Who this covers, and who it does not
This policy is for OMS Pro — the order management software at this domain. Capturo builds other products, and each publishes its own policy. The company-wide summary is at capturo.in/privacy.
There are two kinds of people in this software, and they are treated differently throughout:
- Sellers — our customers. Businesses that sign up, pay us, and run their operations here.
- Buyers — the people who bought something from a seller. They have no account with us and never agreed to anything with us. Their details reach us only because a parcel cannot be addressed without them.
What we hold about a seller
- Account details: name, email, phone, business name, GSTIN.
- What they put in: products, prices, cost prices, stock, suppliers, purchase records.
- Operational records: orders, returns, shipments, settlements and the money movements behind their profit figures.
- Security records: sign-in times, the IP address a session was started from, and a log of privileged actions.
- Marketplace and courier credentials they connect, stored encrypted (AES-256-GCM) and never shown back to anyone, including us.
We do not sell any of it, and we do not use one seller’s data to benefit another. Every record is scoped to the organisation that owns it, and that scoping is enforced on every query rather than by convention.
What we hold about a buyer, and for how long
When a seller connects a marketplace, orders arrive carrying the buyer’s name, contact details and delivery address. We hold them for one purpose: so the parcel can be picked, packed, labelled and delivered.
Once an order is delivered, cancelled or returned, those details are removed automatically after 30 days. A scheduled job replaces the name, email, phone and street address on finished orders. What remains is the business record the seller is legally required to keep: the order number, what was sold, the money, the dates, and the city, state and postcode.
The postcode is kept deliberately. It describes an area of thousands of households rather than a person, and courier pricing, return-risk and delivery reporting are built on it.
Who else sees it
We share data with a service only where the service is doing the work:
- Marketplaces(Amazon, Flipkart, Meesho and others) — the seller connects these, and data flows both ways under that marketplace’s own terms.
- Couriers — the delivery address, because that is the parcel.
- Payment providers— for the seller’s subscription. We never see or store full card numbers.
- Hosting and email providers — infrastructure, in India and the EU.
- The AI assistant— a seller’s question and the figures needed to answer it are sent to a language-model provider. Buyer names and addresses are not part of what it is given, and conversations are stored per user and visible only to that user.
We do not sell data to anyone, and we do not use it to train any model.
How it is protected
- Encrypted in transit (TLS) and connected credentials encrypted at rest (AES-256-GCM).
- Passwords stored hashed with bcrypt, never in readable form.
- Role-based access, checked on every request rather than only hidden in the interface.
- Sign-in attempts rate limited, and password resets limited per hour.
- Privileged actions written to an audit log.
No system is beyond compromise. If one happens and it affects data we hold, we will say so — to the sellers affected and to the authorities where the law requires it — rather than waiting to be asked.
Asking us to remove data
A seller may ask for their account and its data to be deleted at any time by writing to info@capturo.in from the address on the account. We act within 30 days.
A buyer who wants their details removed should contact the seller they bought from, who can act on it in the software. If they cannot reach the seller, they may write to us and we will pass the request on.
Some records survive deletion because the law requires it — a tax invoice must be kept for the statutory period. Those are retained without the personal details attached to them.
Cookies
The app uses a small number of strictly necessary cookies to keep a seller signed in. There is no advertising tracking, and no third-party profiling cookie, on this site or in the app.
Contact
Questions about this policy, or a request under it: info@capturo.in.
Capturo Ventures LLP
SH-435, Kedar Business CenterBapa Sitaram Chowk, KatargamSurat — 395004, GujaratIndia