Privacy policy
Clarv is software that sellers and their accountants use to reconcile and account for their marketplace business. This policy says what data Clarv holds, why, where, for how long, and what rights you have. It is written to be read, not skimmed.
1. Whose data, and what
- Account data: the name, e-mail address and hashed password of each person who signs in, and the seller's business name, GST registrations and PAN as entered.
- Marketplace data: the reports and API data of the seller's own marketplace accounts (Amazon today; other marketplaces as Clarv adds them and the seller connects them) — settlements, orders, inventory, fees, advertising, tax reports and Amazon's tax invoices — read with the seller's authorisation.
- Buyer data (personal data of the seller's customers): only the minimum the seller's operations need: a buyer's name, address and phone from self-shipped orders, used to print the shipping label and the tax invoice; and a business buyer's GSTIN and name on B2B invoices, used to file the seller's own GST returns. Clarv never holds buyers' payment details.
- Bank data: the seller's own bank statements, dropped by the seller for reconciliation.
- Usage data: an audit log of what each user did in Clarv, and technical logs (time, request, outcome) that never contain personal data values or credentials.
2. Why
To provide the service the seller has asked for: reconciliation, accounting, tax returns and compliance, stock and warehouse operations. We do not use any data for advertising, profiling, resale or to train models. Amazon data is used only for the seller's own operations and compliance, and is never combined across sellers.
3. Where it is kept
On Amazon Web Services, at present in the Asia Pacific (Sydney) region (ap-southeast-2); we intend to move to the Mumbai region (ap-south-1) and will update this policy when we do. There: an encrypted database, encrypted file storage and application servers in a private network. Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). Credentials and tokens are additionally sealed under a key held apart from the database. No customer data is kept on staff computers.
4. Who can see it
The seller's own users, and the accountants the seller has assigned to its account, each with a role that limits what they can do. Our engineers may access production data only to fix a fault, under named accounts with multi-factor authentication, and every such access is logged. We do not share data with any third party except our hosting provider (Amazon Web Services) as a processor, and any recipient the seller itself instructs, such as the seller's accounting software or the GST portal.
5. How long
- Buyer name, address and phone from shipping: deleted 30 days after the order is delivered or closed, unless an open return, claim or dispute requires it to be kept.
- Invoice and tax records: kept as long as Indian tax law requires the seller to keep them.
- Everything else: for as long as the seller's account is active, and deleted within 30 days of the seller asking, or of the account closing.
- Backups: encrypted, kept seven days, deleted on the same schedule.
6. Amazon data
Clarv reads Amazon data through the Amazon Selling Partner API with the seller's authorisation, under Amazon's Acceptable Use Policy and Data Protection Policy. The seller may revoke that authorisation in Seller Central at any time, after which Clarv reads nothing further. Amazon customer data is used only to fulfil and account for the seller's own orders and is protected as this policy describes.
7. Your rights
A seller may export all of its data as files at any time, correct anything it entered, and ask for its data to be deleted. A buyer whose data a seller holds in Clarv may write to the seller, or to us, and we will act with the seller within 30 days. Requests go to privacy@clarv.in.
8. Cookies
The Clarv application uses one session cookie to keep you signed in. This website sets no cookies and runs no analytics.
9. Incidents
If we learn that data has been accessed without authorisation, we contain it, assess which sellers are affected, and tell them and, where Amazon data is involved, Amazon within 24 hours of discovery.
10. Changes and contact
We will post any change here with a new effective date, and tell account holders by e-mail of any material change. Questions: privacy@clarv.in, or the address on the contact page.