Privacy Policy
Chiblu India (OPC) Private Limited · last updated 17 August 2026
This Policy explains how Chiblu handles personal data. Please read section 1 in particular: Chiblu has two different roles depending on whose information it is, and which one applies changes who is responsible for it.
1. About this Privacy Policy
Chiblu India (OPC) Private Limited ("Chiblu", "we", "us") provides software that lets a business create and operate its own online store (a "Store"). This Privacy Policy explains how we handle personal data in connection with that service (the "Service").
Chiblu has two different roles, and which one applies depends on whose information it is.
Your Chiblu account and your use of chiblu.com. When you create a Chiblu account, subscribe, contact support, or use our website and dashboard, we decide why and how that information is used.
Information customers give to a Store. A Store is operated by its owner (the "Store Owner"), who operates the business and is responsible for its relationship with its customers. When a customer provides information to a Store — to place an order, for example — the Store Owner decides why that information is collected and how their business uses it. Chiblu handles it to operate the Store on the Store Owner's behalf.
Chiblu does not sell products or services through a Store. Purchases are made from the Store Owner. Chiblu is not the merchant of record, does not receive or hold sale proceeds, and takes no commission on Store sales. Our only charge is a subscription paid by the Store Owner.
If you are a Store customer and want to know how a particular business uses your information, please read that Store's own privacy notice or contact the Store Owner.
2. Information relating to Store Owners
We may collect and process:
- Account information — name, email address, phone number, and information used to secure the account.
- Store information — store name, description, profile and brand details, and the product and content information you publish.
- Business information — legal or business name, business address, and tax registration details where you provide them for invoicing.
- Subscription and billing information — plan, subscription status, billing history and invoices we issue.
- Custom domain information — the domain name, its connection status, and the technical details needed to connect and verify it. Chiblu is not a domain registrar; you register and hold your domain with your own registrar.
- Payment connection information — described in section 4.
- Support communications — messages you exchange with us and records of those exchanges.
- Technical and usage information — device and browser information, and how the dashboard is used, to keep the Service secure and to operate and improve it.
3. Information relating to Store customers and visitors
A person visiting or buying from a Store does not need a Chiblu account, and we do not create one for them.
Depending on what a Store offers and what a customer chooses to provide, we may process:
- name, phone number and email address;
- a delivery or contact address;
- order details, including what was ordered and its status;
- information provided in connection with an order;
- technical information such as device and browser information;
- information about interaction with the Store, as described in section 6.
Not every visitor provides every field, and many provide none — browsing a Store requires no personal information.
Order notifications. When a customer places an order through a Store, we use the phone number and email address given at checkout to send messages about that order — for example that it has been confirmed, that the Store Owner has accepted it, that it has been dispatched or delivered, or that a refund has been issued. These messages are sent using Chiblu's own SMS and email providers, as part of operating the Store on the Store Owner's behalf.
These messages relate only to the customer's order. We do not send marketing, promotional or newsletter messages to Store customers, and we do not use Store customer information for our own marketing.
We do not receive or store card numbers, CVV or other payment credentials. Payment is completed with the payment provider, as described in section 4.
4. Payments
Store payments — the Store Owner's own provider
A Store Owner may connect their own payment provider account to accept payments from their customers. Razorpay is currently supported.
The connected account remains the Store Owner's account, in their own name, governed by their own agreement with the provider. Chiblu receives authorisation to perform a limited set of payment operations on the Store Owner's instruction:
- creating payment orders when a customer checks out;
- reading the status of those payments; and
- initiating a refund when the Store Owner requests one.
We do not use that authorisation for any other payment operation, and it does not allow us to withdraw, transfer or hold funds.
Sale proceeds are received into the Store Owner's own provider account and settle to them under their agreement with the provider. They do not pass through Chiblu.
We store the credentials that enable those operations in encrypted form for as long as the connection is active, and renew them while it remains active.
Disconnecting. A Store Owner may disconnect a payment provider at any time. Disconnecting removes the credentials Chiblu holds. It does not, by itself, revoke the authorisation on the provider's side — to revoke it there, remove the Chiblu application from your provider account. The same applies when a Chiblu account ends.
Chiblu's own subscription billing — a separate relationship
Chiblu charges Store Owners a subscription for the Service. That is billed through Chiblu's own payment arrangements, is entirely separate from a Store's customer payments, and involves different information — plan, subscription status, invoices, and the business details needed to issue them.
