Privacy Policy

1. Overview

Truwth is a buyer trust network for Indian D2C merchants built on Shopify. We create a privacy-preserving trust score for every buyer based on their order behavior across participating merchants. This policy explains what data we collect, why, and how we protect it.

Truwth is operated by Truwth (India). By using our services — whether as a merchant installing our Shopify app, or as a buyer checking your score — you agree to this policy.

2. What data we collect

From merchants (via Shopify):

• Order data — order ID, order value, payment mode (COD or prepaid), fulfillment status, delivery outcome (delivered, returned, RTO)
• Buyer phone number from orders — immediately hashed, never stored as plain text
• Shipping pincode from orders
• Merchant store domain and access token (to sync orders via Shopify API)

From buyers (via score portal):

• Phone number entered to look up score — hashed in the browser request, never logged in plain text
• Truwth ID if entered directly

We do NOT collect:

• Full name
• Email address
• Home address or location beyond pincode
• Bank account or payment details
• Device fingerprints, cookies, or tracking pixels on the buyer portal

3. How we use it

• To generate buyer trust scores — Order history is used to compute a score (300–900) reflecting delivery acceptance rate, RTO rate, prepaid ratio, and cross-merchant behavior.
• To enable COD screening — Merchants use scores to decide whether to offer Cash on Delivery at checkout.
• To allow buyers to check their own score — Buyers can look up their Truwth ID and score by entering their phone number.
• To improve scoring accuracy — Aggregate, anonymized patterns are used to refine the scoring algorithm. No individual is identified in this process.

We do not use your data for advertising, profiling beyond trust scoring, or sale to third parties.

4. How phone numbers are protected

Here is the process:

1. Phone number is received (e.g., from a Shopify order or buyer portal)
2. It is normalized to E.164 format (e.g., +919876500000)
3. SHA-256 hash is computed immediately
4. Only the hash is stored — the original number is discarded

We store the last 4 digits of the phone number (e.g., 7601) alongside the hash. This is used only to help merchants confirm they are looking at the right buyer — it cannot be used to reconstruct the full number.

5. Data sharing

Between Truwth merchants: Buyer scores (Truwth ID, numeric score, tier) are shared across all participating merchants. This is the core function of the network — a buyer's score at one store is visible to all Truwth merchants. No personal identifiers (name, phone, address) are ever shared between merchants. Only the anonymous Truwth ID and score.

Third parties: We do not sell, rent, or share buyer or merchant data with any third party for marketing, advertising, or commercial purposes.

Service providers: We use Supabase (database) and Railway (hosting). Both are GDPR-compliant infrastructure providers. Data is processed within their secure cloud environments.

Legal requests: We may disclose data if required by law, court order, or regulatory authority in India.

6. Information for merchants

When you install Truwth on your Shopify store:

• We access your store's order history and customer phone numbers via Shopify's API with your explicit permission
• Your store's access token is stored securely and used only to sync orders and receive webhooks
• You can request deletion of all your store's data by emailing us — we will delete all synced orders and associated scores derived solely from your store within 30 days
• Uninstalling the app from Shopify stops all future data collection immediately

As a merchant using Truwth, you are responsible for informing your customers that their order behavior contributes to a cross-merchant trust score. We recommend adding a short disclosure to your privacy policy.

7. Information for buyers

If you have placed an order at a Truwth-connected merchant, a Truwth ID and score have been created for you based on that order history.

• Check your score: Visit truwth.in/buyer and enter your phone number to see your Truwth ID, score, and tier
• Your score is based on: Order acceptance rate, RTO/return rate, payment mode (COD vs prepaid), and cross-merchant delivery history
• Score improvement: Accepting deliveries and choosing prepaid improves your score over time
• Opt-out / deletion: Email us at privacy@truwth.in to request deletion of your Truwth profile. Because we only store your phone hash (not the number itself), we will require you to provide your Truwth ID to process the request

8. Data retention

• Order records: Retained for as long as the originating merchant's store is connected to Truwth, plus 90 days after disconnection
• Buyer scores and Truwth IDs: Retained indefinitely to maintain score continuity across the network, unless a deletion request is received
• Merchant access tokens: Deleted immediately upon app uninstall
• Score history logs: Retained for 12 months, then automatically purged

9. Your rights

You have the right to:

• Access — Request a summary of what data Truwth holds about you
• Correction — Request correction of inaccurate score data if you believe there is an error
• Deletion — Request deletion of your Truwth profile (subject to verification via Truwth ID)
• Portability — Request a machine-readable export of your score history
• Objection — Object to your data being used for cross-merchant scoring

To exercise any of these rights, email privacy@truwth.in with your Truwth ID (found at truwth.in/buyer). We respond within 30 days.

10. DPDPA compliance

Truwth is built to comply with India's Digital Personal Data Protection Act, 2023 (DPDPA).

• Purpose limitation: Data is collected only for trust scoring — not for advertising, profiling, or resale
• Data minimisation: We collect only what is necessary — phone hash, order outcome, pincode. No unnecessary PII
• Privacy by design: One-way phone hashing is built into the core architecture — the system is technically incapable of storing plain-text phone numbers
• Consent: Merchants install Truwth with explicit Shopify permission grants. Buyers are informed of the scoring system via merchant disclosures and this policy
• Data localisation: All data is stored on Supabase infrastructure. We are committed to India-region storage as soon as Supabase makes it available in Mumbai/India regions
• Grievance officer: For privacy grievances, contact privacy@truwth.in. We acknowledge within 48 hours and resolve within 30 days