Store Manager by Tukaatu — Privacy Policy

2.1 Information You Provide Directly

• Phone Number — Required for OTP-based account registration and login. Serves as your primary account identifier.
• Full Name — Collected during profile setup to personalize your experience.
• Profile Photo — Uploaded voluntarily during profile creation or editing.
• Store Information — Store name, description, logo, banner image, address, and contact details provided during store setup and profile management.
• Product Listings — Product names, descriptions, prices, categories, dimensions, terms, stock quantities, color variants, brand information, and images you create and manage within the App.
• Campaign & Coupon Data — Campaign details, bid information, coupon codes, discount types, validity periods, and promotional content you create and manage within the App.
• Order & Delivery Data — Order details, customer delivery addresses, order status updates, delivery management actions, and shipping information you process within the App.
• Film & Video Content — Video files, thumbnails, titles, and descriptions you upload when posting films or video content through the App.
• Chat Messages — All text messages and media files (images) you send or receive within the in-app chat between you and your customers.
• Comments — Comments you post or manage on product or film content within the App.
• Abuse Reports — Details you provide when submitting a report against a user or content through the Report Abuse feature.
• Support Requests — Messages and information you submit when contacting our Help & Support team.

2.2 Information Collected Automatically

• App Usage Data — Screens visited, features used, buttons tapped, time spent on each screen, and general interaction patterns collected via Firebase Analytics.
• Push Notification Token (FCM Token) — A unique token generated by Firebase Cloud Messaging after login, used to deliver push notifications for new orders, customer messages, campaign updates, and relevant alerts. This token is stored locally on your device and synced to our servers.
• IP Address — Logged for security monitoring, fraud detection, and abuse prevention.
• Crash Reports and Error Logs — Automatically collected when the App encounters an error or crash to help our engineering team diagnose and resolve technical issues.
• Session Data — Login timestamps, session duration, and logout events for security auditing.

Note: Store Manager by Tukaatu does not collect hardware device identifiers such as IMEI, Android ID, or serial numbers. The only device-level identifier collected is the FCM push notification token.

2.3 Information from Device Permissions

• Camera — Accessed only when you actively choose to capture a photo or video for your store profile, product listing, or film content. Never accessed in the background.
• Storage / Photo Library — Accessed only when you select an existing image or video from your device gallery for store, product, or film content. We do not scan or index your photo library.
• Location / GPS — Accessed to auto-detect your current location when setting up or editing your store address and rendering the map view for address confirmation. Never tracked in the background.
• Microphone — Accessed only when you use the camera or video editor features that require audio capture for film recording. Never accessed outside of these specific interactions.
• Notifications — Used to deliver push notifications for new orders, customer chat messages, campaign updates, and relevant in-app alerts. Manageable from within the App or your device settings.
• Audio Session — Used to manage audio playback behavior when playing video or audio content within the App, ensuring proper audio routing on your device.

2.4 Cookies and Tracking Technologies

The Store Manager by Tukaatu native mobile application does not use cookies directly. Certain features use in-app WebViews to display external content such as help and support pages. These web views may use cookies governed by the respective third-party provider's privacy policy. No advertising cookies or cross-app tracking technologies are used by Store Manager by Tukaatu.

• Account Creation & Verification — To register your account, verify your identity via OTP, and maintain secure access.
• Store & Product Management — To enable creation, editing, and management of your store profile, product listings, dimensions, terms, brands, categories, and inventory.
• Campaign & Coupon Management — To enable creation and management of promotional campaigns, campaign bids, and coupon codes for your store.
• Order & Delivery Management — To display incoming orders, enable order status updates, manage delivery operations, and facilitate customer communication.
• Film & Video Content Management — To enable uploading, editing, and publishing of film and video content associated with your store, including moderation review before content goes live.
• Dashboard & Analytics — To display sales statistics, order summaries, revenue charts, and performance metrics via Firebase Analytics and in-app dashboard features.
• Push Notifications — To send new order alerts, customer message notifications, and relevant app alerts via Firebase Cloud Messaging.
• Real-Time Chat — To enable live messaging and image sharing between you and your customers via Pusher WebSocket channels, including the ability to delete individual messages or entire conversations.
• Location & Address Management — To assist with store address setup and auto-fill your current location using GPS.
• Content Sharing — To enable sharing of product links, store profiles, or film content via the share feature.
• Report Abuse Processing — To receive, review, and act on abuse reports submitted within the App.
• Help & Support — To receive and respond to your support inquiries and feedback.
• Security & Fraud Prevention — To detect, investigate, and prevent unauthorized access, fraudulent activity, and abusive behavior.
• Legal Compliance — To comply with applicable Nepalese laws, regulations, and lawful government requests.

4.1 How Chat Works

Store Manager by Tukaatu uses Pusher WebSocket channels to power real-time messaging between store owners and customers. Messages are transmitted over an encrypted connection and delivered instantly to the recipient's device.

