Applies to everyone using diecastcollective.in — buyers and sellers alike.
Diecast Collective is a marketplace where independent sellers sell collectible diecast
model cars to buyers across India. This policy explains what personal data we collect
from you, how we use it, who we share it with, and the rights you have over your data
under the Digital Personal Data Protection Act, 2023.
1. Data we collect
We collect only what we need to run the marketplace, fulfil orders, and keep the platform safe.
From buyers
Contact details: name, mobile number, email address.
Shipping address: line 1, line 2, city, state, PIN code — provided when you place a bag with a seller.
Order and payment information: which bags you've placed, deposits paid, payment screenshots you upload as proof of payment, refunds requested.
Communication: messages you send us via support or IP complaint forms, and our responses.
Technical data: IP address, browser type, device information, and pages visited. Used for security, fraud prevention, and to make the site work.
From sellers
Business and contact details: your name, business name, mobile number, email address, store slug, store description.
Payout information: UPI IDs and payee names you configure for accepting deposits and payments.
Product uploads: photos, descriptions, prices, and inventory of items you list.
Customer support: responding to your questions and resolving disputes.
Security and fraud prevention: detecting suspicious activity, blocking abusive accounts.
Service improvement: understanding how the site is used so we can make it better.
Legal compliance: meeting our obligations under Indian law, including tax and consumer-protection laws.
3. Who we share your data with
Buyer data shared with sellers
When you (as a buyer) place a bag with a seller, we share only the data that seller
needs to fulfil your order — your name, mobile number, email, and the
shipping address you provided for that bag. This sharing happens automatically at the
point you confirm your bag; you don't need to give separate consent each time.
Sellers are contractually required (via our seller terms) to use your data only
for fulfilling your specific order: contacting you about the order, shipping
the items, and handling any post-sale issues. They cannot use your data for marketing,
add you to mailing lists, or share it with anyone else. We treat violations as grounds
for suspension.
Your data is not shared with sellers you haven't placed an order with,
nor across sellers in any aggregated form.
Seller contact data shown to relevant buyers
If you're a seller, your mobile number and email address are shown to buyers
who have followed your store or placed an order with you, so they can reach out
about their orders. This information is not shown to random visitors or buyers who have
no ongoing relationship with your store.
Your business name, store description, and product listings are public by design —
that's how buyers find you.
Service providers we use
We rely on a small number of trusted service providers to run the platform. Each of them
processes some of your data on our behalf under their own privacy commitments.
We share only what's necessary for them to do their job.
Supabase — database and authentication. Stores account records, orders, and platform data.
Vercel — hosts the website you're reading right now.
Railway — hosts our backend servers that process orders and payments.
MSG91 — delivers SMS-based one-time passwords (OTPs) for phone-number login and verification. We share your mobile number with MSG91 solely to send you the OTP.
When required by law
We may disclose your data if we're legally required to — for example, in response
to a valid court order, subpoena, or lawful government request. We'll only share what's
strictly required.
What we never do
We never sell your personal data. We don't share it with advertising networks
or data brokers. We don't display ads on Diecast Collective, and we don't run tracking
pixels for advertisers.
4. Data retention
We keep your data for as long as your account is active. When you close your account,
or if we close it for policy violations:
Personal identifiers (contact details, addresses) are removed from active systems within 30 days.
Transaction and tax records are retained for the period required by Indian tax law (currently up to 8 years under the Income Tax Act), but personal identifiers within them are anonymized where possible.
Communication records (support tickets, IP complaints) are retained for up to 3 years for compliance and record-keeping.
If you'd like your data deleted sooner, contact us and we'll do our best to accommodate, subject to legal retention requirements.
5. Your rights under DPDP
Under the Digital Personal Data Protection Act, 2023, you have the following rights over your data:
Right to access: get a copy of the personal data we hold about you.
Right to correction: ask us to fix inaccurate or incomplete information.
Right to erasure: ask us to delete your data, subject to legal retention requirements described above.
Right to withdraw consent: if we're processing your data based on your consent, you can withdraw it at any time. This doesn't affect processing that already happened.
Right to nominate: nominate another person to exercise these rights on your behalf in case of your death or incapacity.
Right to grievance redressal: raise a complaint with our Grievance Officer (below) if you're unhappy with how we've handled your data.
6. How to exercise these rights
Email support@diecastcollective.in from the
address linked to your account, and describe what you'd like us to do. We'll respond within
15 days. For access and correction requests, we may ask you to verify your
identity before sharing or making changes to your data — this is to protect you.
7. Data security
We take reasonable steps to protect your data. In practice, this means:
All traffic between your device and our servers is encrypted with TLS (HTTPS).
Data at rest in our database is encrypted by our infrastructure provider (Supabase).
Access to production systems is limited to authorised personnel, with logged access.
Passwords (where applicable) are hashed — we never see or store your raw password.
We use rate limiting and other controls to defend against automated attacks.
No online system is 100% secure. If we ever discover a breach that affects your personal
data, we'll notify you and the Data Protection Board of India as required by law.
8. Cookies & local storage
We use a small number of cookies and local-storage entries to make the site work —
keeping you signed in, remembering your bag, and similar. We don't use
third-party advertising cookies or tracking pixels. We don't currently
use analytics that identify individual users.
9. Users under 18
Under the DPDP Act, users under 18 are treated as children and require verifiable parental
or guardian consent before we can process their data. We don't knowingly collect data from
users under 18. If you're a parent or guardian and believe your child has registered with
us, please email support@diecastcollective.in
and we'll remove their account and data.
10. Changes to this policy
We'll update this policy as our practices evolve or as the law changes. When we make
material changes, we'll notify you at the email address linked to your account and update
the version number and effective date at the top of this page. Continued use of the
platform after a change means you accept the updated policy.
11. Grievance Officer
Under the Information Technology Rules 2021 and the DPDP Act 2023, we've appointed a
Grievance Officer as the point of contact for all data-related complaints.
Acknowledgment within 24 hours · resolution within 15 days
Working days
Monday to Friday, excluding public holidays
Please put "Grievance" in the subject line so we can prioritise your message. If your
grievance isn't resolved to your satisfaction, you may escalate to the Data Protection
Board of India once it becomes operational.