Legal

Privacy Policy

Last updated August 19, 2026

This policy explains how ZABRLABS LLP collects, uses, and protects data from merchants and the customers who shop at Zabr-powered stores. Each Merchant store also maintains its own store-level privacy policy — see section 2 below.

1. Who We Are

Zabr is a multi-tenant e-commerce platform owned and operated by ZABRLABS LLP ("we", "us", or "our"), a Limited Liability Partnership registered in India. This Privacy Policy explains how we collect and use data from merchants who use the platform and from customers who shop at Zabr-powered stores.

ZABRLABS LLP is the data fiduciary for merchant account data. For end-customer data collected through merchant stores, ZABRLABS LLP acts as a data processor on the merchant's behalf.

2. Each Merchant Store Has Its Own Privacy Policy

This Privacy Policy covers ZABRLABS LLP and the Zabr platform itself. In addition, every Merchant store on Zabr publishes its own store-level privacy policy, available at yourstore.zabr.in/privacy, which explains how that specific Merchant collects and uses customer data for their store.

When you shop at a Zabr-powered store, both policies apply: this platform-level policy governs how ZABRLABS LLP processes data as the underlying technology provider, and the Merchant's own store-level policy governs how that Merchant, as the data fiduciary for their own customers, collects and uses your information. If a Merchant has not published a store-level policy, this platform Privacy Policy applies by default.

3. Data We Collect from Merchants

When you create a Zabr merchant account, we collect:

Profile data — name, email address, and phone number, for account creation and communications
Business details — store name, registered address, and GST number where provided
Compliance and KYC data — settlement bank or UPI details, PAN, and other identity documents required by our payment partners for payout verification
Payment information — subscription billing details processed via our payment provider; we do not store card numbers
Store configuration — products, categories, settings, and policies you create
Usage data — how you interact with the dashboard and which features you use

KYC documents are collected only when required to enable payouts. Settlement details are collected at onboarding; identity verification documents are requested before your first payout is released.

4. Data We Collect from Customers

When a customer places an order at a Zabr-powered store, we collect on behalf of the merchant:

Name, email address, and phone number
Shipping and billing address
Order details (products, quantities, prices)
Payment method and transaction reference — card and bank credentials are handled entirely by our PCI-DSS compliant payment gateway and are never stored by ZABRLABS LLP

This data is collected to process orders and belongs to the merchant and the customer. ZABRLABS LLP processes it as a data processor on the merchant's behalf.

5. How We Use Your Data

We use merchant data to:

Operate and provide the Zabr platform
Process transactions and route split settlements to your account
Complete KYC verification with our payment partners as required by the Reserve Bank of India
Process subscription and platform fee payments
Send account-related emails such as order notifications and system alerts
Improve the platform based on aggregate usage patterns
Comply with legal, tax, and regulatory obligations

7. Data Retention

Merchant account data is retained for the duration of the subscription and for 30 days after termination, after which it is deleted.

Order, transaction, and settlement records are retained for up to 8 years to comply with Indian tax, financial, and IT recordkeeping requirements. KYC records are retained for the period mandated by our payment partners and applicable RBI guidelines.

You may request deletion of your personal data at any time, subject to these legal retention obligations.

8. Security

ZABRLABS LLP uses industry-standard security practices including:

SSL/TLS encryption for all data in transit
Encrypted storage for sensitive data at rest
Access controls limiting who can access your data
Signed and verified webhook communication with payment partners
Regular security reviews

No system is completely secure. In the event of a data breach affecting your data, we will notify you and the relevant authorities as required by applicable law, including the Digital Personal Data Protection Act, 2023.

9. Cookies

Zabr uses essential cookies to operate the platform, including session management and authentication. We do not use tracking or advertising cookies.

Analytics on the Zabr marketing website (zabr.in) may use anonymised cookies to understand traffic patterns. These do not track individual users across sites.

10. Your Rights

Under the Digital Personal Data Protection Act, 2023 and other applicable law, you have the right to:

Access the personal data we hold about you
Correct inaccurate or incomplete data
Request deletion of your data, subject to retention requirements
Export your data in a portable format
Withdraw consent where processing is based on consent
Nominate another individual to exercise these rights on your behalf

To exercise any of these rights, contact us at privacy@zabr.in.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email. The date at the top of this page reflects the most recent update.

12. Contact

For privacy-related queries, contact us at privacy@zabr.in or write to ZABRLABS LLP at our registered address.