This Privacy Policy explains what personal data we collect when you use StanShop, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. It applies to the StanShop storefront at www.stanshop.co, to StanShop inside the STAN mobile application, and to any other channel we designate ("StanShop" or the "Platform"). It is a companion to the StanShop Terms and Conditions ("Terms") for your storefront and uses the same defined words: "Products", "Brands", "Codes", "Orders" and "Delivery" mean what they mean in the Terms.

If you use StanShop inside the STAN app, the STAN Privacy Policy at https://getstan.app/privacy-policy governs the app itself. This Policy prevails on any matter concerning a StanShop purchase.

By using StanShop you acknowledge that we process your personal data as described here. Where the law requires your consent for a particular use, we ask for it separately and you may withdraw it at any time (see Section 9).

1. Who is responsible for your data

StanShop is operated by two companies. The storefront you buy on decides which company is the controller (in India, the "data fiduciary") of your personal data and which law applies. Both companies are part of the STAN group and may share personal data with each other as described in Section 5.

2. What we collect

Account and identity data. Name, username, email address, mobile number, date of birth or age confirmation, country and, where you sign in with your STAN account, your STAN account identifier and profile details.

Order and payment data. Products ordered, denomination, region and platform, delivery email or number, amount paid, currency, payment method and the payment identifiers our processors return, such as a transaction reference and the last four digits of a card. We do not store full card numbers, CVVs, UPI PINs or private keys; payments are processed by third-party payment service providers under their own terms. For cryptocurrency payments we record the wallet address, asset, network, transaction hash and confirmation status.

Verification data. When we ask you to verify your identity, age, phone, email, payment method, wallet or address (Terms, Section 2), we collect what you submit — which may include government-issued identification, a selfie or liveness check, and, in India, records retrieved through DigiLocker or a similar provider — together with the result returned by the verification provider.

Device and technical data. IP address, device type and identifiers, device fingerprint and risk signals (for example whether an emulator, cloned or modified app, VPN or rooted device is detected), operating system, browser, language, screen resolution, app version, approximate location derived from IP, referring site and pages viewed, and the date and time of each request.

Delivery and redemption data. Whether, when and to which address a Code was sent, whether the email was delivered or opened, whether the Code was revealed in your Order history, and any redemption confirmation a Brand or supplier gives us. See Section 10 for how redemption information is treated.

Communications. Messages you send us by email, live chat or in-app support, verification requests and our replies, and grievances.

Data from third parties. Payment providers, banks and card networks (for example dispute and chargeback notices, and risk or fraud indicators), verification providers, fraud-prevention and blockchain-analytics services, Brands and suppliers, and public sanctions and restricted-party lists.

3. Why we use it

• To provide the service: create and manage your account, process Orders and payments, deliver Codes, provide support and handle refund and replacement claims.
• To keep StanShop safe: detect and prevent fraud, unauthorised payments, money laundering, sanctions breaches, bot activity, account sharing and reward abuse; decide whether to hold, review, verify or decline an Order; and defend chargebacks and payment disputes with our records of authentication, Delivery and redemption.
• To comply with law: identity verification and anti-money-laundering requirements, tax and accounting records, sanctions screening, and lawful requests from regulators, courts and law enforcement.
• To operate and improve StanShop: measure how the Platform is used, fix errors, test features, run surveys and analytics, and understand which Products and promotions work.
• To communicate with you: order confirmations, Codes, verification requests, service notices and changes to our Terms and policies; and, subject to your preferences and applicable law, promotional messages.
• For corporate transactions: to allow a prospective buyer, investor or lender to evaluate the business, under confidentiality obligations.

We do not sell personal data, and we do not use it for automated decisions with legal or similarly significant effects except fraud and risk screening, which may hold, review or decline an Order. You can ask for human review of such a decision through Section 9.

4. Legal basis

Where the law requires a legal basis, we rely on: performance of our contract with you (account, Orders, delivery, support, refunds); our legitimate interests, or in India the legitimate uses permitted by law, in preventing fraud and abuse, securing the Platform, defending disputes and improving the service; compliance with legal obligations; and your consent, where we ask for it — for example for non-essential cookies, marketing messages or an identity check that the law requires consent for.

5. Who we share it with

Within the STAN group. Stanverse Technologies Pvt Ltd and Getstan Technologies Pte. Ltd. share account, order, device and risk data with each other and with other group companies, in India, Singapore and elsewhere, to operate StanShop across storefronts and to prevent fraud across the group.

Payment and finance partners. Payment gateways and processors, crypto payment processors, banks, card networks and wallet providers, to process payments, refunds and disputes.

Verification and fraud-prevention providers. Identity and KYC verification services, device-fingerprinting and fraud-scoring services, sanctions-screening and blockchain-analytics providers.

