Privacy policy

Grailforus is operated by [Company legal name] Private Limited (CIN [CIN], GSTIN [GSTIN]), registered office [Registered office address, City, State, PIN]. In these documents, “Grailforus”, “we” and “us” mean that company.

We are the data fiduciary for the personal data described here, under the Digital Personal Data Protection Act, 2023 (“DPDP Act”). This policy explains what we collect, why, who we share it with, how long we keep it and the rights you have. It applies to grailforus.com and the emails and messages we send.

We collect only what we need to run a safe marketplace:

We collect this from you, from your use of the site, from our payment partner (payment and verification results) and our shipping partner (delivery status and proof of delivery).

We process personal data with your consent, which you give when you create an account, verify your mobile, list a watch or buy one — and for the legitimate uses the DPDP Act allows, including complying with the law (for example income-tax, GST and accounting records) and responding to legal requests.

You can withdraw consent at any time (section 8). This doesn’t affect processing already done, and we may need to close your account or cancel open listings if the data is needed to provide the service. We keep what the law requires us to keep.

• Other users, minimally. Buyers see a seller’s public name (“First L.” or a dealer’s trading name), city and listings. Sellers see a buyer only as “a buyer in <city>”. Email addresses and phone numbers are never shown to other users. [Dealer business details may need to be displayed under the E-Commerce Rules — pending counsel.]
• Service providers who process data for us under contract and only on our instructions (below).
• Authorities — tax authorities (TDS and TCS returns), law enforcement or courts — when the law requires it or to prevent fraud or crime.
• A buyer of our business, if Grailforus is sold or merged, under this policy.

We don’t sell personal data and don’t share it for advertising.

Our database and photo storage — including accounts, orders, encrypted seller verification data and authentication photos — are hosted in India (Mumbai). Public listing photos are copied to delivery servers worldwide so pages load quickly. A few providers above process limited data outside India: email delivery, US text messages and error reports. The DPDP Act permits this except to countries the Government restricts; we check that list and require equivalent protection from those providers.

• Account and profile: while your account is open, and deleted or anonymised within [90 days] of closure — except as below.
• Transactions, invoices, tax deductions and seller KYC: 8 years after the end of the financial year of the sale, as required by the Companies Act, 2013, the Income-tax Act and GST law.
• Authentication photos, custody records and messages linked to a sale: for the life of the transaction and any dispute, then [3 years] to defend claims and prevent fraud.
• Security logs: rate-limit counters for 24 hours; server and access logs for 180 days, as required by CERT-In’s cyber-security directions.
• Unsold listing drafts you delete, and photos you replace, are deleted straight away.

• Encryption in transit (HTTPS everywhere) and encryption of sensitive fields such as PAN at rest.
• Authentication photos kept in private storage and shown only to the parties to that sale and our staff, through links that expire within a minute.
• Staff access limited by role, with two-factor authentication required and every administrative action logged.
• Card and UPI details are entered only in our payment partner’s secure checkout — we never see them.
• If a personal data breach occurs, we will inform you and the Data Protection Board of India as the DPDP Act requires.

Under the DPDP Act you can:

• get a summary of the personal data we hold about you and the processing, and the identities of those we’ve shared it with;
• have inaccurate or incomplete data corrected or updated (most of it you can edit in your account);
• have your data erased when it’s no longer needed, unless the law requires us to keep it;
• withdraw consent;
• nominate someone to exercise your rights if you die or become incapacitated;
• have a complaint resolved by us, and if you’re not satisfied, complain to the Data Protection Board of India.

Write to gfsjana@gmail.com from the email on your account. We’ll confirm who you are and respond within [30 days].

Grailforus is only for people aged 18 or over. We don’t knowingly collect data from children. If you believe a child has created an account, tell us and we’ll delete it.

We use only cookies that are needed for the site to work: a secure sign-in session cookie, and short-lived cookies for two-factor sign-in. We don’t use advertising or cross-site tracking cookies. Your browser may store small preferences (such as a dismissed notice) on your device only.

We’ll post changes here with a new date and email account holders about significant ones before they take effect.

Privacy questions and requests: gfsjana@gmail.com. Complaints: our Grievance Officer, [Grievance Officer name].