Legal

Privacy Policy

Last updated: 22 September 2026

1.Introduction

This Privacy Policy explains how PartByPart (“we”, “us”) collects, uses, shares and protects personal data. We act as a “Data Fiduciary” under the Digital Personal Data Protection Act, 2023 (DPDP Act) of India and, where applicable, as a “controller” under the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

2.Information We Collect

Account data from Google OAuth: name, email, profile picture, Google account ID.
Listing data: photos, model number, year, part type, condition, description, price, city, country, approximate latitude/longitude.
Chat data: messages between users, timestamps. Stored encrypted at rest.
Device & log data: IP address, device type, browser, referring page, error logs.
Location data: country and city derived from your IP via a third-party geolocation service (ipapi.co) to set your default currency and region.

We do not collect Aadhaar, PAN, financial account details, biometric data, or sensitive personal data as defined under the SPDI Rules.

3.Lawful Basis for Processing

We rely on (a) your consent (obtained at sign-up and consent banners), (b) performance of a contract (to operate the Platform), and (c) legitimate interest (fraud prevention, security, abuse reporting) as lawful bases under the DPDP Act and GDPR.

4.How We Use Your Data

To provide and maintain the Platform and personalise listings shown to you;
To enable chats and connect buyers and sellers;
For AI-assisted moderation, NSFW detection, and detection of stolen / counterfeit listings;
To prevent fraud, abuse and illegal activity;
To comply with legal obligations and respond to lawful requests by public authorities.

5.AI Processing

When you upload a product photo we send the image to our AI provider (Gemini, via Emergent Universal LLM key) to suggest the model number, part type and condition, and to detect inappropriate content. Photos are processed for inference only and are not used to train third-party models. Listing descriptions are similarly checked for prohibited content.

6.Sharing of Data

We share data only with:

Service providers: object storage, geolocation, AI inference, email — all bound by data-processing terms;
Other users: your name, profile photo, listings and chat content are visible to the user you are chatting with;
Authorities: when required by valid legal process (court order, subpoena under Indian law, or equivalent in your jurisdiction).

We do not sell personal data.

7.International Transfers

PartByPart is operated from India. Your data may be processed on servers located in India, the European Union, or the United States. Where personal data is transferred outside your country, we use appropriate safeguards (e.g., Standard Contractual Clauses for EU transfers).

8.Data Retention

Account data: until you delete your account;
Listings: while active, plus 90 days in a soft-deleted state for fraud investigation;
Chat messages: 24 months from last activity, then anonymised;
Logs: up to 180 days as required under the IT Rules 2021.

9.Your Rights

Subject to applicable law you have the right to:

Access the personal data we hold about you;
Correct inaccurate or incomplete data;
Erase your data (right to be forgotten);
Withdraw consent previously given;
Port your data to another service in a machine-readable format;
Nominate another person to exercise your rights in case of death or incapacity (DPDP Act);
Complain to the Data Protection Board of India or your local data protection authority.

To exercise these rights, email privacy@partbypart.com. We respond within 30 days.

10.Security

We use TLS in transit, AES-256 encryption at rest for chat messages, hashed session tokens, rate limiting, and least-privilege access controls. No system is perfectly secure; you remain responsible for safeguarding your Google account.

11.Cookies

We use a single first-party httpOnly cookie (session_token) for authentication. We do not use third-party advertising cookies. By using the Platform you consent to this cookie. You can clear it at any time from your browser.

12.Children

The Platform is not intended for users under 18. We do not knowingly collect personal data from minors. If we learn we have done so, we will delete it.

13.Grievance Officer (India)

In accordance with the Information Technology Act, 2000 (and Intermediary Guidelines, 2021) and the Digital Personal Data Protection Act, 2023:
Name: PartByPart Grievance Officer
Email: grievance@partbypart.com
Address: PartByPart, Mumbai, Maharashtra, India.
Acknowledgement within 24 hours; resolution within 15 days. Disputes arising from this Policy shall be subject to the exclusive jurisdiction of the courts at Mumbai, Maharashtra, with arbitration (if invoked) seated at Mumbai under the Arbitration and Conciliation Act, 1996.

14.Changes to this Policy

We will notify you of material changes to this Policy via in-app banner or email at least 14 days before they take effect.