Brands and suppliers. To fulfil Orders and to confirm whether a Code was valid or redeemed when you make a claim or when a chargeback is raised.

Service providers. Cloud hosting, email and SMS delivery, customer-support tools, analytics and advertising services, acting on our instructions under contract.

Legal and safety. Regulators, courts, law enforcement and cybercrime authorities where the law requires it or where we reasonably believe disclosure is necessary to investigate fraud, protect our rights, or protect the safety of others. Where a transaction is reported as fraudulent, unauthorised or linked to cybercrime, we provide audit trails, IP logs, device identifiers, communications and redemption timestamps to investigating authorities in accordance with applicable law. We notify you of a request for your data where the law allows us to.

Corporate transactions. A buyer or successor in a merger, acquisition, financing or sale of assets, who must protect the data under this Policy.

Professional advisers. Auditors, accountants, lawyers and insurers, under confidentiality obligations.

6. International transfers

StanShop is operated from India and Singapore and uses service providers in other countries, including the United States. Your personal data may therefore be transferred to, stored in and accessed from countries other than the one you live in. Where we transfer data across borders we do so in accordance with the law of your storefront (Section 12) and this Policy, and we require recipients to protect it to an equivalent standard.

7. How long we keep it

• Account data for as long as your account is open and for a limited period after closure to resolve disputes and meet legal obligations.
• Order, payment, delivery, device and verification records for as long as needed to defend claims, chargebacks and disputes — which may be several years after a purchase, since card-network rules allow a dispute to be raised long after the Order and require us to show a history of undisputed transactions.
• Tax, accounting and anti-money-laundering records for the period the law of your storefront requires.
• Fraud and abuse records for as long as needed to prevent repeat fraud, including after an account is closed.
• Support communications for as long as needed to resolve the matter and for a limited period afterwards.

When data is no longer needed we delete it or anonymise it so that it no longer identifies you.

8. Security

We use administrative, technical and physical safeguards appropriate to the risk, including encryption of data in transit, access controls limited to authorised staff, logging and alerting, and staff training. No system is completely secure, and we cannot guarantee that data you send us over the internet will not be intercepted. You are responsible for keeping your account credentials and your Codes confidential; if you believe your account has been accessed without authority, tell us promptly at [email protected].

9. Your rights and choices

Subject to the law of your storefront (see Section 13), you may ask us to:

• confirm whether we hold personal data about you and give you access to it, or a copy of it;
• correct data that is inaccurate or incomplete;
• delete your data, or close your account, where we no longer need to keep it — we may retain what the law or an open dispute requires;
• stop sending you marketing messages, at any time, by using the unsubscribe link or writing to us; service messages about your Orders will continue;
• withdraw a consent you have given — this does not affect processing before withdrawal, and we may then be unable to provide the service that depended on it;
• review a decision made by our automated fraud screening;
• nominate a person to exercise your rights if you die or become incapacitated, where the law provides for this.

Send requests to [email protected] from the email address on your account. We may need to verify your identity before acting. We respond within the time the applicable law allows. If you are not satisfied, you may use the grievance process in Section 14 or contact the authority for your storefront listed in Section 13.

10. Cookies, analytics and advertising

We and our service providers use cookies, pixels, SDKs, local storage and similar technologies ("cookies") on StanShop. Some are essential for the Platform to work — keeping you signed in, remembering your cart and language, protecting against fraud and abuse. Others are used, with your consent where the law requires it, to measure how StanShop is used and to show you relevant offers. The tools we use include:

• Google Analytics to understand how visitors reach and use StanShop. Google collects usage and device data under its own privacy policy. You can opt out by installing the Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout.
• Google Ads remarketing to show StanShop advertisements on Google and its partner sites to people who have visited StanShop. Google uses cookies to serve these ads based on past visits. You can opt out of personalised advertising in Google's Ads Settings at https://adssettings.google.com or through the Network Advertising Initiative opt-out page.
• HubSpot to manage our communications with you, including support and marketing emails, and to measure how you interact with them.
• Segment to collect analytics events from StanShop and route them to the tools above.

Interest-based advertising. Advertisers and advertising networks may use cookies and similar technologies on StanShop and on other sites to serve advertisements based on your browsing history. As a result an advertiser may infer that you belong to a group of users with particular interests. These third parties collect and use data under their own privacy policies, which we do not control and this Policy does not cover.

Your choices. You can control cookies in your browser or device settings, including deleting existing cookies and blocking new ones; if you do, some parts of StanShop may not work. On mobile you can limit ad tracking through your device's advertising settings. Where we show a cookie banner you can change your choices at any time from the settings it links to. Residents of US states with an opt-out right for targeted advertising may also exercise it through Section 9.

Links to other sites. StanShop may contain links to Brand and other third-party websites. Their privacy practices are their own and are not covered by this Policy; read their policies before providing personal data.

