Privacy policy

The short version

• We never publish your phone number, WhatsApp or email address.
• We never sell, rent or share your details with anyone for marketing.
• Your card and UPI details never touch our server.
• You can ask us to delete your account and we will.

What we collect

When you create an account

• Your name, email address and mobile number — to identify your account and verify it is yours.
• A one-time code (OTP) sent to that email or number. It is stored only long enough to check, then expires.
• Your password, stored only as a bcrypt hash. We cannot read it, and nobody here can tell you what it is.

When you set up a seller store

• Your store name and city, which are shown publicly on your listings.
• Your listings: titles, descriptions, prices and photos you upload.

Photos are stripped of EXIF metadata on upload, so the location where a photo was taken is removed before it is ever published.

When you pay

Payment is taken in Razorpay's own secure window. Your card number, CVV, UPI PIN or bank credentials are never sent to, seen by, or stored on this website. What we receive back is a payment reference, the amount and whether it succeeded — that is what your receipt is built from.

When you use the site

• A session cookie, so you stay signed in. It carries no personal data.
• Which pages were viewed, so we know what is useful.
• IP addresses are hashed, never stored. The hash is salted with a secret kept outside the database, so the original address cannot be recovered from it — not by us, and not by anyone who obtained a copy of the database.

What we do with it

• Run your account, your listings and your chats.
• Send you what you asked for: verification codes, password resets, and notice when a buyer messages you.
• Detect fraud and abuse, and act on reports.
• Understand which pages help people, in aggregate.

What we never do

• We do not sell or rent your data. Not to dealers, not to advertisers, not to anyone.
• We do not publish your contact details. A buyer cannot see your number or email — only the chat.
• We do not put personal data in a link. Nothing identifying you is placed in a URL where it could leak through a referrer or a log.

Who else sees it

Only the services that make the site work, and only the part each one needs:

• Razorpay — to take your payment. They handle your card or UPI details; we never do.
• ZeptoMail (Zoho) — to deliver our email to you.
• MSG91 — to deliver SMS and WhatsApp verification codes.
• Our hosting provider — the server the site runs on.

We are required to disclose information where a law or a court order compels it. We have no other arrangement with anybody.

How long we keep it

• Account and listing data, while your account exists.
• Payment records, as long as tax and company law requires — these we cannot delete on request.
• One-time codes, minutes. Session records, weeks.

Your rights

You can ask us to:

• Show you what we hold about you.
• Correct anything wrong.
• Delete your account and your listings.
• Stop sending you email that is not about your own account.

Write to support@thecurrencybazaar.com from the address on your account. We act within 30 days. There is no charge, and you do not have to give a reason.

Security

The site is served only over HTTPS. Passwords are hashed with bcrypt and never stored in a readable form. Administrator accounts can be protected with two-factor authentication. Sign-in attempts are rate-limited, and repeated failures from one address are blocked.

Children

This site is not for anyone under 18, and we do not knowingly hold their data.

Changes

If this policy changes in a way that affects you, we will say so on the site rather than quietly editing the page.

Who is responsible

Numismatic Coin Collections Private Limited
CIN: U52599UP2020PTC134827
GSTIN: 09AAHCN1719P2ZW

Questions, or a complaint about how your data was handled — our grievance officer's details are on the contact page.