Privacy policy

What an order, a booking or an account needs, and no more:

• Account and contact details: your name, email address and phone number.
• Addresses: the delivery addresses and service-site addresses you save or enter.
• Orders and payments: your order, booking, invoice and payment history. Card and UPI details are entered on the page of Razorpay, our payment processor, and never reach TCMCart servers — we receive only the payment reference and its outcome.
• Services: your service bookings, the tenders (job requests) you post and the bids on them, and the ratings and comments you leave.
• Support: your support tickets, and the questions you type into the help assistant.
• Business details: for business customers, the firm name, GSTIN and PAN printed on your invoices.
• Service partners: identity and KYC documents (such as Aadhaar, PAN or a trade licence), a profile photo, and the bank IFSC and last four digits of the account number used for payouts.
• Your device: a push-notification token, if you allow notifications in the app.
• Location, only when you ask for it: if you press "Use my current location", we read your device’s coordinates once and save them against that project location so we can pre-select the nearest site when you order. We never read your location in the background, never track your movements, and never share these coordinates with anyone. Skip the button and we never ask; remove the project location and the coordinates go with it.
• Security: the IP address and browser or device user agent recorded with each sign-in session and in our audit logs.

• If you choose "Continue with Google", Google shares your name, your email address and your Google account ID with TCMCart. We ask only for these basic details (Google’s openid, email and profile permissions), never for your Google password, contacts or other Google data. Google’s sign-in token also includes a link to your profile photo, which we do not use or keep.
• We use them to create your TCMCart account or sign you in to it; to link Google to an existing TCMCart account with the same email address; to show "Google: connected" on your profile; and to email you when Google sign-in is added to your account.
• We store your Google account ID and your Google email address with your TCMCart account. The sign-in token Google sends is checked and not kept. We do not sell this information, share it with third parties, or use it for advertising.
• On the website, Google provides the "Continue with Google" button, so loading the sign-in or create-account page lets Google set its own cookies under Google’s privacy policy. In the Android app, Google’s account picker on your phone does the same job.
• Deleting your TCMCart account removes the link to your Google account. You can also remove TCMCart’s access at any time in your Google Account, under "Third-party apps and services".

Only the people who need it to do what you asked, and only what they need:

• Razorpay, our payment processor, to take payments and issue refunds.
• Our cloud hosting and storage providers, who store data on our behalf.
• Expo's push service, which passes notifications to Apple and Google for delivery to your device.
• The service partner assigned to your booking, who receives your name, phone number and site address.
• Delivery partners, who receive the name, phone number and address for the delivery.

We also disclose data where the law requires us to.

In the app, open the Account tab, then Your profile, then Delete account. Without the app, or as a service partner, write to us through the contact page and we will delete the account within thirty days.

How account deletion works sets out the steps, what is deleted, and what is kept and why.

Questions about this policy or your data go through the contact page. A message there reaches the support desk and comes back with a reference number.