Post Maze

Privacy Policy

Last updated: October 21, 2026

1. Introduction

Post Maze ("Post Maze", "we", "us", "our") operates a B2B wholesale marketplace connecting Indian suppliers with buyers. This Privacy Policy describes, system by system, what personal and business data we collect across registration, identity verification, account security (OTP), Requests for Quotation (RFQs), supplier quotations, product listings, saved/wishlist offers, company banking & shipping details, category requests, the freight calculator, support tickets, and notifications; the purpose and legal basis for processing each category; how long we keep it; who it is shared with; and the rights you have over it.

It applies to every visitor, registered Buyer, registered Supplier, and Admin of the platform. We are a company incorporated in India, and this policy is drafted with reference to the Information Technology Act, 2000 and its rules, and the Digital Personal Data Protection Act, 2023 ("DPDP Act"). Section 14 explains cross-border transfers and additional rights for visitors outside India (e.g., the EEA/UK).

2. Account & Identity Data

  • Core profile: full name, email address, phone number (with country/dial code), designation, hashed password, and avatar/profile photo. Your role (Buyer, Supplier, or Admin) determines which features and navigation you see.
  • Identifiers: every account has an internal UUID (`users.id`) and, where relevant, a separate public identifier used in URLs — your internal database key is never exposed directly.
  • Email verification: standard registration, and registration via Google SSO, both require a one-time passcode (OTP) emailed to the address being registered, recorded with an expiry and a used/unused flag, before the account is created.
  • Phone verification: if you verify a phone number, we generate and store a short-lived OTP against that phone number (with expiry and used flag) to confirm you control it. Delivery of phone OTPs by SMS is part of our phone-verification feature; where SMS delivery is not yet enabled in your environment, the OTP flow is not exposed to end users.
  • Password reset: requesting a password reset creates a single-use, time-limited reset token tied to your account; it is invalidated after use or expiry.
  • Google SSO: when you sign in with Google, we receive your name, email, and profile picture from Google's identity token and store the picture as your avatar. We never receive or store your Google password.

3. Company Profile & Business Data (Suppliers)

  • Public company profile: company/trade name, industry, description, country, city, address, logo, banner, established year, employee count, annual turnover, social links, trading areas, and export history (countries served). This is shown publicly on your company detail page and in marketplace listings.
  • Verification documents: GST certificates, PAN cards, business licenses, and other supporting documents, each stored with a document type, file path, and a review status (pending / verified / rejected). These are visible only to Admins through the restricted verification queue and document viewer — never through a public endpoint.
  • Banking & payout details (sensitive): if you complete the Payment & Shipping tab, we store account holder name, bank name, bank account number, IFSC code, and/or UPI ID. This is financial information we treat as sensitive: it is used only to display your declared payment methods to prospective buyers and is never used by Post Maze to move money on your behalf, as the platform does not process payments. Do not enter banking details you are not comfortable being associated with your public supplier profile's payment-method display, and treat any request from a counterparty to change these details outside the platform with caution.
  • Shipping & logistics preferences: pickup address, shipping locations, average lead time, delivery/shipping terms, and declared ports of shipment.
  • Company strengths & media: free-text capability highlights and uploaded media (images/documents) used to showcase your company on your public profile.
  • Category watchlist: the categories you follow, which directly drives which RFQs you are matched against.
  • Category requests: if you ask us to add a new category or sub-category, we record the requested name, your reason, its review status, and any admin note explaining approval or rejection.

4. RFQs, Quotations & Products

  • RFQs (Buyers): title, description, category, quantity, unit, budget range, deadline, status (open/closed/awarded), and an optional link to a specific product. Buyers can edit, archive, or delete their own RFQs.
  • Quotations (Suppliers): price, message/terms, validity date, and status (pending/accepted/rejected/withdrawn) against a specific RFQ. A supplier may hold only one active quotation per RFQ.
  • Product listings: title, HS code, description, country of origin, brand name, pricing model (fixed/range/volume), unit price, minimum order quantity, sample price, production capacity/lead time, plus associated images, certificates (name, number, issuing body, validity dates), and specifications (name/value pairs). Every listing carries a moderation status (pending/published), and — where rejected or later removed — a rejection reason and the identity of the reviewing admin.
  • Saved offers / wishlists (Buyers): if you save products or supplier offers into a named list, we store the list name and its contents against your account, purely so you can retrieve them later; this data is private to your account and is not shared with the suppliers whose listings you save.

