Privacy Notice

Celestkart is an online marketplace where business buyers find, compare and order space components from suppliers, request quotes and track orders. The platform is operated by Celestkart Private Limited [pending incorporation] (CIN [CIN], GSTIN [GSTIN]), [Registered address] (“Celestkart”, “we”, “us”).

For personal data processed through the platform, Celestkart acts as the Data Fiduciary under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the “DPDP law”), and this notice is also published under the Information Technology Act, 2000 and the rules made under it.

We collect only what you give us through the platform, plus basic technical logs:

• Buyer account: full name, company name, country, an optional description of what you source, email address and password. Passwords are held by our authentication provider and are never stored in our own database.
• Sign-in with Google: if you choose it, the name and email address Google shares with us for that purpose.
• Supplier application: company name, contact person, email address, password, phone number, country, GSTIN (optional), location, product categories and description, and documents you upload such as AS9100, ISO 9001 and GST certificates.
• Supplier review: the review status of your company, any reason given if an application is not approved, and which Celestkart team member completed the review and when.
• Waitlist form: name, email address, company name and whether you are a buyer or a supplier.
• Requests for quote, quotes and orders: the component requested, quantity, target delivery date and messages; quoted price, lead time and notes; order status, carrier and tracking number.
• End-User Declaration (buyers): end-user organisation, intended end use, destination country, signatory name and title, typed signature, the account that signed, the time of signing, IP address and browser user agent, and an optional signed PDF.
• Technical logs: our hosting providers record standard request logs (such as IP address, time, page or endpoint requested and browser user agent) to operate and secure the service.

We do not use third-party analytics, advertising or tracking tools.

• To create and secure your account and sign you in.
• To review supplier applications and show the Verified Supplier badge on approved suppliers.
• To run requests for quote, quotes and orders between buyers and suppliers, and to show order status.
• To record End-User Declarations and screen destinations, so that trade in controlled items can follow applicable export-control law.
• To contact people on the waitlist about onboarding.
• To keep the platform secure, prevent misuse and meet legal obligations.

We process your personal data on the basis of your consent, given when you create an account, apply as a supplier or join the waitlist, and for the legitimate uses permitted under the DPDP law (for example, to meet a legal obligation).

You can withdraw consent at any time by writing to [grievance email]. Withdrawal does not affect processing already carried out, and we may need to close your account, because the platform cannot work without the data described above.

We use two essential cookies, set only when you sign in. We set no analytics or advertising cookies.

• celestkart_session: keeps you signed in. Not readable by page scripts (httpOnly). Expires after 1 hour.
• celestkart_user: holds your role and company ID so the interface shows the right pages. Expires after 1 hour.

Both are removed when you sign out. Because they are essential to signing in, they cannot be switched off.

We use these service providers (Data Processors) to run the platform:

• Supabase: database and authentication, hosted in Mumbai, India (AWS ap-south-1). Authentication emails, such as email confirmation, are sent through our authentication provider.
• Google Cloud Run: our application server and its logs, hosted in Mumbai, India (asia-south1).
• Cloudflare: delivers the website through its global network, so a request may be served from the location nearest to you.
• Cloudflare R2 object storage: stores documents you upload.
• Google: only if you choose to sign in with Google.

Celestkart may in future be part of a group with a parent company in Singapore. We may transfer personal data outside India subject to applicable law, including any restrictions notified under the DPDP law.

• Account and company data: while your account is active, then [retention period, to confirm].
• Supplier documents and review records: [retention period, to confirm].
• Requests for quote, quotes, orders and End-User Declarations: [retention period, to confirm], including any period required by export-control or tax law.
• Waitlist entries: [retention period, to confirm].
• Technical logs: [retention period, to confirm].

When a retention period ends, we delete the data or make it anonymous, unless the law requires us to keep it.

• All traffic to the website and API is encrypted in transit (HTTPS).
• Passwords are handled by our authentication provider and stored only in hashed form.
• The sign-in cookie cannot be read by page scripts, and sessions expire after 1 hour.
• Access inside the platform is limited by role: buyers, suppliers and Celestkart administrators each see only what their role allows.
• Uploaded documents are private and are shared only through short-lived, signed links.
• Each End-User Declaration is stored with a content hash so later changes can be detected.

Under the DPDP law you can ask us to:

• give you a summary of the personal data we process about you and how we use it;
• correct, complete or update your personal data;
• erase your personal data, unless we must keep it to meet a legal obligation;
• address a grievance about how we handle your personal data; and
• nominate another person to exercise these rights if you die or become unable to do so.

Write to [grievance email]. We may need to confirm your identity before acting on a request. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

If a personal data breach occurs, we will inform the Data Protection Board of India and the people affected, in the form and within the time required by the DPDP law, describing what happened, the likely impact and the steps we are taking.

Celestkart is a service for businesses. It is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

Name: [Grievance Officer name]
Email: [grievance email]
Address: [Registered address]

Draft, pending counsel review: the Grievance Officer is designated under the Information Technology Act, 2000, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP law. Acknowledgement and resolution timelines are to be confirmed by counsel.

We will update this notice when our practices change, and show the new version number and date at the top of this page. If a change affects how we use personal data you have already given us, we will tell you before it takes effect and, where required, ask for your consent again.

This notice is governed by the laws of India.