Privacy Policy

Smart Banganga (“we”, “us”) operates a hyperlocal marketplace for Banganga, Kapilvastu, Nepal. Customers discover nearby shops and service providers, place product orders, reserve hotel rooms, and book local services - from agrovet and repair to water supply, painting, and more. Shop owners manage their catalogue, bookings, and service requests from owner tools. The app is free for customers; shop participation is governed by a separate agreement plus our Terms of Service.

Data controller: Smart Banganga, Banganga, Kapilvastu, Lumbini Province, Nepal · smartbanganga@gmail.com. If you contact us about privacy, tell us the email or phone number on your account so we can find it.

We collect the minimum needed to run a marketplace. By category:

• Account data.Name; email address and/or username; password (stored only as a one-way hash - we cannot read it); optional phone number, delivery address, saved addresses (each with an optional map pin you drop yourself), and profile photo; Google account identifier when you use Google Sign-In (we verify Google's ID token on our server and keep only the identifier, name, email, and photo Google returns).
• Orders, reservations & service requests. What you ordered or booked (items, quantities, room, dates, service details), the delivery or stay address, contact phone, landmark notes, messages you exchange with the shop, and order/booking status history.
• Reviews.The star rating and comment you leave on a completed order, stay or booking. Reviews are public on the shop's page under your first name and last initial only, and the shop may reply publicly.
• Shop-owner data.Business name, shop address and phone, catalogue and pricing, and - for delivery setup - a shop location captured from the owner's device.
• Device & technical data. Push-notification token, app version, device OS, sign-in session records (device description, IP-derived network data), and crash/diagnostic logs needed to keep the app working.
• What we do not collect. No online-payment card or banking data - payment today is cash on delivery/pickup or pay at the property (see Terms §5). No background location tracking, no contact list, no SMS or call-log access.

• Run the marketplace: accounts, sign-in, catalogue, ordering, reservations, service requests, order tracking, and customer-shop messaging.
• Fulfilment: pass your order details (name, phone, address, items) to the shop you chose so it can confirm, prepare, deliver, or host you.
• Safety & reliability: prevent fraud and abuse, enforce our Terms, debug crashes, and keep sessions secure.
• Communication: order confirmations, delivery/booking updates, and service messages by push notification, and transactional email where needed. No marketing messages without your consent.
• Improvement: aggregated, de-identified analytics (e.g. which categories are popular) to decide what to build next.

Basis under Nepal's Privacy Act, 2075 and our legitimate interests: your consent when you create an account or grant a permission, performance of the marketplace contract when you order or book, and our legitimate interest in a secure, working service. You may withdraw consent (e.g. revoke a permission, sign out, request deletion) at any time - the service simply cannot perform the part that needed it.

We never sell personal data. Sharing is limited to:

• The shop you transact with. The shop or service provider you order from or book with receives your name, phone, relevant address/dates, and order contents - nothing else.
• Service providers who process data for us: Google (Sign-In verification, Play distribution); Firebase Cloud Messaging (push delivery); Cloudinary (hosting product, shop, and avatar images); Brevo (transactional email); and our hosting/database provider. Each sees only what its job needs and acts under its own security commitments.
• Legal & safety. To comply with Nepali law, a court order, or to protect users, shops, or the service against fraud or abuse.
• Business continuity. If Smart Banganga is reorganised, your data transfers with the service under this same policy, and we will notify you of any material change.

• Location (foreground, one-time).Asked only when it is needed - capturing a checkout delivery point, pinning a saved address, or setting a shop's service area. Never tracked in the background; denying it just means typing the address manually.
• Notifications. Asked once so order confirmations, delivery, and booking updates can reach you. You can switch them off in system settings; the in-app inbox still shows the same updates.
• Camera / photo library. Used for QR scanning and for images you choose to upload (profile photo, product or shop photos). We never scan your library - only the image you pick.

• Account data: while your account is active.
• Orders, reservations, requests, and shop-customer messages: while needed for fulfilment, warranty/support, and shop bookkeeping, then archived or deleted.
• Session/security logs: kept short-term for fraud prevention and debugging, then deleted or aggregated.
• Deletion requests: we erase or irreversibly anonymise your personal data within 30 days unless Nepali law requires us to keep specific records (e.g. tax-relevant transaction logs), in which case we keep only that and tell you.

Passwords are hashed, never stored in readable form. Sessions use short-lived access tokens plus rotating refresh tokens; credentials on your phone live in encrypted storage. Traffic runs over HTTPS, access to production data is limited to authorised personnel, and image uploads are re-encoded on the way in (which also strips camera metadata). No system is perfect - if you suspect misuse of your account, sign out everywhere and email us immediately.

You may at any time ask us to:

• Confirm what personal data we hold about you and get a copy.
• Correct inaccurate details (most profile fields are also editable in-app).
• Delete your account and personal data, or withdraw consent for optional processing.
• Object to, or ask us to limit, specific uses of your data.

You can delete your account yourself at any time in the app, under Profile → Delete account. It takes effect immediately.

To exercise any of the other rights, or if you cannot use the app, email smartbanganga@gmail.com from your account email with the subject “Privacy request”. We verify ownership (a confirmation link or code), then act within 30 days. Deletion signs you out on all devices, removes your profile, address book, and notification tokens, and unlinks Google Sign-In; past orders are kept only as anonymised records the shop needs for its books, with your name, phone, and address removed.

Smart Banganga is a general-audience shopping and services app and is not directed at children under 13. Accounts for younger children should be created and managed by a parent or guardian. If you believe a child has provided data without proper consent, contact us and we will delete it promptly.

This marketing site (smartbanganga.com) is static content: it sets no advertising trackers of its own. Strictly-necessary storage remembers your language choice; the embedded support-chat widget (Lumjha) loads only when your browser is idle and may set its own functional cookies per its policy. The Google Play / Drive download links you tap are governed by Google's policies once you leave our site.

If we materially change this policy we will post the new version here, update the date above, and - for significant changes - notify you in-app or by email before the change takes effect. Continued use after the effective date means you accept the updated policy.

Questions, requests, or complaints: smartbanganga@gmail.com · Smart Banganga, Banganga, Kapilvastu, Lumbini Province, Nepal. You also retain the right to complain to the competent authority under applicable Nepali law.