash diagnostics (no crash reporting SDK is integrated)
3. How We Use Your Information
- To create, verify, and manage your seller account
- To process customer orders and coordinate fulfillment and delivery
- To calculate and disburse your weekly payouts via bank transfer
- To display your store and products to customers on the Nepfa marketplace
- To provide seller analytics, sales reports, and business insights in your dashboard
- To send push notifications for new orders, payment confirmations, and platform updates
- To verify your identity, business authorization, and prevent fraudulent activity
- To facilitate returns/refunds and resolve order disputes
- To improve Platform functionality and user experience
- To comply with Nepal's tax, financial, and business regulations
4. Information Sharing
We may share your information with:
- Customers: Your store name, store logo, product listings, business details, and ratings visible publicly on the marketplace
- Payment processors (Fonepay/bank): Bank account details necessary to process your weekly payouts
- Delivery partners (NCM): Pickup address, package details, and order information for fulfillment
- Cloud service providers (Firebase, Cloudflare R2): Encrypted data storage, image hosting, and push notification delivery
- Legal authorities: When required by Nepalese law, court order, or to protect rights and safety
- Nepal Revenue Authority: Transaction data as required by tax regulations
We do not sell your personal or business information to third parties for advertising or marketing purposes.
5. Customer Data Visibility
As a seller, you receive customer information (name, delivery address, phone number) solely for order fulfillment purposes. You must not use customer data for any purpose other than fulfilling orders placed through Nepfa. You must not contact customers outside the Platform, share their data with third parties, or use it for independent marketing. Violation of these obligations may result in account termination.
6. Data Security
We implement industry-standard security measures including: encryption in transit (TLS/HTTPS for all communications), encrypted document storage on Cloudflare R2, secure token-based authentication with short-lived access tokens and refresh token rotation, role-based access controls, and regular security assessments. KYC documents are stored encrypted and accessible only to authorized verification personnel. However, no method of electronic transmission is 100% secure, and we cannot guarantee absolute security.
7. Data Retention
- Active accounts: All data retained while your seller account is active
- Transaction records: Retained for up to 7 years after account closure as required by Nepal's tax and financial regulations
- KYC documents: Retained for 5 years after account closure per regulatory requirements
- Product data: Removed within 30 days of account deletion request
- Push tokens: Cleared upon logout or account deletion
You may request deletion of non-essential data at any time by contacting privacy@nepfa.com.
8. Your Rights
- Access: Request a copy of the personal and business data we hold about you
- Correction: Update or correct inaccurate information via your seller dashboard or by contacting us
- Deletion: Request deletion of your account and associated data (subject to legal retention requirements)
- Portability: Request your data in a machine-readable format
- Objection: Opt out of non-essential communications and promotional notifications
- Restriction: Request that we limit processing of your data in certain circumstances
To exercise these rights, contact us at privacy@nepfa.com.
9. Push Notifications
We send push notifications for: new order alerts, order status changes, payment/payout confirmations, product approval updates, and important platform announcements. You can disable notifications at any time through your device settings or the app notification preferences. Disabling notifications does not affect your ability to use the Platform, but you may miss time-sensitive order alerts.
10. Camera & Photo Access
The mobile app requests camera and photo library access for: uploading product images, uploading KYC/verification documents, and updating your store logo. Photos are uploaded to our secure servers (Cloudflare R2) and are not accessed for any other purpose. You can deny camera/photo access and still use most app features (document upload would require access).
11. Third-Party Services
The Platform integrates with:
- Firebase Authentication (Google): Account creation and sign-in
- Firebase Cloud Messaging (Google): Push notification delivery
- Google Sign-In: Social authentication option
- Apple Sign-In: Social authentication option
- Cloudflare R2: Encrypted document and image storage
- Khalti: Payment processing and payout disbursement
- NCM (Nepal Can Move): Delivery logistics and pickup coordination
Each third-party service operates under its own privacy policy. We do not integrate any advertising networks or third-party analytics tracking services.
12. Data Transfers
Your data may be processed on servers located outside of Nepal (including Google Cloud infrastructure and Cloudflare's global network). We ensure that any such transfers are protected by appropriate safeguards including encryption and contractual obligations with our service providers.
13. Children's Privacy
The Platform is intended for use by registered businesses and individuals aged 18 or older. We do not knowingly collect data from children under 18. If you believe a minor has provided us with personal data, please contact us at privacy@nepfa.com.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via email, push notification, or in-app notification at least 15 days before the changes take effect. The "Last updated" date at the top indicates when the policy was last revised. Continued use of the Platform after the effective date constitutes acceptance of the updated policy.
15. Contact Us
For privacy-related inquiries: