Privacy policy

1. Who we are

Smargent is a product of Big Ark Consulting Pvt. Ltd., a private limited company incorporated in India (CIN U72900KA2021PTC154067), with its registered office at 245, 3rd Main, 3rd Cross, 2nd Block, Thyagaraj Nagar, Bengaluru 560070, Karnataka, India ("we", "us"). Smargent is software and a service for businesses that sell online on several channels ("sellers"): it runs their catalog, orders, stock, purchasing, payouts, margin and tax, and our operations team in India can do that work for them.

Smargent is for businesses. We don't offer it to consumers.

2. Our role for each kind of data

• Data in a seller's account, including their buyers' orders and details: the seller decides why and how it is used. We process it only on the seller's behalf and on their instructions, as their processor (a "data processor" under India's Digital Personal Data Protection Act, 2023, and a "service provider" under US state privacy laws such as the California Consumer Privacy Act). If you bought from one of our sellers, that seller is responsible for your data; contact them first, and we will help them answer you.
• Data about our own customers and contacts (the people who sign up, the sellers we talk to, people who email us): we decide how it is used, as a "data fiduciary" under the DPDP Act and a "business" under US state laws.

3. What we collect

From the people who use Smargent

• Account details: name, email address, the businesses you belong to and your role in each. Passwords are kept only as one-way hashes.
• What you do in Smargent: the changes you make and approve, which go into each business's audit log.
• Messages you send us, by email or otherwise.

From the seller's business and channels

• Business records: products, prices, costs, stock, suppliers, purchase orders, payouts, bank statement lines the seller uploads, tax registrations (such as GSTIN or EIN) and business addresses.
• Orders from the channels the seller connects or uploads, including buyers' personal data: name, shipping and billing address, phone and email (marketplaces such as Amazon often give a masked email), what they bought and what they paid.
• Access tokens for the channels the seller connects, which we keep encrypted.

Technical data

• Server logs: the time, the page or API route, the result and how long it took, and the network address our host sees. Logs don't contain products, prices, customers or other seller data.
• A session cookie when you sign in to the application, needed to keep you signed in. We use no advertising or analytics cookies.

4. How we use it

We use personal data only to provide Smargent to the seller and to run our own business, and only for these purposes:

• To run the seller's operations: list products, take and fulfil orders, print packing slips and labels, handle returns, issue tax invoices and credit notes, match payouts, keep stock right and prepare accounting files.
• To provide support and our operations service, following the seller's written procedures and approval rules.
• To keep Smargent secure, find and fix problems, and prevent fraud and abuse.
• To meet legal duties, such as keeping tax records.
• To run our relationship with our customers: accounts, billing and messages about the service.

We do not sell personal data, and we do not share it for advertising. We do not use a seller's or buyer's data to market to buyers, to build profiles of buyers across sellers, or to train AI models. We do not combine one seller's data with another's.

5. Amazon, Shopify and other channels

When a seller connects a channel, we receive data under that channel's terms as well as this policy, and we follow the stricter rule.

Amazon

• We use data from Amazon's Selling Partner API only for the seller's own operations (orders, shipping, tax and accounting, inventory and listings), as Amazon's Acceptable Use Policy and Data Protection Policy allow.
• We keep Amazon buyers' personal data no longer than 30 days after the order is delivered, and only for as long as it is needed to fulfil, ship, return, or meet tax and legal duties. After that the buyer's name, address, phone and email are removed from the order.
• We don't use Amazon buyers' data to contact them outside Amazon, to market to them, or to build profiles that join them with buyers from other channels.
• Amazon data is encrypted in transit and at rest, and only people who need it for the seller's work can see it.

Shopify

• We use store data only to provide Smargent to that store's owner, under Shopify's API terms.
• We honour Shopify's privacy requests: when a buyer asks a store for their data, we record the request for the seller with the orders it covers; when a buyer or a store asks to be erased, we erase what we hold about them, except tax records the law requires.
• When a store uninstalls Smargent, we stop reading it and delete its access token.

Other channels

We use data from other marketplaces and stores (for example Walmart, eBay, Etsy, TikTok Shop and WooCommerce) the same way: only for the seller's operations, under that channel's terms.

6. AI and agents

Smargent uses AI agents to check listings, plan reorders, match payouts, sort returns and write summaries. They propose changes; a person approves them. The agents send the AI model only what the task needs, and never buyers' names, addresses, phones or emails. We use Anthropic's commercial API, whose terms do not allow Anthropic to train its models on what we send.

7. Who we share it with

We share personal data only with these service providers ("sub-processors"), under contracts that require them to protect it and use it only to serve us:

We tell our customers before we add or replace a sub-processor. We also share data:

• with the channels and services a seller connects, when the seller tells Smargent to (for example, sending stock to their store);
• with our own staff and contractors in India who run operations for that seller, under confidentiality duties, and only for businesses they are assigned to;
• when the law requires it, for example a valid court order, and we tell the seller first unless the law forbids it;
• if our business is sold or merged, with the buyer, under this policy.

8. Where it is stored

Smargent's data is stored in the United States. Our team in India works on it from India. Moving data between India and the United States is allowed under the DPDP Act; if either country's law changes, we will follow it, and we may offer storage in India where a seller needs it.

9. How long we keep it

• Buyers' personal data on orders: 30 days after delivery for Amazon orders, without exception. For other channels, 30 days by default; a seller can choose to keep their own store's buyers longer, for as long as they need for returns, warranty and customer service. After that, the name, street address, phone and email are removed; the city, state, country and order totals stay as an anonymous sales record.
• Tax invoices and credit notes: as long as tax law requires (in India, at least the period set by the GST law and the Companies Act).
• A seller's business records: while their account is open. When it closes, we give the seller 30 days to export their data, then delete it within the following 30 days, except what the law makes us keep.
• Accounts of people who use Smargent: while they belong to a business, then removed with the business's data.
• Server logs: a short period set by our host, and they contain no seller or buyer data.

10. How we protect it

Each business's data is walled off in the database itself; channel tokens are encrypted; buyers' contact details are shown only to roles that need them; every change is in an audit log; data is encrypted in transit and at rest. Our security page describes each of these. Our staff see a seller's data only while they are assigned to that seller, and their access is removed when they leave.

11. If something goes wrong

If we find that personal data has been or may have been accessed, changed or lost without permission, we will:

• tell each affected seller within 24 hours of finding it, with what we know and what we are doing;
• tell Amazon within 24 hours where Amazon data is involved, and other channels as their terms require;
• report to CERT-In within the time Indian law sets, and to the Data Protection Board of India and affected people as the DPDP Act requires;
• help the seller with any notice they must give their buyers or regulators.

12. Your rights

Everyone

You can ask us what personal data we hold about you, ask us to correct it or delete it, and complain to us. Email hello@smargent.app. We may need to check who you are first. If the data is in a seller's account, we will pass your request to that seller and help them answer.

India (Digital Personal Data Protection Act, 2023)

You have the right to information about how your data is processed, to correct, complete, update and erase it, to withdraw consent where we rely on it, to nominate someone to act for you, and to have a grievance resolved. Our grievance officer is Stephen Dias, at hello@smargent.app. We will answer within the time the law sets. If you are not satisfied, you can complain to the Data Protection Board of India.

United States (California and other states)

Depending on where you live, you can ask to know what personal information we collected about you and why, to get a copy, to correct it and to delete it. We do not sell personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of. We won't treat you differently for using these rights. You can use an authorised agent. In the last 12 months, the categories we collected are those in section 3, for the purposes in section 4, shared only as in section 7.

13. This website

This website sets no cookies, runs no scripts and uses no analytics or tracking. Our host keeps standard request logs (network address, time, page) to run and protect the site. If you email us, we use your message only to reply and to follow up on what you asked about.

14. Children

Smargent is for businesses and is not meant for anyone under 18. We don't knowingly collect children's data for our own purposes. Sellers must not use Smargent to process children's data in ways the law doesn't allow.

15. Changes and contact

If we change this policy, we will post the new version here with its date and tell our customers by email before a change that affects them takes effect.

Questions or requests: hello@smargent.app, or write to Big Ark Consulting Pvt. Ltd., 245, 3rd Main, 3rd Cross, 2nd Block, Thyagaraj Nagar, Bengaluru 560070, Karnataka, India.