Privacy Policy

MandiHub ("we", "us", or "our") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, store, and protect your data in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act 2023) and other applicable Indian laws.

By using MandiHub services, you consent to the data practices described in this policy. We collect and process sensitive personally identifiable information (PII), including Aadhaar numbers and business-registration documents, as part of our marketplace operations and Know Your Customer (KYC) verification processes. We do not collect PAN details, and we do not hold bank account information.

1Data Collection Purpose

We collect your personal data for the following legitimate purposes:

• Marketplace Operations: Facilitate buying and selling of agricultural products, equipment rental, and farm labor hiring
• KYC Verification: Verify identity of farmers, buyers, sellers, and agents to prevent fraud and ensure compliance with Indian regulations
• Payment Processing: Process subscription payments, which Google Play collects. No money moves between buyers and sellers through the Platform
• Account Management: Create and maintain user accounts, provide customer support, and deliver platform services
• Legal Compliance: Meet our obligations under Indian law, including the Information Technology Act and its intermediary rules, and tax law as it applies to the subscriptions we sell
• Security & Fraud Prevention: Detect and prevent fraudulent activities, unauthorized access, and security threats

2Types of Data We Collect

We collect the following categories of personal and sensitive personal data:

3Data Storage Duration

These are the periods we actually keep things for, and each one is enforced by a job that runs every day rather than by a promise:

• KYC documents: the photograph you upload is deleted as soon as a reviewer has verified it. We do not keep it afterwards — the verdict, the last four digits of the number and your verified badge are what remain. A document we refuse is kept so you can see why and send a corrected one, and is erased, with the identity numbers on the record, five years from your last verification.
• Your account: erased as soon as you ask. Deleting your account clears your name, phone, email, address, location and KYC details in one step — we do not hold them for a further period first.
• Device tokens used for notifications: thirty days after a device stops being used.
• Photographs that were uploaded but never attached to anything: twenty-four hours.
• Messages you exchange with other users: kept while your account is open, so a conversation is still there when you come back to it.

MandiHub does not process payments between buyers and sellers and holds no bank or transaction records for those dealings, so there is no financial retention period here. Subscription payments are handled by Google Play, and Google keeps those records under its own policy.

4Data Security Measures

We implement industry-standard security measures to protect your data:

• Encryption: KYC document numbers are encrypted with AES-256-GCM at rest, and all traffic uses TLS in transit
• Access Controls: Strict role-based access controls limit data access to authorized personnel only
• Secure Infrastructure: Data stored on secure servers with regular security audits and vulnerability assessments
• Authentication: Multi-factor authentication (OTP-based) for sensitive operations
• Monitoring: Continuous monitoring for unauthorized access attempts and security incidents

5Data Sharing and Third Parties

We may share your data with the following third parties for legitimate business purposes:

• Payment Processor: Google Play Billing processes every purchase. We never receive or store your card, UPI or bank details — Google does, under its own privacy policy
• KYC Verification Services: none. Your Aadhaar number is reviewed by MandiHub staff and is not sent to a third-party verification provider
• Government Authorities: When required by law (tax authorities, law enforcement, regulatory bodies)
• Service Providers: Cloud hosting providers, SMS/email services, analytics platforms under strict data processing agreements

We do not sell your personal data to third parties for marketing purposes.

6Your Rights Under DPDP Act 2023

Under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to Access: Request a copy of your personal data we hold
• Right to Correction: Request correction of inaccurate or incomplete data
• Right to Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Right to Data Portability: Request your data in a machine-readable format
• Right to Withdraw Consent: Withdraw your consent for data processing at any time (may limit access to services)
• Right to Grievance Redressal: File complaints with our Data Protection Officer or the Data Protection Board of India

To exercise any of these rights, please contact our Data Protection Officer using the contact details below.

7Children's Data and Minimum Age

MandiHub is not intended for children. You must be at least 18 years old to create an account, because the Platform is used to list produce, rent equipment, and hire labour, all of which require the legal capacity to enter into binding contracts.

• Age check: Before we ask for any personal information, we ask for your date of birth and use it only to work out whether you are old enough to use the Platform.
• Under 13: We do not knowingly collect any personal information from children under 13, in line with the Children's Online Privacy Protection Act (COPPA). If the date of birth you enter shows you are under 13, we stop there, keep no record of it, and collect nothing further.
• 13 to 17: You are not eligible for an account. We keep no record of the date of birth entered and collect nothing further.
• 18 and over: We store your date of birth alongside your consent to these documents, as the record that the age check was performed.
• Discovery after the fact: If we learn that we hold personal data belonging to a child under 18, we will delete it and close the account. If you believe a child has provided us with personal data, contact dpo@mandihub.in and we will act within 7 business days.

