Privacy Policy

This Privacy Policy explains what personal data JARASA Jewellery & Co ("the Company", "we") collects through this website and the Jarasa Android apps, why we need it, and the choices you have. By using the service you agree to this policy.

1. What we collect

• Account data: your name, member ID (JRC…), mobile number and a password (stored only as a salted scrypt hash — never in plain text).
• Profile data you choose to add: email, PAN (optional), address/state/pincode, and your language preference.
• Order data: items, quantities, the locked gold rate and price, buyer details you enter (name, phone, address, optional GSTIN), status history and a fingerprint that makes every money record one-of-a-kind.
• Payment records: the records needed to run the jewellery shop and honour its commitments.
• Merchant data (partner jewellers): business name, mobile (login), email, GST number, PAN, BIS hallmark licence, bank details, shop photo and the KYC documents you upload (Aadhaar front/back, PAN card, GST certificate, hallmark licence).
• Location check-ins (only with your action): when you press a 📍 check-in button (buyer store visit / jeweller counter check-in) we store the GPS coordinates + time on that single order as proof of the physical visit.
• Technical data: cookies (login session, merchant session, language, plan scope, cart), IP address for abuse/rate-limit protection, and activity-log entries (logins, content changes, uploads) to keep the platform accountable.

2. Why we use it

• To run your account, the Gold Shop, orders, invoices and wallets.
• To verify partner jewellers (KYC) and their products before anything goes public.
• To issue correct GST tax invoices and keep audit-proof money trails (fingerprints, activity log).
• To protect the platform from fraud, duplicate credits and abuse (rate limits, IP checks).
• To send service e-mails you ask for (password reset links) and, when enabled, order notices.

3. Who can see your data

Only the authorised Jarasa admin team. Personal wallet balances and earning reports of members are not shown to other members. Merchant KYC documents are streamed only to the merchant himself and to authorised staff — they are never public. Location check-ins are visible only to the team for that one order. We do not sell your data.

4. Documents & uploads

KYC files and bills/receipts are validated by content type (magic bytes), size-capped, and stored outside the public web root. Old single-document KYC uploads remain viewable to you and staff. Upload images may be automatically shrunk in your browser before upload to save data.

5. Cookies we use

• jrc_session — your logged-in session (member or staff), signed with HMAC.
• jrc_merchant — the partner jeweller portal session.
• jarasa_lang, jarasa_scope — your language and plan choice.
• jarasa_cart — your browser-local cart.
• Optional admin view-as cookie — used only when staff uses the view-as-member tool, and every start/stop is logged.

You can clear cookies any time; you will simply be asked to log in again.

6. Security

Passwords use scrypt with a per-user salt. Sessions are HMAC-signed; production runs over HTTPS. Debits are guarded by atomic database checks, and every money movement carries a unique fingerprint so a credit can never be duplicated. Staff actions (approvals and reviews) are attributed and timestamped.

7. Your choices

• View and edit your profile data any time from your dashboard.
• Ask the admin to close your account / erase data that we are not legally required to keep — write to info@jarasaonlineservice.tech from your registered contact.
• Merchant accounts: you can replace your KYC documents per document; KYC status changes are reviewed by the team.

8. Children

The programme is not directed at persons under 18. Accounts for minors are not allowed.

9. Changes

We may update this policy as the platform grows; the date above changes with every material update. Questions? Contact support.