Privacy Policy

What this covers

This describes what IndieVouch itself collects and does with data while you use it to create payment links, buttons or storefronts. It does not cover how a seller who uses IndieVouch handles data on their own — if you're a buyer with a privacy question about a specific purchase, that's between you and the seller you paid.

What we collect

From a seller's account: business or creator name, email address, a hashed password, and payment node details — your UPI ID and bank name, plus the phone number that receives your bank's SMS alerts if you use SMS forwarding.

Per order, from a buyer: name and email are required, phone number is optional — collected only to process and send a receipt for that specific order, on the seller's behalf.

To confirm a payment: the text of the bank credit SMS your device forwards (or that you paste into Web Verify). We read it once to match an amount and reference to a pending order; we don't keep a running log of your SMS inbox beyond what's needed for that match.

Files you choose to sell: any digital file a seller attaches to a link, button or product for delivery to buyers.

To keep the service working and abuse-free: IP addresses on requests (used for rate limiting), and a session cookie that keeps you signed in — nothing beyond what's needed for those two things.

To measure our own ads: IndieVouch's public pages (the home page, feature and pricing pages, sign-up and sign-in) use the Meta Pixel. It sets cookies and sends Meta the page you visited, your browser and device details, your IP address, and whether you created an account. It is never loaded on a seller's dashboard or on a buyer's checkout page.

What it's used for

Strictly to run the service: matching payments to orders, sending buyer receipts by email or SMS on a seller's behalf, showing sellers their own orders on the dashboard, and protecting the platform from abuse. We don't use buyer data or the contents of anyone's account for advertising, and we don't sell data to anyone. The one advertising use is the Meta Pixel described above: it tells us which of our own ads lead to visits and sign-ups, so we can show IndieVouch to people likely to find it useful.

What we never have

Your UPI PIN, bank login, or card details — the architecture never asks for or handles any of these. A payment goes straight from a buyer's UPI app to a seller's own bank account; the only thing IndieVouch ever sees afterwards is the confirmation text a bank already sends. See Trust for the full picture.

Who else sees it

Data is stored with Supabase (database, file storage and account authentication) and the app runs on Railway. If a seller or the platform configures an SMTP provider for sending email, message contents pass through that provider to deliver it. None of these process data for their own purposes — they host it on our behalf. Meta receives the Meta Pixel data described above and handles it under its own privacy policy.

How long we keep it

For as long as an account stays active, plus whatever a seller's own order history requires. Closing an account and asking us to delete its data removes it, aside from records we're required to keep for legal or accounting reasons.

Your choices

To access, correct, or delete data we hold about you — whether you're a seller or a buyer who paid through IndieVouch — write to support@indievouch.in.

To stop the Meta Pixel, use your browser's tracking protection or a content blocker, or manage how Meta uses this activity in your Meta account's ad preferences. IndieVouch works the same either way.

Not for children

IndieVouch is meant for people old enough to hold their own UPI-linked bank account, and isn't directed at children.

Changes

If this policy changes in a way that matters, we'll update the date at the top of this page.