Privacy Policy

This policy explains what personal data RasayanXchange (“we”, “us”) collects through rasayanxchange.com and its subdomains (the “Platform”), why we collect it, who we share it with, and the choices and rights you have. It applies to visitors, registered Buyers and Suppliers, and business contacts we reach out to.

For the purposes of India’s Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described here. This policy forms part of our Terms & Conditions.

Account details. Your name, business email address, mobile number, password and the type of account (Buyer, Supplier or both). Passwords are stored only as a one-way hash; we cannot read them.

Company details. Company name, GSTIN, PAN, registered and other business addresses, logo, photos and the profile information you add, and your membership status.

Business activity. Product listings, prices and price lists, requirements and RFQs, quotations, orders (including delivery addresses), shipment and quality records, and the messages and timeline entries exchanged on an order.

Sign-in and security records. The IP address and browser or device used when you sign in or accept our Terms, sign-in codes and recognised devices, and a log of important account actions. We keep these to protect accounts and to keep an audit trail.

Feedback. If you use the Feedback button: your message, rating, the page you were on, your browser type and, if you give it, your email address.

How you found us. When you first arrive, your browser remembers the source of the visit (for example a search engine, LinkedIn or a campaign link) for up to 180 days. It is sent to us only if you register or post a requirement, so we can see which channels bring members.

Error reports. If a page fails, a technical report is sent to our error-monitoring service. It may include a short recording of the screen around the error, with all text masked.

Business contacts from public sources. We collect business contact details that companies have themselves made public, such as in trade advertisements and directories: company name, business email and phone, website, city and products. We use them only to invite the company to list on the Platform. Every invitation includes a link to stop further contact, which we honour.

International buyers. If your company is outside India and registers by invitation, we also collect its company registration number (or VAT or trade-licence number), its Legal Entity Identifier if you give one, a copy of its registration certificate or licence, and an international mobile number. The registration document is stored privately and seen only by our team. We check the company number with official registers where they exist (the EU VIES service, UK Companies House and the GLEIF LEI register, which receive only the company identifier), and we screen the company name, trade name and contact person’s name against published sanctions lists (UN, US, UK and EU), which we download; nothing about you is sent to the list publishers. The results are kept with your company’s record for our review.

We do not knowingly collect sensitive data such as health, financial account or biometric data, and we never hold or process payments between members.

• To create and run your account, and verify your email address, mobile number and business details.
• To show your company, listings, requirements and quotations to other members, and to connect Buyers with suitable Suppliers.
• To send emails you need: sign-in codes, order and RFQ updates, price-confirmation reminders and account notices.
• To keep the Platform safe: preventing fraud and misuse, protecting accounts and investigating problems.
• To improve the Platform, using feedback, error reports and counts of where members come from.
• To meet legal obligations, such as tax records and lawful requests from authorities.

We rely on your consent, given when you register or submit information, and on legitimate uses permitted by law. You can withdraw consent at any time (see section 9). Withdrawing it may mean we can no longer provide your account.

Supplier company profiles, product listings, published requirements and similar marketplace content are meant to be seen and may be visible to the public and to search engines. Your personal mobile number and email are not shown publicly; contact details are shared with a counterparty only as part of an enquiry or order you take part in. Order details are visible only to the Buyer and Supplier on that order and to our administrators.

Our team may view your account in read-only mode to help you or to improve the Platform. We cannot change anything or act for you in this mode, and every such view is recorded.

We do not sell personal data. We share it only with:

• Service providers that run the Platform for us, under their own privacy and security terms: Render (servers and database), Vercel (website hosting), Cloudinary (images), Resend (sending email), ImprovMX (forwarding mail sent to our addresses), Sentry (error reports), Google Maps (address search, on pages where you enter an address), and Anthropic and Google (AI features, see section 6).
• Official registers, for international buyers only: the company identifier (not personal data) is sent to the EU VIES service, UK Companies House or GLEIF to confirm it exists.
• Other members, as described in section 4.
• Authorities, when the law requires it or to protect the rights and safety of our members, the public or us.
• A successor, if the business is transferred, under the same protections as this policy.

Some features use AI models from Anthropic (Claude) and Google (Gemini): for example the procurement assistant, reading a price list you upload, and drafting descriptions. When you use them, the text or file you provide is sent to that provider to produce the answer. Please do not include personal data that the task does not need. AI output can be wrong; check it before relying on it.

We do not use advertising cookies or third-party analytics trackers. Your browser stores your sign-in, so you stay signed in, and the visit source described in section 2. Google Maps and Sentry load their own scripts, which may set their own cookies or identifiers, as explained in their privacy policies. Clearing your browser storage signs you out and removes these.

Our service providers store and process data on servers outside India, including in Singapore and the United States. We use providers that protect data in transit and at rest, and we transfer data only where Indian law allows it.

If you are an international buyer, your data is transferred to and processed in India and in the countries above. Where the law of your country gives you rights over your personal data, you can exercise them by writing to the address in section 12, and we will handle the request as that law and Indian law require.

We keep account, company and business records while your account is active, and afterwards for as long as we need them to resolve disputes, prevent fraud and meet legal, tax and audit obligations. Security logs and error reports are kept for shorter periods. Business contacts who ask us to stop contacting them are kept only as a do-not-contact record, so we do not contact them again.

You can ask us to:

• give you a summary of the personal data we hold about you and who we have shared it with;
• correct, complete or update it (much of it you can edit yourself in your profile);
• delete it and close your account, except where we must keep records by law;
• stop using it for a purpose you consented to;
• record a person who may exercise these rights for you in the event of death or incapacity.

You can delete your account yourself at any time: sign in and go to Profile → Security → Delete my account. Accounts with an order still in progress can be deleted once that order is completed or cancelled.

For anything else, email info@rasayanxchange.com from the address on your account, saying what you would like us to do. We may ask you to confirm your identity. We respond as soon as we can and within the time limits set by law.

We use encrypted connections, hashed passwords, emailed sign-in codes for administrator accounts, access limited to people who need it, and logs of administrative actions. No system is completely secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.

The Platform is for businesses and is not intended for anyone under 18. We do not knowingly collect data from children; if we learn we have, we delete it.

For any question or complaint about how we handle personal data, contact our grievance officer, Aparna Tripathi, at info@rasayanxchange.com, Vadodara, Gujarat, India. If you are not satisfied with our response, you may approach the Data Protection Board of India.

We may update this policy as the Platform changes. The version and effective date at the top show the current version. For significant changes we will also tell registered members by email or on the Platform.