Legal

Privacy Policy

Last updated: July 2026  ·  Effective: July 2026

This Privacy Policy describes how Circlit Technologies Pvt. Ltd.("Circlit", "we", "us", or "our"), operating the platform at circlit.in, collects, uses, stores, shares, and protects your personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

Contents

01. Information We Collect

Information You Provide

• Account Information: Name, email address, phone number, and password when you create an account.
• Business Information: Company name, GSTIN, registered address, and business type for seller verification.
• Transaction Data: RFQ details, listing information, order history, and payment records.
• Communication Data: Messages, support tickets, and correspondence with our team.
• BOM Data: Bill of Materials uploaded for analysis through our BOM Intelligence tool.

Information Collected Automatically

• Device Information: Browser type, operating system, device identifiers.
• Usage Data: Pages visited, features used, search queries, and interaction patterns.
• Log Data: IP address, access timestamps, referring URLs.

02. How We Use Your Information

• To operate and maintain the Circlit platform, including marketplace, RFQ, and BOM Intelligence services.
• To verify seller identity and GST registration for trust and compliance.
• To process transactions and facilitate communication between buyers and sellers.
• To provide AI-powered component search, replacement recommendations, and BOM analysis.
• To send transactional communications (order updates, RFQ responses, deal notifications).
• To send marketing communications (only with your consent; you may opt out at any time).
• To improve our platform, detect fraud, and ensure security.
• To comply with applicable laws, including GST regulations and the DPDP Act.

03. Legal Basis for Processing

We process your personal data on the following legal grounds under the DPDP Act:

• Consent: Where you have given us explicit consent, such as for marketing communications or BOM data analysis.
• Contractual Necessity: To perform our obligations under the Terms of Service and facilitate transactions.
• Legal Obligation: To comply with applicable Indian laws, including GST filing requirements and the IT Act.
• Legitimate Uses: As permitted under the DPDP Act for purposes such as fraud prevention, platform security, and service improvement.

04. Information Sharing and Disclosure

We do not sell your personal data. We may share information with:

• Transacting Parties: Buyer/seller details necessary to complete a transaction on the Excess Exchange.
• Service Providers: Hosting (Vercel), database (Supabase), payment processing, and analytics providers who process data on our behalf under strict contractual obligations.
• Government Authorities: Where required by law, court order, or regulatory request, including GST authorities.
• Professional Advisors: Lawyers, auditors, and accountants as necessary for business operations.

05. Data Storage and Security

Your data is stored on servers operated by our infrastructure partners (Supabase / AWS). We implement industry-standard security measures including encryption in transit (TLS 1.2+), encryption at rest, access controls, and regular security audits. While we take all reasonable precautions, no internet transmission is 100% secure, and we cannot guarantee absolute security.

If your data is transferred outside India, such transfers are made in compliance with the provisions of the DPDP Act and any rules notified by the Central Government regarding permissible jurisdictions.

06. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this policy, or as required by law. Specifically:

• Account Data: Retained while your account is active and for 90 days after deletion request to allow recovery.
• Transaction Records: Retained for a minimum of 7 years as required under GST law and the Companies Act, 2013.
• Communication Logs: Retained for 180 days for dispute resolution and support purposes.
• BOM Data: Retained while your account is active; deleted within 30 days of account deletion.

07. Your Rights Under the DPDP Act

As a Data Principal under the Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable Indian law, you have the right to:

• Access: Obtain a summary of the personal data we process about you, the processing activities undertaken, and the identities of third parties with whom your data has been shared.
• Correction and Erasure: Request correction of inaccurate or incomplete personal data, updating of your data, and erasure of personal data that is no longer necessary for the purpose for which it was collected (subject to legal retention requirements, including 7-year retention of transaction records under GST law).
• Grievance Redressal: Raise a grievance regarding our handling of your personal data through our Grievance Officer (details in Section 11 below).
• Nomination: Nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.
• Withdraw Consent: Where processing is based on your consent, withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may limit your ability to use certain features (for example, Exchange participation requires GST verification).
• Opt Out of Marketing: Unsubscribe from marketing communications at any time via the link in any marketing email or by contacting us.

To exercise any of these rights, write to privacy@circlit.in from your registered email address. We will respond within 30 days for general data requests. Grievances are handled on the faster timeline described in the Grievance Redressal section below.

If you are not satisfied with our response to a grievance, you have the right to file a complaint with the Data Protection Board of India in the manner prescribed under the DPDP Act.

08. GST and Business Data

As a B2B marketplace, we collect and process business data including GSTIN, company names, and trade information. This data is used for seller verification, transaction compliance, and regulatory reporting. Business data associated with GST is retained as per statutory requirements.

By registering as a seller on Circlit Exchange, you expressly consent to the display of your GST Identification Number (GSTIN) and verified business name to prospective buyers as part of Circlit's seller verification badge system. GSTINs are business identifiers issued under the CGST Act, 2017 and are verifiable on the Government of India GST portal. If you do not wish your GSTIN to be displayed, you may not participate as a seller on the Exchange.

09. Cookies and Tracking

We use essential cookies for authentication and session management. We may also use analytics cookies (such as those from Vercel Analytics) to understand how users interact with our platform. You can control cookie preferences through your browser settings. Essential cookies cannot be disabled as they are necessary for the platform to function.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to your registered address and/or through a prominent notice on the platform. Your continued use of the platform after the effective date of any changes constitutes acceptance of the updated policy.

11. Contact Us

For questions about this Privacy Policy or our data practices: