Privacy Policy

This policy explains how Yavora Innovations Private Limited (“FanRoute”, “we”) handles personal data when you use FanRoute. It is written for the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and their rules. We collect only what we need to run the service, and we do not sell personal data or use it for advertising.

It covers three groups of people:

Shop owners: people and businesses with a FanRoute account.
Visitors: anyone who opens a FanRoute shop page or fanroute.in.
Buyers: visitors who place an order or send a payment screenshot on a shop.

1. Shop owners: what we collect

Account: email address, display name and password (stored only as a salted PBKDF2 hash, never in readable form).
Shop: everything you add to your shop, such as its name, handle, bio, business category, city, area or address, business hours, website, Instagram handle, Google Maps link, products and services, prices, offers, testimonials, links and store links.
Contact and payment details you publish: your WhatsApp number, UPI ID, UPI QR image, and any bank details you add (account holder, bank, IFSC and account number). Everything except the bank account number appears on your public shop, because customers need it to reach and pay you. The bank account number is encrypted in our database and only shown back to you.
Images you upload: logo or avatar, banner, product photos, store-card images and your UPI QR code.
Billing: if you subscribe to Pro, the Razorpay customer and subscription IDs, subscription status, renewal dates and invoice amounts. Your card, UPI and bank credentials go straight to Razorpay; we never see or store them.
Security and usage records: when you register and log in we record the time, the sign-in method, your browser's user-agent and a shortened one-way hash of your IP address. We also keep an audit log of important account and admin actions.
Consent: when you accepted these policies and confirmed you are 18 or older, and which version you accepted.
Messages: what you send us when you contact support, report a shop or submit a copyright notice.

2. Visitors: what we record

When someone opens a shop page or taps something on it, we record an event so the owner can see aggregate analytics. Each event holds:

What happened: a page or product view, a link or product tap, a WhatsApp enquiry, copying the UPI ID, opening a payment app, viewing the QR code, sharing the shop, or starting or submitting an order.
When it happened, and which shop, product or link it relates to.
The website that sent the visitor (the referrer) and any campaign tag the owner added to their link (the ?c= tag).
The browser's user-agent, and the device type and operating system worked out from it.
The two-letter country code our network provider (Cloudflare) supplies for the request.

We do not store visitors' IP addresses with these events, give visitors an ID, or show owners who a visitor is. An IP address is used briefly in memory to stop floods of fake views and to rate-limit abuse, and then discarded.

On fanroute.in itself we also use Vercel Web Analytics to count page views, and keep our own count of visits to our marketing pages (see Section 6 for the cookie).

3. Buyers: what we collect for the shop

When you place an order or send a payment screenshot on a shop, we collect your name, your phone number or email, any note you write, the amount, the payment screenshot you upload and the UPI transaction reference. We pass this to that shop's owner only, so they can confirm your payment and fulfil your order. Payment screenshots are kept in private storage that only the shop owner can view, through their signed-in dashboard.

The shop owner decides how your order information is used and is responsible for it (they are the data fiduciary). FanRoute stores and processes it on the owner's behalf. For questions about an order, contact the shop directly; for anything about how FanRoute stores it, contact us.

Your payment itself happens in your own UPI or banking app. FanRoute never receives or handles buyers' money or payment credentials.

4. Why we use personal data

To create and run your account and shop, and to show your shop to visitors.
To let buyers place orders and send payment proof to the shop owner.
To show shop owners analytics about their visitors and products.
To bill Pro subscriptions.
To send service emails: email verification, password resets, account-deletion confirmations, alerts when one of your links breaks or recovers, and notices if your shop is suspended or reinstated. You can turn link alerts off in Settings. We do not send marketing email.
To keep FanRoute secure and to prevent spam, fraud and abuse.
To handle reports, complaints and copyright notices, and to meet our legal obligations.

We process shop-owner data to provide the service you asked for, on the basis of your consent when you create an account, and where the law requires or allows it (for example tax records or a lawful request from a government authority). You can withdraw consent by deleting your account; that does not affect processing already done.

We share personal data only with the service providers below, who process it for us under contract, and with the shop owner in the case of buyer data. We do not sell or rent personal data.

Supabase: database and file storage (servers in the United States).
Render: runs our application servers (Singapore).
Vercel: hosts the fanroute.in website and provides Web Analytics.
Cloudflare: CAPTCHA on sign-up (Turnstile) and the visitor's country code.
Razorpay: payment processing for Pro subscriptions (India).
Brevo: sends our service emails.
Upstash: stores our marketing-page visit counts.

We may also disclose data when the law requires it, to respond to a lawful order of a court or government agency, or to protect people from harm. If FanRoute or Yavora Innovations is merged or sold, data would move to the new owner under this policy.

6. Cookies and browser storage

Sign-in: your browser keeps your login token and chosen shop so you stay signed in.
Preferences: your theme and storefront language (rf_lang cookie, 1 year).
View counting: while a tab is open, a shop page remembers which products it has already counted, so one visit is not counted twice. This stays in the browser and is not an ID.
Campaign tag: the ?c= tag you arrived with, kept for the browser tab.
Marketing visit counter: an fr_v cookie (1 year) that only tells us whether a browser has visited fanroute.in before. It holds no personal data.

Third-party scripts are limited to Vercel Web Analytics, Cloudflare Turnstile on the sign-up page, and Razorpay's checkout on the billing page. We use no advertising or social-media trackers.

7. Where data is stored

Our database and uploaded files are stored with Supabase in the United States, and our application servers run in Singapore. Data is therefore transferred outside India, which the Digital Personal Data Protection Act allows except to countries the Government of India restricts. We protect it the same way wherever it is processed.

8. How long we keep data

Account and shop data: while your account is active.
Raw visitor events: deleted after 90 days.
Free-plan shops: raw events and the hourly totals made from them are deleted after 30 days. Paid plans keep the hourly totals while the account is active.
How far back your dashboard shows is a separate display limit (Free 14 days, Pro 30 days, 90 days on the legacy Enterprise plan). Hiding older figures from your charts does not delete them.
Email-verification links expire after 24 hours and password-reset links after 1 hour.
Deleted accounts: see Section 9. We keep a record that a deletion was requested and completed, holding only a one-way hash of the email address, and audit-log entries of important actions on the account (which can include the email address that performed them), as proof that we honoured the request and to meet legal obligations. Razorpay keeps its own payment records as the law requires.

9. Your rights and choices

Under the Digital Personal Data Protection Act, 2023 you can:

Access a summary of your personal data and how we process it.
Correct or update it. Most of it you can edit yourself in your dashboard.
Erase it by deleting your account.
Nominate someone to exercise your rights if you die or become unable to.
Complain to our Grievance Officer (below) and, if you are not satisfied, to the Data Protection Board of India.

Download your data: Settings → Data & privacy gives you a copy of your account data. For anything not in that file, email us.

Delete your account: Settings → Data & privacy. You confirm by email, any Pro subscription is cancelled so you are not charged again, and your shops go offline straight away. After a 30-day window in which you can change your mind we permanently delete your shops and everything in them (links, products, orders, payment details, uploaded images, analytics, subscriptions and settings) and your sign-in and security records, and replace your name and email address with an anonymous placeholder.

To exercise any right, email support@fanroute.in. We may need to confirm your identity first.

10. Children

FanRoute is only for people aged 18 or over. We do not knowingly collect data from children. If you believe a child has given us personal data, email support@fanroute.in and we will delete it.

11. Security

Passwords are hashed with PBKDF2, bank account numbers are encrypted at rest, buyers' payment screenshots are kept in private storage, connections are encrypted in transit, and access to production data is limited to people who need it and is logged. No system is perfectly secure. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the law requires.

12. Changes to this policy

We will post any update here with a new effective date and, for a material change, tell shop owners by email or in the dashboard before it takes effect.

13. Contact

Privacy questions and requests: support@fanroute.in. See also our Terms of Service.