Privacy

Who this notice is from

This is the privacy notice for Krishi Setu, at krishisetuindia.com. Under India's Digital Personal Data Protection Act, 2023, the organisation that decides why and how your personal data is used is called the Data Fiduciary. For Krishi Setu that is registered entity name and address - not yet decided.

You are what the Act calls the Data Principal: the person the data is about. This notice is written to tell you plainly what we hold, why, for how long, and what you can ask us to do about it.

What we collect, and why

Your mobile number. It is your account. We use it to sign you in by calling you with a code, and to know which farmer or buyer a contract belongs to. Without it there is no account.

Your name, and for farmers your village, district, state and land area; for buyers your business name, type, address and GSTIN if you give it. These appear on your listings, bids and contracts so the other party knows who they are dealing with.

An email address, only if you choose to add one to your profile. It is used for one thing: sending your sign-in code if the phone call cannot be placed. It is never shown to anyone.

Contracts, produce listings, bids, bookings, and the record of what happened to them: who applied, who was awarded, when a delivery was confirmed, when a payment was confirmed. This is the substance of the service and is kept as a record of what both sides agreed and did.

Farm records you choose to keep in My Farm: plots, what grew on them, yields, livestock. These are private to you and are never shown to a buyer or to the public.

Photographs you upload to a listing or a contract. These are public, because the listing or contract is public.

A sign-in log: each time a code is requested, we keep a keyed hash of the phone number and of the network address it came from, the channel used, and whether it worked. Not the number, not the address, and never the code. This exists to limit how often codes can be requested, because each phone call costs money and could otherwise be abused.

What we deliberately do not collect

No Aadhaar number, and no identity documents of any kind. Where we record that an account was verified, we record only that it was, how, and when - never the document.

No payment details. Krishi Setu does not take, hold or move money. When a buyer records that they paid and a farmer confirms it arrived, we store those two statements and the dates, nothing about the bank transfer itself.

No third-party analytics, advertising trackers or social media pixels. The only cookies are the ones that keep you signed in and remember your language.

No location tracking. Your district and village are what you typed, not where your phone is.

What is visible to whom

Open contracts and open produce listings are public: anyone on the internet can read them, including the buyer's business name and the farmer's name, district and state. That is how a marketplace works, and you are told this before you post.

A buyer's track record - contracts posted, deliveries received, payments confirmed on time - is public, because how promptly a business pays is the most useful thing a farmer can know before growing a season for it.

A farmer's track record is not public. It is visible to the farmer, and to a buyer whose contract that farmer has applied to - the point at which the buyer has a decision to make.

Your phone number and email are never shown to another user. Contact between a farmer and a buyer happens after a contract is awarded, and how you share contact details then is your choice.

Where your data is, and who processes it

Your data is stored in a database run by Supabase, and the website runs on Vercel's servers in Mumbai, India. The region of the Supabase database is not yet confirmed - it decides whether any personal data leaves India.

To call you with your sign-in code we use 2Factor.in, an Indian provider, which receives your ten-digit number and the code for that call. To email a code as a backup we use Resend, which receives the email address you added and the code.

These are Data Processors: they act on our instructions and for these purposes only. We do not sell personal data, share it with advertisers, or give it to anyone for their own use.

How long we keep it

The sign-in log: 90 days, then it is deleted.

Your account and profile: while the account is active, and for three years after it was last used. After that it is deactivated and the personal details on it are removed.

Contracts, bids and their history: kept, including cancelled ones. A record of what two parties agreed and did is the kind of thing that matters most exactly when one of them later disputes it, and deleting it would serve whoever is in the wrong.

Photographs: until you remove them, or until the listing or contract they belong to is removed.

Your rights

Under the Digital Personal Data Protection Act, 2023 you may ask us: what personal data we hold about you and what we do with it; to correct or complete it; to erase it where we no longer need it for the purpose it was collected; and to nominate another person to exercise these rights for you if you cannot.

You can see and change your name, email, bio and farm or business details yourself on your profile page, and remove any photograph you uploaded.

To ask for anything else - a copy of your data, deletion of your account, or a correction you cannot make yourself - use the contact form and say which you want. We will confirm what we have done. An account is deactivated rather than erased where a contract on it is still live or was completed, because the other party to that contract has a right to the record too.

If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

Age

Krishi Setu is for adults. You must be 18 or older to create an account. We do not knowingly hold personal data of anyone younger, and if we learn that we do, we will remove it.

Grievances and contact

The Act requires a way to raise a grievance and a person responsible for answering it. For now, use the contact form; a named grievance officer and their contact details are not yet decided.

If this notice changes in a way that matters, the date at the top will change and the change will be described here. This version: 11 September 2026.