8Account Deletion and Data Anonymization

You can request account deletion at any time by:

• Navigating to Account Settings > Delete Account in the mobile app or website
• Contacting customer support at support@atavishaala.com
• Sending a written request to our Data Protection Officer

Upon account deletion request:

• Your account will be deactivated immediately and you will lose access to platform services
• Your name, phone number, email, address, location and KYC details are erased straight away, in a single step, not after a further waiting period
• Your stored KYC document is deleted from our file storage at the same time
• Your listings and reviews stay, detached from you: they are no longer linked to a name, a number or any way of identifying you

9Data Protection Officer Contact

10Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by:

• Posting the updated policy on this page with a new version number and "Last updated" date
• Sending an email notification to your registered email address
• Displaying an in-app notification when you next log in

Your continued use of MandiHub services after any changes indicates your acceptance of the updated Privacy Policy.

Revision history

• Version 1.8 · 19 September 2026

  A verified identity document is now deleted the moment it is verified, rather than kept for five years. Until this revision the photograph of an Aadhaar card - the full number, the holder's face and their address - stayed in storage for five years after it had served its only purpose, which was a reviewer comparing it against the details read off it. Those details are on the account and the verdict is on the record; the image was being kept for nothing but the chance of a second look, and holding it that long was the riskier reading of UIDAI's conditions and of the minimisation duty in the DPDP Act. A refused document is still kept, because somebody told their document was rejected is owed the ability to see why and send a corrected one, and it is erased on the same five-year clock as the identity numbers. The verified badge, the last four digits and the audit record naming the reviewer are unaffected.

• Version 1.7 · 18 September 2026

  Every published contact address moves to the company's own domain. Version 1.6, issued earlier the same day, gave the Grievance Officer the company's general telephone line — his own number had been supplied with nine digits, and no Indian mobile has nine — and an email address on mandihub.in, which was never a mailbox. The officer now has a reachable ten-digit number, and both his address and the general support address are on atavishaala.com. Nothing else changes: the officer, the registered identity, the seat of jurisdiction and every clause stand as issued in 1.6. A grievance route and a support address are only routes if they connect, which is why a contact detail warrants a revision of its own rather than a silent edit to the last one.

• Version 1.6 · 18 September 2026

  The company's legal identity is published for the first time. The IT Rules 2021 r.3(2) and the Consumer Protection (E-Commerce) Rules 2020 r.5 each require an intermediary to name itself and a Grievance Officer who is a person; until now neither appeared on any surface, and the officer was given as the role title “Grievance Officer — MandiHub”. Both documents now carry the registered name Atavishaala Agro Exports Private Limited, its CIN, GSTIN and registered office at Kedgaon, Ahmednagar (Ahilyanagar), Maharashtra, and Nithin Amirineni as the named Grievance Officer with a telephone number and an email address. The seat of jurisdiction, blank in counsel's copy and therefore rendered as “the competent courts in India” since 1.5, now names Ahilyanagar, Maharashtra. The published grievance telephone number is the company line: the officer's direct number was supplied with nine digits, which no Indian mobile has, and a stated escalation route that does not connect is worse than one that is merely general.

• Version 1.5 · 14 September 2026

  Terms and Conditions replaced with the document supplied by counsel for Atavishaala Mandi Hub: 24 clauses covering eligibility, account security, the platform's role as an introducer rather than a party, seller and buyer obligations, listings and pricing, fulfilment, disputes, prohibited activity, content licensing, security, suspension, disclaimers, liability, indemnity, grievance redressal and governing law. Adds the clause that was missing from every earlier revision: selling requires a verified identity, and a verified seller's listing is published immediately rather than waiting for a moderator — which is what the Platform now does. The seat of jurisdiction is left blank in counsel's copy, so the clause names the competent courts in India until a city is supplied. The translated Terms were withdrawn rather than left describing the previous agreement; every language is served the current English Terms until a full translation replaces them.

• Version 1.4 · 12 September 2026

  Removes four claims the Terms and the Privacy Policy made that the Platform does not keep. The Terms told buyers they could track orders and deliveries, and four sections later said there is no order, no checkout and no payment; they also promised quality-verified products while stating elsewhere that a verified badge means an identity document was seen and nothing more, and that we do not inspect produce. Termination promised to settle pending transactions, and there are none. The Privacy Policy said we enable financial transactions through the platform, when the only money we handle is a subscription collected by Google Play.

• Version 1.3 · 12 September 2026

  Terms rewritten to describe what the Platform actually is: a classifieds board that introduces buyers to sellers and is never a party to their dealings. Removes the order, shipment, delivery and refund language for transactions that do not exist, and states plainly that a Google Play subscription is refunded by Google. Retention periods replaced with the ones now enforced by a daily job, and the PMLA basis for keeping identity data removed.

• Version 1.2 · 12 September 2026

  Consumer disputes are carved out of the arbitration clause: a consumer may take a complaint to the commission where they live or work and is not required to arbitrate. Adds the children's data and minimum-age section to the website, which had been in the app since 1.1 and missing from the web copy.

• Version 1.1 · 9 August 2026

  Adds the children's data section and states the minimum age of 18 in the Privacy Policy. Published both documents inside the mobile app.

• Version 1.0 · 6 August 2026

  First published revision. Removes escrow-era claims left over from the transactional marketplace, and replaces the render-time "Last updated" date with a fixed one.

11Contact Us

For general inquiries about our privacy practices or this Privacy Policy, please contact us: