FAQ'sNeed Help?Contact us

Privacy Policy

Home

Last updated: 6 October 2026

This policy explains how OJI Communications Private Limited ("OJI", "we", "us") collects, uses and protects personal data when you use OJI: the OJI merchant app and portal (vyapar.ojionline.in), OJI online shops (shop.ojionline.in), the OJI delivery app, and OJI on WhatsApp, Facebook and Instagram. We follow India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000 and its rules.

1. Who we are

OJI provides billing, inventory, online shop, delivery, payments and marketing tools to businesses ("merchants") in India. When you buy from a merchant through OJI, the merchant decides how your order is handled; OJI processes your data on the merchant's behalf to run the service. For data about merchants and their staff, OJI decides how it is used.

2. Data we collect

  • Account data: name, mobile number, email, business name, address, GST / PAN and KYC documents (merchants).
  • Customer and order data: name, mobile number, delivery address, items ordered, amounts, order and delivery status.
  • Payment data: payment status, amount and reference from the payment provider. Card and UPI details are entered on the payment provider's page and are not stored by OJI.
  • WhatsApp data: your WhatsApp number and name, the messages you send to OJI or a merchant on OJI, and the products or cart you send, so we can answer you and process your order.
  • Facebook / Instagram data: when a merchant connects their Page, Instagram or ad account, we receive the access they grant (for example to publish posts, run boosted posts and read their results). We do not receive your Facebook password.
  • Device and usage data: IP address, device and browser type, pages used, app errors and cookies needed for login and the shopping cart.

3. Why we use it

  • To provide the service: accounts, billing, online orders, delivery, payments, receipts and support.
  • To send you messages you expect: OTPs, order and delivery updates, payment links, and alerts merchants ask for.
  • To measure results for merchants, such as which posts or boosted ads led to orders.
  • To keep the service secure, prevent fraud and meet legal, tax and accounting duties.
  • Marketing messages are sent only where you have agreed; you can stop them at any time (see section 7).

We do not sell your personal data.

4. Who we share it with

  • The merchant you order from or who serves you.
  • Payment providers (for example mswipe) to take and confirm payments.
  • Meta (WhatsApp, Facebook, Instagram) to send and receive messages, publish posts and run ads requested by a merchant. For boosted ads, OJI may tell Meta that a purchase happened (amount, order reference and Meta's click identifier, with customer identifiers hashed) so the merchant can see results.
  • Service providers that host, send SMS / email or support OJI, only to perform those tasks for us.
  • Authorities when the law requires it.

4A. Google Ads and Google sign-in

If a merchant connects a Google account to run Google Search ads from OJI ("Sign in with Google"), OJI receives access to that merchant's Google Ads account through the Google Ads API, only with the permission the merchant gives on Google's consent screen.

  • What we access: the merchant's Google account email, the Google Ads accounts they choose, and the campaigns, budgets, keywords, ads and results (spend, clicks, calls, search terms) that OJI creates or shows for them.
  • Why: only to create, change, pause and report on the merchant's own Google ads inside OJI, and to send the merchant's own webshop orders from those ads back to their Google Ads account as conversions.
  • What we do not do: we do not sell Google data, use it for advertising of our own, share it with other merchants, or use it to train AI models. People at OJI read it only for support the merchant asks for, security, or when the law requires it.
  • Storage: the Google sign-in token is stored encrypted on OJI servers in India and is never shown in the app.
  • Removing access: the merchant can disconnect Google Ads in OJI at any time (Marketing > Google Ads > Disconnect), which pauses running ads and deletes the stored token; or remove OJI's access at myaccount.google.com/permissions. Ad results already shown in OJI are kept with the merchant's account until it is deleted (section 8).

OJI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google charges merchants directly for their ads under Google's own terms.

5. How long we keep it

We keep data while your account is active and as long as needed for the purposes above. Billing, tax and accounting records are kept for the period Indian law requires (generally 8 years). Data no longer needed is deleted or anonymised.

6. Security

Data is sent over encrypted connections. Secrets such as access tokens and payment keys are stored encrypted, and access is limited to people who need it. No system is completely secure; if a breach affects you, we will inform you and the Data Protection Board of India as the DPDP Act requires.

7. Your rights and choices

  • Access a summary of your personal data and how it is used.
  • Correct or update it.
  • Ask us to erase it (except what the law requires us to keep).
  • Withdraw consent, including for marketing messages. On WhatsApp you can also block the number or tell us to stop.
  • Nominate a person to exercise these rights on your behalf.
  • Raise a grievance with us, and if not resolved, with the Data Protection Board of India.

8. How to delete your data

Email support@ojionline.in with the subject "Delete my data" and the mobile number or email you used with OJI. We will confirm your identity and delete your data within 30 days, except records we must keep by law. Merchants can also disconnect Facebook, Instagram and ad accounts at any time in OJI (Social Shop and Boost Post), which stops OJI's access immediately; you can also remove OJI's access in your Facebook settings under Apps and websites.

9. Children

OJI is not meant for people under 18. We do not knowingly collect their data without verifiable consent of a parent or guardian. If you believe a child has given us data, contact us and we will delete it.

10. Cookies

We use cookies and similar storage needed to keep you logged in, keep your cart and remember choices such as language. You can block cookies in your browser, but parts of OJI may then not work.

11. Changes

We may update this policy. The new version will be posted here with its date; important changes will also be announced in OJI.

12. Contact and grievance officer

OJI Communications Private Limited, India.
Grievance Officer / privacy questions: support@ojionline.in.
We acknowledge grievances within 48 hours and aim to resolve them within 30 days.