Who we are
Vikalp Omni Private Limited (incorporation in progress) operates Vikalp One, a commerce platform for businesses in India. In this policy, “we” means Vikalp Omni Private Limited (incorporation in progress). “You” means the person the data is about: someone who works for a business on Vikalp One, or a visitor to our website.
This policy covers our website (www.vikalpone.com), the business dashboard (one.vikalpomni.com) and the emails we send.
For the personal data in this policy, we decide why and how it is used. In the words of India’s Digital Personal Data Protection Act 2023, we are its Data Fiduciary.
If you visit our website
Our website sets no cookies. It runs no analytics or tracking scripts, and it loads nothing from other companies.
Amazon CloudFront, which serves our website and our dashboards, keeps a log of each visit: your internet address, the time, the page asked for, and your browser’s description of itself. We keep these logs for 400 days, for security and to fix problems. Cookies are never written into them.
If you email us, we use your message and your email address to answer you.
If you have an account
When you sign up and work in the business dashboard, we collect:
- Your name, email address and mobile number.
- Your password, stored only as a slow one-way hash: it can’t be turned back into your password, even by us.
- Your authenticator app’s secret, encrypted.
- Your backup codes, stored only as slow one-way hashes.
- The public half of each passkey you add. Nothing biometric reaches us: your face or fingerprint stays on your device.
- Sign-in attempts: the email address typed, the time, the internet address, and whether it worked.
- Your sessions and devices: the internet address, the browser and system (from your browser’s own description), when you signed in and when you last used it.
- A record of each change made through Vikalp One: who made it, what changed, when, and from which internet address.
- Which version of our Terms and this policy you accepted, when, and from which internet address.
- If you ask to get back into your account without your phone, what you tell us in that request.
About your business
Most of these details are about a company, not a person. Some can be personal data too, such as a sole proprietor’s PAN or an address that is also a home. This policy covers those as well.
When you set up a business, we collect:
- Your companies’ legal names, and their GSTINs (which contain the PAN) with their states.
- Your brands’ names, their store addresses on vikalpone.com and their invoice prefixes.
- Your locations’ names and street addresses.
- What your business sells.
Why we use it
We use personal data only for these purposes:
- To create your account and sign you in safely.
- To stop password guessing and other attacks, and to warn you when your account signs in on a new device.
- To set up and run your business on Vikalp One.
- To send you the emails described below.
- To keep a record of who changed what, for security and accountability.
- To phone the mobile number on your account if you ask to get back in without your phone. We send no messages to that number today.
- To meet our legal duties, such as keeping tax records and answering lawful orders.
- To find and fix problems.
Cookies on the dashboards
Our website sets no cookies, and there are no advertising or tracking cookies anywhere on Vikalp One.
Each dashboard sets two cookies, both needed for it to work:
- The session cookie keeps you signed in. With “Keep me signed in” ticked, a session lasts up to 30 days, and 14 days without use end it. Unticked, it ends when you close your browser, or after 12 hours at most.
- The device cookie is a random key, kept for 400 days. We keep only a fingerprint of it. It lets us email you when your account signs in on a new device. With “Keep me signed in” ticked, it also lets the sign-in screen remember the accounts used on that browser: name and email only, at most 5, each one removable, and each forgotten after 90 days unused.
Emails we send
We send emails only about your account and your business. We send no marketing emails today. If that ever changes, we will send them only with your consent, and each one will have a way to stop them.
The emails we send are:
- Codes to sign up, sign in, reset your password, or ask to get back in.
- Security notices: a sign-in on a new device, a password or mobile number changed, a passkey or authenticator app added or removed, a backup code used.
- Notices about your business, such as a pause with its reason, or the end of a pause.
- Sign-up links, and answers to requests you make.
Who can see your data
We store and process everything on Amazon Web Services (AWS). AWS hosts our servers, database and files, sends our emails (Amazon SES), serves our website and dashboards (Amazon CloudFront) and keeps our encryption keys (AWS Key Management Service). AWS handles the data to provide these services to us: it is our processor.