5. Trust & Safety: Reports and Rate Limiting

  • User reports: if you report another user, we record the reporter, the reported account, a reason category (spam, fraud, abuse, fake listing, or other), free-text details, and the resulting status (open/resolved/dismissed), including any resolution note and the admin who closed it. Only one open report per reporter/target pair is kept at a time.
  • Spam/abuse protection: login, registration, password reset, product creation, and report submission are rate-limited using short-lived, in-memory counters keyed to your IP/account; this data exists only to throttle abusive request patterns and is not retained as a historical profile.

6. Help & Support Tickets

If you contact support through the platform's ticketing system, we collect and store:

  • A ticket number, subject, category, priority, and status (new / in progress / on hold / waiting for you / resolved / closed), together with any related RFQ, product, or report your ticket references.
  • The full message thread between you and our support team. Internal notes admins add to a ticket for their own coordination are never shown to you and are excluded from any export of your ticket history.
  • Any files you attach to a support message (stored name, original filename, file type, and size) — attachments inherit the same visibility as the message they belong to, so an attachment on an internal note is never visible to you.
  • Timestamps for first response, resolution, closure, and any reopening, used to measure and improve our support quality — not shared outside the support team.

7. Notifications & Communication Preferences

  • In-app notifications: a running list of alerts tied to your account (e.g., a ticket update, an RFQ match, a quotation response), each with a type, title, optional body text, an optional in-app link, and a read/unread marker.
  • Preference settings: for each category — Sourcing, Messages, Orders, Payments, Promotions, Security, and Support — you can independently choose whether to receive alerts In-App, by Email, or by SMS, plus an overall email frequency. We only contact you about a category through a channel you have enabled for it, except for core security notices (e.g., password changes) which are sent regardless of preference because they protect your account.
  • Freight price-change alerts: the buyer settings include a toggle for "freight price change updates." This preference is currently stored for your account but has no live trigger behind it yet — enabling it does not currently generate any notification, as this is tied to a future shipping/freight-alerts module.

8. Freight Calculator Usage

If you use the Instant Freight Calculator (FCL, LCL, Air Freight, Express Courier), we process the origin/destination ports, ICDs, dry ports, or city/airport hubs you select, cargo parameters (chargeable/volumetric weight, CBM, container type), and selected add-ons (insurance, customs clearance, door pickup/delivery). Each calculation is logged with the computed total and the underlying trade-lane, surcharge, and FX data used, for analytics, abuse prevention, and periodic recalibration against market benchmarks (Drewry WCI, FBX, IATA TAC). If you are not signed in, this data is not linked to any personal identity.

9. Uploaded Files & Where They Live

Avatars, company logos/banners, company and support-ticket documents, product images/certificates, and verification documents are stored on Cloudflare R2 (preferred, zero-egress), AWS S3, or local disk storage depending on how the deployment is configured, and served over HTTPS via unique, non-guessable paths. Files are never renamed to the name you originally uploaded them under when stored — the original filename is kept only as metadata — which prevents path-based attacks and accidental overwrites. Files tied to a private record (verification documents, support attachments on internal notes, banking details) are never exposed through a public route.

10. Administrative Audit Trail

Actions administrators take — approving/rejecting/blocking a user, approving/rejecting/removing a product, removing an RFQ, resolving/dismissing a report, granting/revoking a Verified badge, assigning or closing a support ticket — are logged with the admin's identity, the action, the affected record, and a timestamp. This log exists purely for accountability and dispute resolution and is visible only to authorized administrators.

11. Legal Basis for Processing

  • Performance of a contract: account creation and delivery of the core marketplace, RFQ, quotation, product, and support features you sign up to use.
  • Consent: SSO login, SMS/phone verification, and promotional notifications — all revocable at any time via your settings.
  • Legitimate interests: fraud prevention, rate limiting, platform security, service analytics, and freight-pricing calibration.
  • Legal obligation: record-keeping under Indian tax, company, and consumer-protection law, and responding to lawful requests from authorities.

No decision with legal or similarly significant effect (verification approval, product moderation, report resolution, account suspension) is made by an automated system without a human administrator in the loop.

12. How Your Data Is Shared

  • Public marketplace: your company profile, published product listings, declared payment methods, shipping terms, and Verified status (if granted) are visible to the public and to other registered users browsing the marketplace.
  • Buyer–Supplier interactions: an RFQ's details and attachments are visible to every supplier following the matching category, not only to the one you transact with; a buyer sees every quotation submitted against their RFQ.
  • Administrators: access account, verification, banking/shipping, product, RFQ, report, and support-ticket data strictly to moderate the platform and resolve issues, with every action logged (Section 10).
  • Sub-processors: Cloudflare R2 or AWS S3 (file storage) and our SMTP provider (transactional email, currently via Hostinger) process data on our instructions only, under confidentiality obligations, and receive only what is needed to perform their function.
  • Legal/safety disclosures: we may disclose data where required by law or valid legal process, or to protect the rights, property, or safety of Post Maze, our users, or the public.
  • Business transfers: if Post Maze undergoes a merger, acquisition, or asset sale, data may transfer as part of that transaction under equivalent privacy protections.
  • We do not sell personal data, and we never share verification documents or banking details with anyone other than you and authorized administrators.

13. Cookies, Local Storage & Sessions

We do not use third-party advertising or tracking cookies. Your browser's local storage is used to keep you signed in and to remember basic interface preferences such as a collapsed sidebar. Clearing your browser storage signs you out and resets saved UI preferences. If analytics or advertising cookies are introduced later, this section will be updated and consent requested where the law requires it.

14. International Data Transfers

Infrastructure such as Cloudflare R2 or AWS S3 may store data in regions outside India depending on configuration. Where data crosses borders, we rely on providers offering contractual data-protection commitments consistent with this Policy. If you access Post Maze from the EEA/UK, you additionally have GDPR rights (access, rectification, erasure, restriction, portability, and objection) exercised the same way as described in Section 16.

15. Data Retention

We keep account, company, banking, RFQ, quotation, product, report, support-ticket, and freight-calculation data for as long as your account is active, and afterward for as long as needed to meet legal, accounting, tax, or dispute-resolution obligations — generally up to seven years for financial/transaction-adjacent records, consistent with Indian record-keeping norms, unless a shorter period is legally required. Deleted categories, products, RFQs, documents, support tickets, and accounts are soft-deleted (a `deleted_at` timestamp is set) and excluded from every public and user-facing view rather than being instantly purged, so that linked records (e.g., a quotation against a removed RFQ) stay consistent. OTP records (email, phone, registration) expire and are superseded automatically and are never reused once consumed.

16. Your Rights

Subject to applicable law (the DPDP Act, 2023 in India, and GDPR where it applies to you), you may:

  • Access a copy of the personal data we hold about you.
  • Correct inaccurate data — most profile, company, banking, and shipping fields can also be edited directly from your account/company settings.
  • Erase your data, subject to the retention obligations in Section 15.
  • Export your data in a portable format.
  • Object to or restrict certain processing, and withdraw consent for SSO, phone verification, or promotional/SMS communications at any time via your notification settings.
  • Raise a grievance with our Grievance Officer (Section 17) or your local data protection authority.

To exercise these rights, please contact us. We may verify your identity before fulfilling a request, to prevent unauthorized access to your data.

17. Grievance Officer

In accordance with the Information Technology Act, 2000 and rules made thereunder, Post Maze has designated a Grievance Officer to address complaints about the processing of your personal data. Raise a grievance via our contact page, marked "Privacy Grievance," and we will acknowledge and address it within the timelines prescribed by law.

18. Data Security & Breach Notification

Passwords are hashed and salted and never recoverable in plain text. Sessions use JSON Web Tokens (JWT) with a defined expiry. Verification documents, banking details, and internal support notes are gated behind authenticated, role-checked endpoints and are never exposed via public routes. All file uploads are served over HTTPS. No system is completely secure; if we become aware of a breach that poses a meaningful risk to your rights, we will notify affected users and, where legally required, the relevant supervisory authority, without undue delay.

19. Children's Privacy

Post Maze is a B2B platform for business use and is not directed at individuals under 18. We do not knowingly collect data from minors, and will delete any such data promptly if discovered.

20. Changes to This Policy

We update this Policy as the platform evolves — for example, as in-platform messaging, online payments, SMS delivery, or additional SSO providers go live — or as applicable law changes. The "Last updated" date above reflects the latest revision; material changes are announced on the platform or by email before they take effect.

21. Contact Us

If you have any questions about this Privacy Policy, or wish to exercise any right in Section 16, please contact us.