Privacy policy

What we collect

• Your account (shop owners): you sign in with your Me2Us4U account, so we receive its ID, your name, verified phone number and email from Me2Us4U, and keep your business name and city. We don't hold your password.
• Your shop: everything you publish on it — name, address and map pin, opening hours, photos, items, prices and stock, and the web address you choose.
• Your bank account for payouts: you enter it here and we pass it straight to Babuky, our buyer side, which verifies it and pays you. We do not keep the account number; we keep only whether it has been verified.
• Your own payment gateway or delivery account, if you connect one: its keys are stored encrypted and used only to take payments and book deliveries for your shop.
• Buyers who order from a shop page: name, phone number and, for deliveries, the address and PIN code, plus what was ordered and how it was paid. Reviews show the name the buyer enters.
• The Babuki Shop Android app: a notification token for your phone, so we can alert you to new orders.
• Messages and enquiries you send us, including software consultancy requests: your name, contact details and message.
• Technical data: the sign-in cookie described below, and basic server logs (IP address, browser, pages requested) kept for security.

Why we use it

We do not sell personal data, and we do not use it for advertising.

• To create and secure your account through Me2Us4U sign-in.
• To run your shop page, list your shop on babuky.com, take orders and payments, book deliveries and settle your sales to your bank.
• To let you, and only you, see and fulfil your buyers' orders.
• To bill your plan, meet tax and accounting law, prevent fraud and answer your questions and complaints.

Who receives it

Only what each needs to do its job:

• Buyers on babuky.com see what your shop publishes — your shop's public details and items. Listing there is part of the service.
• Babuky (babuky.com), run by the same company: your shop's public details, orders placed there, and your bank account for verification and payouts.
• Me2Us4U, run by the same company: signs you in, and is told which accounts still have a shop here, so an account isn't deleted while its shop is open.
• The shop a buyer orders from: that buyer's name, phone and delivery address, to fulfil the order.
• Our RBI-authorised payment aggregator: to take payments, plan subscriptions and refunds. Card, UPI and bank details are entered with them, not with us.
• Delivery partners: the pickup and delivery addresses and contact details needed for the delivery.
• MSG91: to send order alerts by SMS. Firebase (Google): to send order alerts to the Android app.
• OpenStreetMap: the address you search for and the map area you view, to find and show your shop's location.
• Amazon Web Services (India region): hosting and secure storage.
• Authorities, when the law requires it.

How long we keep it

• Your account and shop: while you use Babuki. When you delete your shop, its page, items and photos are removed; billing records are kept as tax law requires.
• Buyers' delivery addresses: removed 180 days after the order is closed. Order amounts and item details are kept for the shop's and our tax records.
• Server logs: kept only as long as needed for security.

Your rights

You can ask to see, correct or erase your personal data, withdraw your consent, or nominate someone to act for you, by emailing support@me2us4u.com. We may need to confirm it is you first. Some records, such as invoices and order amounts, we must keep by law even after you ask us to erase your data.

Cookies

• One sign-in cookie, babuki_session, set after you sign in with Me2Us4U, keeps you signed in for up to 30 days. It is HttpOnly and Secure, so scripts on the page cannot read it, and it is sent only over HTTPS.
• Our admin console uses its own sign-in cookie, for our staff only.
• A shop page remembers your cart in your browser's own storage, so it is still there when you come back. It never leaves your device until you place the order.
• We use no advertising or tracking cookies.

Security

Traffic is encrypted (HTTPS), sign-in goes through your Me2Us4U account, saved gateway and delivery keys are encrypted, and access to our systems is restricted and logged. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

Children

Babuki accounts are for people aged 18 and over. We do not knowingly collect data from children.

Changes to this policy

We update this page when what we collect or share changes, and tell shop owners about significant changes.