11. Redemption information

Information about the redemption of a Code — whether, when, where or by whom it was redeemed, and any account, device, network, wallet or location identifiers associated with the redemption — is personal data of the person who redeemed it. It is held by the Brand and/or by us. We do not disclose it to any User, purchaser, recipient or other third party, including in response to a claim that a Code was lost, stolen, shared or used without permission. It may be disclosed only to law enforcement, courts and regulators under a valid legal process, or as the law otherwise requires. If you believe a Code has been stolen or misused, report it to your local law enforcement agency (in India, the National Cyber Crime Reporting Portal at cybercrime.gov.in; in the United States, the FBI Internet Crime Complaint Center at ic3.gov); we will cooperate with the investigating authority. We may rely on redemption information ourselves, with Brands, and in chargeback and dispute proceedings to establish Delivery and redemption.

12. Children

StanShop is intended for adults. If you are under 18, or otherwise not legally capable of entering into a contract, you may use StanShop only under the supervision of a parent or legal guardian who accepts the Terms and is responsible for the account; we then process the minor's data on that basis and with the guardian's consent. We do not knowingly create an account for, or take an Order from, a minor without a responsible adult. If you believe a child has provided us personal data without a guardian's involvement, contact us at [email protected] and we will delete it.

13. Region-specific terms

13A. StanShop India

The data fiduciary for the India storefront is Stanverse Technologies Pvt Ltd (Section 1). This Policy is an electronic record under the Information Technology Act, 2000 and is published in accordance with the Information Technology Act, its rules, and the Digital Personal Data Protection Act, 2023 and rules made under it, as in force from time to time. It does not require a physical or digital signature.

In addition to Section 9, you have the rights the Digital Personal Data Protection Act gives you: to access a summary of the personal data we process and the persons we have shared it with, to correction, completion, updating and erasure, to grievance redressal, and to nominate another person to exercise your rights. Where we process your data on the basis of consent you may withdraw it as easily as you gave it. Personal data may be transferred outside India for the purposes in this Policy except to any country the Government of India has restricted by notification.

Our Grievance Officer for the India storefront is at Stanverse Technologies Pvt Ltd, HSR Layout, Bengaluru (address in Section 1), email [email protected]. If your grievance is not resolved to your satisfaction, you may approach the Data Protection Board of India. Indian law governs this Policy for the India storefront and the courts at Bengaluru have jurisdiction, subject to any mandatory forum the law gives you.

13B. StanShop Global

The controller for the Global storefront (the United States and all countries other than India) is Getstan Technologies Pte. Ltd., Singapore (Section 1), which processes personal data in accordance with the Singapore Personal Data Protection Act 2012. This Policy is governed by the laws of Singapore and disputes are resolved under Section 19 of the Global Terms, except that if you live in a jurisdiction whose law gives you mandatory privacy protections, those protections continue to apply.

United States residents. We do not sell personal data or share it for cross-context behavioural advertising in exchange for money. Depending on your state (including California, Colorado, Connecticut, Virginia, Texas and others with comprehensive privacy laws), you may have the right to know what personal data we collect, use and disclose; to access and obtain a portable copy; to correct inaccurate data; to delete data; to opt out of the sale of personal data, targeted advertising and profiling with significant effects; and not to be discriminated against for exercising these rights. You may exercise them through Section 9 and may appeal a refusal by writing to [email protected] with "Privacy appeal" in the subject line. An authorised agent may act for you if they show your written permission and we can verify your identity. The categories we collect are set out in Section 2, the purposes in Section 3, the recipients in Section 5 and retention in Section 7. Under California Civil Code §1798.83 (the "Shine the Light" law) you may request information about disclosures to third parties for their direct marketing; we make no such disclosures.

European Economic Area, United Kingdom and Switzerland. If you use StanShop from these regions you have the rights in Section 9 and the right to lodge a complaint with your local data protection authority. The legal bases in Section 4 apply, and transfers out of your region are made under recognised safeguards such as standard contractual clauses.

Sanctioned territories. We screen accounts and Orders against sanctions lists of Singapore, the United States, the United Nations, the European Union and the United Kingdom and may block or cancel Orders connected to restricted territories (Terms, Section 2).

14. Grievances and contact

For questions about this Policy or your personal data, write to [email protected] or use in-app live chat. If your privacy concern is not resolved, you may contact our Nodal Officer at [email protected]

We acknowledge a grievance within 48 working hours and resolve it within 15 days of receipt, or sooner where the law requires. We may ask you for more information; a prompt reply avoids delay. These timelines match Section 17 of the Terms.

15. Changes to this Policy

We may update this Policy from time to time. We give notice of material changes by email, in-app message or a notice on the Platform before they take effect, and where the law requires it we ask for your consent. Your continued use of StanShop after a change takes effect means you accept the updated Policy.