1.What this covers
This policy covers what Stashq collects when you buy a digital product, when you run a store, and when you simply visit a page. Stashq is operated from India and sells to buyers in India, so Indian law — including the record-keeping and invoicing rules under GST — decides several of the answers below.
2.What we collect from buyers
You do not need an account to buy. Whether or not you create one, a buyer record is kept so that your purchases can be found again and delivered to you. It holds:
- your email address — required, because it is how a purchase is delivered and how you get back into it later;
- your name and phone number, if you give them;
- the state you select at checkout — see section 3;
- what you bought, what you paid, the invoice raised for it, and whether and when you downloaded it;
- any refund request you file, and the messages in it.
If you later create an account with the same email address, the purchases already held against it are linked to that account.
3.Your state, and why we need it
Checkout asks which state you are in, and it is not optional. This is a legal requirement rather than a preference: for an online supply to a customer who is not GST-registered, the supplier must record the customer's state on the tax invoice as the place of supply, whatever the value of the sale, and must collect it before the supply is made.
It decides which government the tax on your purchase is paid to, it appears on your invoice, and Stashq cannot issue a compliant invoice without it. We do not ask for your address, and we do not ask whether you are a business — neither changes the answer.
It is stored with your purchase record, so your invoice and any later one are consistent. It is never looked up from an email address someone types in — so if you buy again as a guest, you will be asked for it again. That is deliberate: the alternative would let anyone discover where you live by entering your address at a checkout.
4.Reviews you write
If you review something you bought, that review is published on the product’s public page. It is the only thing on this page that we make public. It holds:
- your rating, and your written review if you wrote one;
- the name you type on the review form — which is a free-text box, not your account name and not the name on your purchase. Leave it blank and the review shows as “Anonymous”;
- the date you wrote it.
Your email address is never shown, and neither is anything else from your buyer record. The public page cannot reach them.
A review cannot be edited once posted, so treat the name box the way you would treat anything else you are publishing under. You can take your review down at any time from the purchase in your library, and it is removed from the product page — though that does not let you post a new one for the same purchase. If your purchase is refunded, the review comes down on its own.
5.What we collect from sellers
- your account details, and the products, descriptions and files you upload;
- your store's name, address on Stashq, branding and settings;
- your sales, what Stashq paid you for each of them, and the subscription invoices raised to you;
- the state you are in, for the same reason as section 3 — it goes on the invoice Stashq issues you for your plan.
Your settlement details are not stored by Stashq. Bank account and payout information is held by our payment provider, which verifies it and pays you directly; there is no field for an account number anywhere in Stashq's own records. We also do not ask sellers for a GSTIN.
6.What is collected automatically
- Signed-in devices. For each session on your account we record the IP address, browser, operating system and when it was last active, so that you can see the list in your security settings and, if you see something you do not recognise, sign out of every other session at once.
- Abuse limits. Requests to a few endpoints that work without a login — checking a store name, previewing a coupon, starting a checkout — are counted against the requesting IP address for a short window, to stop them being hammered.
- Page analytics. Our host's analytics and performance measurement run on every page, and report aggregate traffic and page-speed figures. They are not used to build a profile of you.
Our emails do not track you. Open and click tracking is not enabled, so we do not know whether you opened a message or which link you followed. What we do record is whether an address bounced or complained, so that we stop sending to it.
7.How we use it
- To deliver what you bought, and to let you reach it again later
- To take payment, issue the tax invoice, and pay sellers
- To handle refund requests and disputes
- To keep accounts secure, and to detect fraud and abuse
- To send the messages described in section 9
- To meet tax, accounting and other legal obligations
8.Who else processes it
Stashq does not sell your information and does not share it for anyone else's advertising. It is processed by the services that make the platform work, each for one purpose:
- Razorpay — payments, refunds and seller payouts, including the settlement details Stashq itself does not hold
- Supabase — sign-in and the database
- Cloudflare R2 — the files sellers upload and buyers download
- Resend — sending email
- Vercel — hosting, and the analytics in section 6
We also disclose information where the law requires it, or to establish or defend a legal claim.
9.Email you can turn off
Sellers can switch off four groups of email in settings — purchase updates, product notices, payout notices and storage notices — and those preferences are honoured when the message is queued.
Some messages cannot be switched off, because turning them off would take away the thing you are owed rather than reduce noise: the delivery of something you bought and the link that opens it, anything about a refund request (which runs on a deadline), notice that a product you own is being removed, and notice that your payouts or your subscription are blocked. Sign-in and password-reset email is likewise part of using an account.
10.How long we keep it
Account and store information is kept while the account exists. Files are kept while the product exists; when a product is deleted, buyers who own it are given a stated grace period to download it before the files are purged.
Purchase, invoice and payout records outlive an account. GST requires records of a supply to be retained for 72 months after the due date of the annual return for the year they fall in, so a deletion request cannot remove the tax record of a sale that has already happened. It can remove the rest.
11.Your choices, and contact
- See and update your profile, see your signed-in devices, and sign out of every other session
- Change which optional emails you receive
- Ask for a copy of what we hold about you, or ask us to delete it, subject to section 10
- Close your account
Write to hello@stashq.in for any of these, or with any question about this policy. Tell us the email address you used, since that is how buyer records are found.