Privacy Policy

1. Who we are and the law this policy follows

PurchaseBarcode is run by RNR Associates, a sole proprietorship at 2/388 First Floor, Front Side, Subhash Nagar, New Delhi, Delhi 110027, India. We decide what personal data the website collects and how it is used. We collect it and keep it, on servers run by our hosting provider (section 5).

We publish this policy under the Information Technology Act, 2000 (section 43A) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which require a published privacy policy.

The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 have been notified. The parts that set out the duties of businesses like ours have not come into force yet; under the government's notification of 13 November 2025 they start in May 2027. We will update this policy for them before then.

2. The personal data we collect

When you create an account

• Your name, email address and mobile number.
• Your password. Under the 2011 Rules a password is sensitive personal data. We store it only as a one-way bcrypt hash, so nobody at PurchaseBarcode can read it.
• A 6-digit email verification code. It is emailed to you with your name, is kept only in your session data on our server, and expires after 10 minutes.
• The date and time you last logged in.
• If you use "Forgotten your password?", a random reset token and its expiry time are saved in your account record.

In your profile (optional)

• Your address, city, state, pincode and GST number (GSTIN). We use them to fill in the checkout form for you.

When you check out and pay

• Billing name, email and mobile number (required), and billing address, city, state, pincode and GSTIN (optional). These are saved with the order when you submit the checkout form, before you pay, and are used for your invoice.
• The items in your cart and any coupon you use.
• A record that you ticked the checkout declaration: its version and the date and time you accepted it.
• Payment references from Razorpay: the Razorpay order ID, payment ID and signature, the amount and the payment status. You enter your card, UPI or bank details on Razorpay's checkout; your full card number, CVV, UPI PIN and banking passwords never reach us. Razorpay's confirmation of your payment to our server includes the payment method and partial details, such as your UPI ID, the last four digits and network of your card, or your bank's name; we use them only to confirm the payment and do not store them.
• The barcode numbers issued to you and when they were delivered, your invoice number, date and amounts, and the order updates shown under Notifications in your account.

When you contact us

• The contact form saves your name, email address, subject and message.
• If you email, call or WhatsApp us, we receive what you send us through that service.

Technical data

• Our own code does not record your IP address, browser or the page you came from.
• Hostinger, which hosts the website, handles every request, including your IP address and browser details, and may keep its own server logs.
• Our error logs can contain order numbers, account and payment IDs and email-sending errors.

3. Cookies and outside services on our pages

• PHPSESSID (needed for the site to work). It is set on every visit and links your browser to your session on our server, which keeps you logged in and holds short on-screen messages and, while you sign up, your verification code. The cookie ends when you close your browser.
• Our pages set no analytics, advertising or tracking cookies, and we do not use any analytics service.
• Google Fonts. Our pages load their fonts from Google (fonts.googleapis.com and fonts.gstatic.com), so your browser sends your IP address and browser details to Google when it fetches them.
• Razorpay. The payment page loads Razorpay's checkout from checkout.razorpay.com. Razorpay may set its own cookies or storage in its checkout window under its own privacy policy.
• Pages that do not exist. If you open an address that does not exist on this site, Hostinger may show its own "page not found" page. That page is Hostinger's, not ours; it loads Google Analytics and other third-party scripts, which may set cookies.

You can block or delete cookies in your browser, but logging in and checkout need the PHPSESSID cookie.

4. Why we use your data

• To create and run your account and confirm your email address.
• To take your order, take payment through Razorpay, issue your barcode numbers and keep the record that stops a number being issued twice.
• To produce your invoice and keep the tax and accounting records the law requires.
• To answer your messages and complaints and to help with your orders.
• To keep the website working and secure and to find and fix errors.
• To meet our legal obligations.

The emails the site sends are: your sign-up verification code; an update when we change the status of your order (a copy comes to us); and your invoice, when we re-send it to you. We do not send marketing emails, and we do not use your data for advertising.

5. Who receives your data

We do not sell or rent your personal data. It goes only to the recipients below, and only for the purposes in section 4.

• Razorpay (razorpay.com), our payment gateway: the amount, your order number, and your billing name, email and mobile to fill in its checkout. You give your card, UPI or bank details to Razorpay directly.
• Hostinger, our hosting provider: it runs the servers that hold the website and its database.
• Our email service provider, which delivers the website's emails: the emails listed in section 4 and their contents.
• Google: your IP address and browser details when your browser loads our fonts (section 3).
• buzzlytech.com, a store that issues barcode numbers from the same pool as us: the shared record of issued numbers holds your account ID number and order ID next to each number, so that neither store issues it again. It does not hold your name or contact details.
• WhatsApp (Meta): only if you choose to message us on WhatsApp.
• Government authorities, courts and law enforcement, when the law requires it.

We do not send your data to GS1 or to any ISBN agency, and we do not look up or register your numbers with them.

6. How we protect your data

• The website is served over HTTPS, so data between your browser and our server is encrypted in transit.
• Passwords are stored only as bcrypt hashes.
• We never receive your full card number, CVV, UPI PIN or banking passwords, and we do not store the partial payment details Razorpay's confirmation carries.
• Your account pages, codes and invoices open only after you log in, and only for orders that belong to your account.
• Payment confirmations are checked against Razorpay's signature before any code is issued.
• The admin area needs a separate admin login.

No website is completely secure. If a security incident affects your personal data, we will report it as the law requires.

7. How long we keep your data

• Orders, invoices and payment records. The Central Goods and Services Tax Act, 2017 (section 36) requires us to keep them until 72 months after the due date of the annual GST return for the year they belong to. For example, records for the financial year 2026-27 are kept until at least 31 December 2033. We keep them longer if they are part of an appeal, investigation or other proceeding, and other laws, such as income-tax law, may also require us to keep some records.
• The record of issued numbers (number, account ID, order ID) is kept permanently, so a number is never issued twice.
• Your account and profile are kept while your account exists.
• Unpaid orders, unverified sign-ups, contact messages and account notifications are not deleted automatically at present. You can ask us to delete them (section 8).
• Download files. The ZIP of your codes is made when you download it and deleted straight after. Invoice PDFs are made when you open them and are not stored.
• Session data is kept on the server under the hosting provider's default settings; the PHPSESSID cookie ends when you close your browser.
• Server and error logs are kept under Hostinger's settings.

8. Your rights and choices

• See and correct your data. In Profile you can change your name, mobile number, address, city, state, pincode and GSTIN. To change your email address, or the billing details saved on a past order, write to us.
• Choose not to give data. You can decline to give us personal data. We need your name, email address and mobile number to open an account, and billing details to issue an invoice, so without them we cannot sell to you.
• Withdraw your consent. You can withdraw your consent at any time by writing to us. We will then stop using your data, except what the law requires us to keep, and we may have to close your account.
• Ask us to erase your data. There is no self-service account deletion yet. Write to us and we will erase the data no law requires us to keep, and tell you what we must keep and why.

How to ask. Email contact@purchasebarcode.com from the email address registered on your account, with "Privacy request" in the subject, or write to us at the address on this page. We may ask you to confirm the request comes from you. We respond within one month.

9. Children

Accounts and purchases are for people aged 18 or over, as our Terms of Service say. We do not knowingly collect personal data from anyone under 18. If you think a child has given us personal data, contact us and we will delete it, unless the law requires us to keep it.

10. Questions and grievances

For any question or complaint about your personal data, use the grievance contact on this page. We acknowledge a grievance within 48 hours and resolve it within one month. The full process is on our Grievance Redressal page.

11. Changes to this policy

When our practices or the law change, we will update this page and the "Last updated" date at the top.