Draft for legal review · Version 2026-09-01-draft-1
This notice explains personal-data use on Mobiussphere. It is not a government approval or a promise of absolute security. Company/contact details below are supplied by the operator and require legal verification.
What we collect and why
- Account: name, email, phone, password hash, login/session and security events to create, authenticate and protect your account. Google sign-in shares verified account identity through Supabase if you choose that option. We do not ask for your Google password.
- Delivery and purchase: recipient name, contact number, address, items, order history, payment identifiers/status, vouchers and wallet activity to fulfil orders, provide support, prevent fraud and meet applicable recordkeeping duties. Payment credentials are entered with the payment provider; do not send card numbers/CVV to our support or rights forms.
- Recovery: email and short-lived verification challenge records to verify registration or reset your password. OTPs are transactional, not marketing consent.
- Optional purposes: promotional email, analytics and precise location are separate choices. You may decline them and still shop. Location lookup shares coordinates with the lookup providers only after permission; manual address entry remains available.
- Support and rights: account identifier and the request you submit, to answer it and verify ownership. Never include passwords, OTPs, Aadhaar/passport copies or complete payment credentials.
- Browser data: cart, selected address, session token, language/currency and privacy choices can be stored on this device. Product reviews/photos in the current implementation are device-local, not a published review service. Avoid shared devices and clear saved addresses using Privacy controls.
Service providers and disclosures
Hosting: Hostinger. Database and selected authentication: Supabase/PostgreSQL and Google. Payments: Razorpay and, where chosen, crypto payment networks; public blockchain transactions cannot be erased by MobiusSphere. Transactional email: Resend (or configured Hostinger SMTP). Fulfilment: the seller and courier assigned to your order, including China–India shipments. Selected location lookup: OpenStreetMap Nominatim and BigDataCloud. Some product imagery/media is fetched from third-party CDNs such as Unsplash, which receive connection information. Optional tracker scripts, if configured, require a separate analytics/marketing choice. No analytics provider has been approved in this compliance build.
Only information needed for the selected service should be disclosed. Vendor locations, subprocessors, contracts and any transfer restrictions must be verified by the operator and counsel before launch. We do not promise all data stays in India. Automatic online translation of page contents is disabled in this build to avoid sending personal text to a translation vendor.
Retention and deletion
Account and saved-address data is used while needed for your chosen service. You can request correction or erasure and withdraw optional consent. Order, payment, security and dispute records may need restricted retention after closure for applicable legal duties. Consent receipts and rights case history are retained only as needed to demonstrate choices and handle requests. Expired OTPs cannot be used after 10 minutes; expiry does not itself erase the database row.
Operator review required: a category-specific retention schedule, processor deletion, backup expiry and enforcement jobs are not yet approved. Counsel must reconcile DPDP Rules 6/8, tax/payment/dispute retention and deletion rights. This page does not falsely promise immediate deletion or a purge job that is not running. Browser privacy choices expire after 180 days; local receipt history is limited to 100 entries and contains no form data.
Your choices and rights
Use to withdraw optional permissions or clear device addresses. Use Data rights requests for access information, correction, erasure, withdrawal of service consent, nomination or a grievance. Signing in establishes the account associated with a request; further proportionate verification may be needed before releasing or deleting data. If you cannot sign in, email the contact below from your registered email—do not create a new account just to exercise rights.
Withdrawal does not undo prior lawful processing. If you withdraw a purpose necessary to provide an ongoing service, we will explain the effect and any required legal retention. Optional consent is never a condition of buying. We target a response within 30 days; a trained owner must handle requests and communicate any lawful exception. If unresolved, you may use the Data Protection Board's officially notified complaint mechanism when applicable, after using our grievance process. No unofficial Board link is provided.
Children and supported languages
We have not implemented verified parental/guardian consent. Do not submit a child's personal data through the normal signup flow; contact support for guidance. An age self-declaration is not verified parental consent. Required language options and the children/capacity workflow must be legally reviewed before launch.
Grievance / privacy contact
Company: Mobiussphere.
Address: Tower A, China Resources Land Building, No. 9668 Shennan Avenue, Yuehai Subdistrict, Nanshan District, Shenzhen, Guangdong Province, 518057, China.
Grievance contact: Mobius Support — support@mobiussphere.in. Subject: Privacy / DPDP request. Automated verification messages use promotion@mobiussphere.in; that address is not the grievance channel. Mobius Support is the operator-designated team label, not a claim that a statutory named officer or DPO has been appointed.
Material purpose changes require an updated notice and fresh consent where required. Existing users are not presumed to have accepted this version.