When you write to support@vikalpomni.com, your message and anything in it are kept by Google Workspace, which hosts that mailbox for us: it is our processor for those messages.
We don’t sell, rent or share personal data for advertising. We give it to a court or a government authority only when the law requires us to.
Inside Vikalp One, our team’s dashboard shows each business’s name, set-up progress and status. It can’t read a business’s street addresses, products, orders or customers. It shows the mobile number on an account only to our team’s owners and admins, only while that person is asking to get back in, and records each time it does.
Where your data is kept
We store everything in India, in AWS’s Mumbai region (ap-south-1).
Two things can pass outside India on the way. CloudFront answers each visit from the AWS location nearest the visitor, which may be in another country; the visit logs are still stored in Mumbai. And an email we send goes to your email provider, wherever it keeps its mail.
How we protect it
Private fields, such as mobile numbers and street address lines, are encrypted with keys kept in AWS Key Management Service. Your authenticator app’s secret is encrypted the same way. Passwords and backup codes are stored only as slow one-way hashes.
Your account’s email address is kept in a separate part of the database that only our sign-in service can reach, because signing in needs to look it up.
The database itself checks that each business’s records are kept apart from every other business’s.
Before a sensitive change, such as a new password, we ask you to confirm it’s you. Our servers’ logs leave out passwords, codes and private fields.
How long we keep it
We keep personal data only as long as we need it:
- Account and business records: while the account is open.
- After an account is closed: records the law requires us to keep, such as tax and accounting records, for as long as it requires (at least 8 years for those). Everything else is removed or made anonymous within 90 days.
- Sign-in and security records: 1 year.
- Visit logs from CloudFront: 400 days.
- The device cookie: 400 days in your browser.
- Test businesses made by our own test robots: removed after 7 days.
Your rights
To use any of the rights below, email support@vikalpomni.com from your account’s own email address. We may need to confirm it’s you before we act.
You can also change your name and mobile number yourself, on your account page at https://one.vikalpomni.com/.
These rights follow India’s Digital Personal Data Protection Act 2023. You have the right to:
- Get a summary of the personal data we hold about you, and of how we use it.
- Have it corrected, completed or updated.
- Have it erased when it is no longer needed, except what the law makes us keep.
- Withdraw your consent at any time. This may mean closing your account, because we can’t run an account without the data it needs.
- Nominate someone to act for you if you die or can’t act yourself.
- Have your grievances answered by our grievance officer.
- Complain to the Data Protection Board of India if we don’t resolve your grievance.
If you are a customer of a store
Once stores sell, each store’s customers’ personal data (names, phone numbers, email addresses, addresses and orders) belongs to that store’s business. The business decides why and how it is used: it is the Data Fiduciary for that data.
We process that data on the business’s behalf, only to run Vikalp One for it. We don’t use it for our own purposes, and we never sell it.
If you are a customer of a store on Vikalp One, read the store’s own privacy notice, and contact the store about your data. If you write to us instead, we pass your request to the store.
When stores take payments, card details will never touch our servers: payment networks handle them.
Children
Vikalp One is made for businesses. Its accounts are only for people aged 18 or over.
If you think someone under 18 has made an account, write to support@vikalpomni.com and we will look into it.
If there is a breach
If a breach of our security affects your personal data, we will tell you what happened, what it means for you and what we are doing about it.
We will also report it to the authorities that must be told.
Grievance officer
Our grievance officer is Akshay Jain. Write to support@vikalpomni.com about your personal data, this policy, or a store on Vikalp One.
We acknowledge a complaint within 24 hours and resolve it within 15 days.
The same officer handles complaints about what a store says or sells. Each store page will have a “Report this store” link that leads to them.
If we don’t resolve your grievance, you can complain to the Data Protection Board of India.
Changes to this policy
When we change this policy, we publish a new version with its date at the top.
For a change that matters, we email every business’s owners, and ask for acceptance again where needed.
The current version is always at https://www.vikalpone.com/privacy.