Xspare ("we", "us", or "our") operates an online marketplace connecting customers with automobile spare-parts vendors in Kerala, India. This Privacy Policy explains what personal data we collect, why we collect it, and how it is used and protected when you use our website at xspare.in (the "Platform").
2. Information We Collect
From customers:
Phone number — collected via OTP for identity verification.
Enquiry details — vehicle make, model, year, required part, and your district in Kerala.
Your name, as provided when submitting an enquiry.
Photos of your vehicle or part — uploaded optionally to help vendors respond accurately.
From vendors:
Business name, owner name, phone number, secondary phone, email, state, and district — provided during vendor registration.
Phone number — used for account authentication via OTP.
Verification documents — Aadhaar card, GST certificate, RVSF (Registered Vehicle Scrapping Facility) registration, and a shop photo, uploaded during KYC verification. They are stored in a restricted, access-controlled area and can be viewed only by authorised Xspare staff, and only to verify your business identity. They are never shown to customers or other vendors.
Bank and UPI details — account holder name, bank name, account number, IFSC code and (optionally) UPI ID, provided so we can pay you for completed orders. These are visible only to you and authorised Xspare staff, and are never shown to customers.
Push notification token — stored to deliver push notifications for new enquiries in your district. This token is device-specific and does not identify you personally.
Quote details — price, part grade, notes, and optional photos submitted in response to customer enquiries.
Chat messages — text, photos and voice messages exchanged with customers through the Platform's in-app chat, to coordinate on enquiries.
Voice messages — if you send a voice note in chat, we record it through your device's microphone only while you hold or press the record button, and store the audio so the customer can play it. We do not record in the background.
App diagnostic data — if you use our mobile vendor app, we collect crash and performance data (device type, OS version, app errors) through a crash-reporting service, to help us fix bugs. This does not include the content of your messages or documents.
3. How We Use Your Information
To verify your identity and prevent fraudulent enquiries or registrations.
To match customer enquiries with vendors in the same district and notify them in real time.
To allow vendors to respond to enquiries with quotes.
To send push notifications to vendor devices when a new enquiry arrives in their district.
To pay vendors the amount due for completed orders, using the bank or UPI details they provided.
To improve the Platform through aggregated, anonymised usage analytics.
We do not sell your data to third parties. If you accept optional cookies, we also use them for analytics and advertising measurement, as described in Section 5A.
4. Third-Party Services
We rely on trusted third-party sub-processors to operate the Platform:
Authentication provider — handles phone number OTP verification. Your phone number is transmitted to this service solely to generate and verify OTP codes.
Database and backend provider — stores all enquiry, quote, and vendor data in a secure, hosted database (region: ap-south-1, Mumbai).
Hosting provider — serves the Platform and may collect standard server-side access logs (IP address, browser type, request path) as well as anonymised page-view analytics.
Crash-reporting provider — used in our mobile vendor app to collect diagnostic and crash data so we can identify and fix bugs (Sentry). Reports contain technical details such as device model, OS version and error traces, and do not include message, voice, document or bank content.
5. Push Notifications
If you are a vendor, your browser or the Xspare vendor app registers a push notification token with our Platform. This token is specific to your device, is stored in our database, and is used exclusively to send you alerts about new spare-part enquiries, quotes and order updates. You can stop notifications at any time through your browser or phone settings, or by uninstalling the app.
5A. Cookies & Tracking
We use cookies and similar technologies only for the following, and the optional ones only if you click Accept on our cookie banner:
Essential — storage needed to keep the site working (for example your login session and a saved enquiry draft). These do not need consent.
Error reports — if the site crashes or hits an error, a technical report (error details, browser and device type, and the page address) is sent to our error-monitoring provider, Sentry, so we can fix bugs. It is not used for advertising and does not include what you type into forms.
Analytics (optional) — Google Analytics 4 measures which pages are visited and how the site is used.
Advertising measurement (optional) — the Meta (Facebook) Pixel tells us which of our ads led to an enquiry. When you submit an enquiry, we may also send Meta a conversion event with hashed contact details so it can match the enquiry to an ad.
If you click Reject, or do not answer, the optional scripts are not loaded. You can change your choice at any time using Cookie settings in the page footer. Our hosting provider also runs cookieless page-view and performance measurement.
6. Data Retention
Enquiry and quote data is retained for as long as necessary to facilitate the transaction and for up to 12 months thereafter.
Vendor account data is retained for the duration of the vendor's active registration plus 12 months.
Push notification tokens are updated or removed when you revoke notification permission or close your account.
You may request deletion of your data at any time by contacting us (see Section 10). On a verified request, we delete your personal data, including verification documents (such as Aadhaar), bank and UPI details, voice messages and push tokens, within 30 days. We may keep records we are legally required to retain, such as payment and tax records.
7. Data Security
We implement industry-standard safeguards including:
HTTPS encryption for all data in transit.
Row-level security policies on our database so vendors can only access their own quote data.
Verification documents and bank details are accessible only to you and authorised Xspare staff, enforced by access rules on our database.
Service-account credentials for server-to-server communication are stored as encrypted secrets and never exposed to the browser.
No method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
8. Children's Privacy
The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us so we can delete it.
9. Your Rights
Under applicable Indian data-protection law, you have the right to:
Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your data, subject to legal obligations.
Withdraw consent for push notifications at any time via browser/device settings.
To exercise these rights, contact us at the address in Section 10.
10. Grievance Officer
In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the details of the Grievance Officer are:
Address: Mannumkad, Ramavarmapuram, Thrissur, Kerala 680008, India
Complaints or concerns may be submitted by email. We will acknowledge your complaint within 24 hours and endeavour to resolve it within 15 days of receipt.
11. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at [email protected].
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. Your continued use of the Platform after changes are posted constitutes your acceptance of the revised Policy.