Read the sections that matter to you
Each section stays collapsed until you choose to open it.
1. Data we processPhone, order, email, UTR and limited technical records.
Depending on the stage of an order, BA Consultancy may process an Indian mobile number, order reference, language, email address, UPI transaction ID/UTR/reference, expected amount, payment-review status, correction and rejection records, ZIP sent/resend status, consent record, administrator actions, first-party analytics events, campaign attribution, secure browser/session identifiers and a one-way HMAC technical fingerprint.
The application does not store the raw IP address in the business database. Infrastructure providers may process network logs under their own security and service terms.
2. Why we use the dataOrder creation, recovery, verification, fulfilment, support and security.
The mobile number is used to create and recover the order. Email and UTR/reference are used to manually match payment and deliver the purchased ZIP. Order and audit records support corrections, resends, refunds, fraud prevention, customer support, security, compliance and dispute handling.
We do not use purchase data for marketing unless a separate optional marketing consent is introduced in the future. No such consent is part of the current order checkbox.
3. Consent and noticeOne clear checkbox records the customer’s acceptance.
Before a new order is created, the buyer sees a short privacy notice, links to the legal documents, and one unchecked acceptance box. The system records the legal version, language, time, source path and a protected technical reference. Consent can be withdrawn for processing that is no longer necessary, but withdrawal does not erase records that must still be kept for an order, dispute, fraud prevention, accounting or law.
4. Service providers and transfersVercel, Supabase and Cloudflare support hosting, database and security.
BA Consultancy uses service providers such as Vercel for hosting, Supabase for database and authentication, and Cloudflare Turnstile for abuse protection. These providers may process limited data in locations where they operate, subject to their contracts, security measures and applicable law. The paid ZIP remains only on the administrator’s local device and private backup.
5. SecurityAccess controls, forced RLS, rate limits and audit records.
Controls include server-only secrets, forced database row-level security, protected database functions, admin authentication, secure HTTP-only order cookies, one-way hashing/HMAC, rate limits, Turnstile, same-origin checks, audit trails, encrypted transport and controlled backups.
No online service can promise absolute security. If a personal-data breach creates a material risk, BA Consultancy will investigate, contain it and provide notices required by applicable law.
6. RetentionCore order records are reviewed after 12 months.
Core order, consent, payment-review and fulfilment records are generally retained for at least 12 months after the latest relevant order, payment, support or delivery event. After that period, direct identifiers may be deleted or anonymised when no longer needed.
Some records may be kept longer for an active complaint, refund, fraud investigation, accounting or taxation requirement, legal claim, security incident or lawful government request. Non-identifying aggregate analytics may be retained longer.
7. Customer rightsAccess, correction, updating, erasure and grievance requests.
A customer may ask what personal data is associated with an order, request correction or updating, request erasure where continued retention is not required, or raise a privacy grievance. Requests should include the order reference and matching phone or email so the requester can be verified without asking for unnecessary identity documents.
Requests may be sent to customerbaconsultancy@gmail.com. We aim to acknowledge within 48 hours and resolve within 30 days, subject to verification and legal retention requirements.
8. Adults onlyThe purchase flow is limited to adults.
The purchase flow is intended for buyers aged 18 or older. BA Consultancy does not knowingly invite children to submit order, payment or delivery data.
9. ContactPublished privacy and grievance contact.
Privacy and grievance contact: Grievance Officer — BA Consultancy, customerbaconsultancy@gmail.com. Operator: BA Consultancy, operated by BHAVANI ADVANCED TECHNOLOGIES. Correspondence address: 4, Doddapete, Ranebennur, Haveri, Karnataka 581115, India. GST registration: GST registered — GSTIN 29GAFPB9063P1ZZ.