These two payment relationships are distinct: one is a Store Owner being paid by their customers; the other is Chiblu being paid by the Store Owner.
5. Why we process personal data
- To provide, operate, maintain and support the Service, including hosting Stores.
- To create and administer accounts and authenticate users.
- To operate a Store on the Store Owner's behalf, including processing orders placed through it.
- To enable a connected payment provider to work, as described in section 4.
- To bill subscriptions and issue invoices.
- To send messages about an order placed through a Store — confirmation, acceptance, dispatch, delivery and refund notices — and service messages about a Chiblu account.
- To provide support and respond to enquiries.
- To keep the Service secure and to detect, investigate and prevent fraud, abuse and security incidents.
- To understand how the Service is used so we can improve it.
- To comply with applicable law and to establish, exercise or defend legal claims.
8. Retention
We keep personal data for as long as reasonably necessary for the purposes described in this Policy — to provide the Service, comply with legal obligations, keep the Service secure, resolve disputes, enforce our agreements, and establish or defend legal claims.
How long we keep information depends on what it is. Account information, Store and order information, financial and tax records, security and audit logs, analytics, and backups each serve different purposes and are kept for different periods. Some records must be kept for periods set by law even after an account is closed, and backups are kept for a limited period and overwritten in the ordinary course rather than edited.
Closing an account does not delete everything immediately. See section 10.
9. Your rights
Where the law gives you rights over your personal data, these may include access to a summary of what we hold, correction, erasure, grievance redressal, nominating someone to act for you, and withdrawing consent where processing relies on it. Withdrawing consent does not affect processing carried out before withdrawal.
Where to direct a request depends on whose information it is.
- If you have a Chiblu account — contact us at support@chiblu.com.
- If you are a Store customer — the business you bought from owns the customer relationship, so please contact that Store Owner first. If you contact us instead, we will ordinarily refer you to them and assist them in responding.
We act on verified requests as required by applicable law, subject to the retention described in section 8. We aim to acknowledge a verified request within 2 business days.
We may need to verify your identity before acting, and we may be unable to act on a request where the law requires us to keep the information.
10. Closing an account
Account closure is handled by our support team. To close an account, contact support@chiblu.com from the account's registered email address. We may ask for reasonable information to verify the request.
We process verified requests within the timeframe required by applicable law and our applicable retention obligations. We aim to acknowledge a verified request within 2 business days.
Closing an account may result in your Store being deactivated, any custom domain being released, your subscription being terminated, and the payment credentials we hold being removed, subject to applicable retention requirements. Section 4 explains what disconnecting a payment provider does and does not do.
We do not promise that all information is deleted immediately or completely. Some records must be retained for periods set by law, and backups are overwritten on their own cycle.
If you operate a Store: You remain responsible for the personal data you collect from your customers through your Store and for your obligations relating to that data. Please make your own arrangements before closing your account.
11. Security
We use technical and organisational measures appropriate to the risk — including encryption of data in transit, access controls, and monitoring — to protect personal data against unauthorised access, loss and misuse. Credentials used for a connected payment provider are stored in encrypted form.
No service can be completely secure, and we do not guarantee absolute security. If a personal data breach occurs, we will notify affected people and the relevant authority as required by applicable law.
12. Where personal data is processed
Chiblu and its service providers may process personal data in India and in other jurisdictions where they operate, subject to applicable law. Where personal data is processed outside India, we use appropriate safeguards and contractual or organisational measures consistent with applicable law.
13. Hosted Store content
Stores are created and controlled by their Store Owners. Chiblu provides the software and hosting; we do not author Store content and do not review it before publication.
14. Children
The Service is intended for use by adults operating a business, and is not directed at children. We do not knowingly collect personal data from a child. If we become aware that we have collected such information, we will take appropriate steps in accordance with applicable law.
15. Changes to this Policy
We may update this Policy. Where a change is material we will give notice as described in section 19 of our Terms. Continuing to use the Service after a change takes effect means the updated Policy applies.
16. Contact and grievances
For any question about this Policy, or to raise a grievance about how we handle personal data:
- Grievance Officer — Pradeep
- Email — support@chiblu.com
- Address — Chiblu India (OPC) Private Limited, No. 51, Innov8, Mantri Commercio, Devarabisanahalli, Bellandur, Bengaluru, Karnataka – 560103, India
If you are not satisfied with our response, you may be able to escalate to the relevant authority.