Brand Privacy Notice

This Notice describes how OGROTI, a sole proprietorship based in Bengaluru, Karnataka, India ("OGROTI", "we", "us"), handles the personal data of brand owners, authorised signatories, employees and other representatives who act for a brand on OGROTI.

Contact for privacy questions and grievances: hello@ogroti.net. This Notice sits alongside the OGROTI Brand Onboarding, Discovery & Collaboration Agreement and the general OGROTI Privacy Policy at https://ogroti.net/privacy.

• Account details: your name, email address, and your name and photo if you sign in with Google.
• Brand details: brand name, website, categories, and the representative's name and role.
• Verification: documents or evidence of the brand's identity and your authority, only when reasonably necessary (for example registration, GST, FSSAI or trademark details).
• Collaboration records: the requests you send, messages exchanged with OGROTI about them, and photos and records of products when they reach us.
• Acceptance records: the versions of the Agreement and this Notice you accepted, the checkbox wording, the date and time, your account email, IP address and browser.
• Technical data: IP address, browser and device information, error reports, and analytics on how pages are used.

We do not ask for Aadhaar numbers or copies of personal identity documents unless a specific legal purpose requires them.

• To verify your brand and your authority to act for it.
• To create and run your brand page and your account.
• To run collaborations: pass requests between you and creators, arrange visits, and receive, check and deliver products.
• To keep records of what you accepted, and to handle complaints and enforce the Agreement.
• To detect impersonation, fraud, abuse and security risks, and to fix errors.
• To understand how OGROTI is used, so we can improve it.
• To comply with legal obligations and respond to lawful requests.

Accepting the Agreement is not consent to marketing. Any optional marketing is asked for separately and can be withdrawn.

Creators see your public brand page and the content of the requests you send. OGROTI handles all communication between you and creators and never gives a creator your email address or phone number.

Your brand page is public and can be viewed, indexed and cached by others, including search engines. We remove it from OGROTI when your listing ends, but cannot guarantee removal of copies outside our control.

We share only what is needed for each purpose, with:

• Our database and sign-in provider, website hosting and content-delivery provider, and transactional email provider.
• Our product analytics provider and error monitoring provider.
• Our courier partner, for returning a product to you when needed.
• Creators, limited to your brand page and your requests.
• Professional advisers under confidentiality duties, a lawful successor to the OGROTI business, and courts, regulators or authorities where legally required.

We do not sell personal data. You can ask us which providers we use.

We process personal data on the grounds permitted by the law in force at the time, including the Digital Personal Data Protection Act, 2023 as its provisions come into force, and your consent where it is required. Where we rely on consent, you can withdraw it; this may stop a feature that depends on it and does not affect processing already done.

OGROTI uses cookies and similar browser storage needed to keep you signed in, a product analytics service that records how pages and features are used, and an error monitoring service that records technical errors. Analytics data is kept for no longer than thirteen (13) months.

• Account and brand page data: while your brand account exists.
• Collaboration requests, messages and product photos: two (2) years after the collaboration is closed.
• Verification documents: ninety (90) days after your listing ends.
• Acceptance and consent records: five (5) years, even after an account is deleted, as proof of what was accepted.
• Complaints and dispute records: three (3) years after final resolution.
• Analytics: thirteen (13) months.
• Backups: a rolling cycle of thirty (30) to ninety (90) days.

Where the law requires a different period, or information is needed for a legal claim, investigation or security incident, we keep it as long as required and no longer. When a period ends we delete or irreversibly anonymise the data.

We use safeguards proportionate to the data and risks, including access restriction, secure credentials, encrypted connections, vendor controls, backups and incident response. No online system is completely secure. We will handle personal-data breaches and notifications as the law requires.

Subject to the law in force, you can ask us for a summary of your personal data and how we use it, ask us to correct, complete or delete it, withdraw consent, nominate someone to act for you, and raise a grievance. Write to hello@ogroti.net. We may verify your identity before acting, and will respond within the period the law requires.

Brand accounts are for adults acting for a business. We do not knowingly collect children's personal data through them, and will handle any we find as the law requires.

Several providers we use store or process data outside India. We choose providers with appropriate safeguards and comply with any transfer restrictions under Indian law.

We may update this Notice to reflect changes in law, services or data practices. Each version has its own version number and date and stays available unchanged. Where a change needs fresh notice or consent, we will ask before the changed processing starts.

When accepting the Agreement you are asked to acknowledge, through a separate unticked checkbox, that this Notice has been made available to you. We record the version acknowledged, the wording and the date and time.