4.2 What Is Stored

• All chat messages (text and images) exchanged between store owners and customers are stored on our secure servers.
• Message history is retained so that you can access previous conversations when you reopen a chat thread.
• Images shared in chat are stored on our servers and linked to the conversation thread.

4.3 Message and Conversation Deletion

You can delete individual messages or entire conversations at any time directly within the App. When you delete a message or conversation, it is removed from your view and a deletion request is sent to our servers. Deletion from our servers is processed within 30 days, except where retention is required for active disputes, legal holds, or abuse investigations.

4.4 Who Can See Your Messages

• Only you and the customer you are chatting with can see the content of your messages under normal circumstances.
• Tukaatu staff do not access private chat conversations except when an abuse report has been filed against a message or conversation, or when a valid legal request requires it. In such cases, access is limited to authorized personnel only.

4.5 Message Security

• All messages are transmitted over encrypted connections (TLS/HTTPS).
• Access to stored chat data is restricted to authorized personnel only and protected by strict access controls.
• Images shared in chat are stored securely and are not publicly accessible without authentication.

4.6 Content Policy for Chat

Users are strictly prohibited from sending:

• Sexually explicit or pornographic material
• Content that harasses, threatens, or abuses other users
• Spam, phishing links, or fraudulent messages
• Content that promotes violence, hatred, or discrimination
• Any content that violates applicable Nepalese laws

Violations may result in message removal, account suspension, or reporting to relevant authorities.

4.7 Chat Data Retention

• Chat messages and media are retained for as long as your account remains active.
• If you deactivate your account, your chat history will be deleted after the 15-day account recovery period.
• In cases of active disputes, legal holds, or abuse investigations, specific chat records may be retained beyond the standard deletion period as required.

5.1 What You Can Upload

Store owners can record, upload, edit, and publish film and video content through the App using the built-in camera, video editor, and film posting features. Uploaded video files and thumbnails are stored on our secure servers via Amazon S3.

5.2 Moderation Before Publishing

All film content submitted through the App is reviewed by our moderation team before it is published on the platform. Content that violates our policies will be rejected and will not go live. You will be notified of the outcome.

5.3 Content Policy

You must not upload:

• Sexually explicit or adult content
• Content that infringes on third-party intellectual property rights
• Content that promotes violence, hatred, or illegal activity
• Misleading or fraudulent promotional content

We reserve the right to remove any content that violates our content policy without prior notice. Repeated violations may result in account suspension.

6.1 Account Deactivation

You can request account deactivation at any time directly from the Profile section within the App. When you submit a deactivation request, your account is deactivated via our account deactivation endpoint and enters a 15-day recovery period. During that period, you may restore the account by signing in with your verified phone number. If you do not recover it, the account and customer-owned data are permanently deleted after 15 days.

6.2 Data Deletion After Deactivation

Upon account deactivation, your personal data will be deleted or anonymized after the 15-day account recovery period, except where retention is required by applicable law or for legitimate purposes such as dispute resolution, fraud prevention, or financial record-keeping.

6.3 Requesting Data Deletion

If you wish to request permanent deletion of all your personal data, please contact us directly:

• Email: support@tukaatu.com
• Phone: +977 980 569 2517

We will process your data deletion request within 7 business days and confirm once completed.

Note: A dedicated account deletion webpage is not currently available. Data deletion requests must be submitted by contacting us directly.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We may share your information only in the following limited circumstances:

7.1 Service Providers

• Firebase (Google) — Push notification delivery (FCM) and crash reporting. Firebase Analytics collects anonymized, aggregated usage data only. No personally identifiable information is shared with Firebase Analytics.
• Pusher — Real-time WebSocket infrastructure for in-app chat and live notifications. Message content is transmitted through Pusher's encrypted channels but is not stored by Pusher.
• Amazon S3 — Secure cloud storage for film and video content uploaded through the App.
• Flutter Map / OpenStreetMap — Map rendering for store location and address features.

All service providers are contractually obligated to keep your data confidential and process it only as instructed.

7.2 Customers

When a customer places an order, the following is shared with you as the store owner solely to fulfill the order:

• Customer name
• Delivery address
• Order details and items
• Customer notes (if provided)

This information must not be used for any purpose other than fulfilling the customer's order.

7.3 Legal Requirements

We may disclose your information if required by applicable Nepalese law or in response to valid legal requests by public authorities such as a court order or government directive.

7.4 Protection of Rights and Safety

We may disclose information where reasonably necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, or threats to the safety of any person.

7.5 Business Transactions

If Tukaatu is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. You will be notified prior to your data being transferred and becoming subject to a different privacy policy.

Store Manager by Tukaatu is operated from Nepal and your data is primarily processed within Nepal. However, some third-party service providers operate internationally:

• Firebase (Google) — Servers located globally including the United States. Processed in accordance with Google's Privacy Policy.
• Pusher — Servers in multiple global regions. Data transmitted through Pusher's WebSocket channels may be routed through servers outside Nepal.
• Amazon S3 — Film and video content may be stored on Amazon S3 servers located outside Nepal.

All international transfers are protected by contractual data protection obligations and TLS/HTTPS encryption in transit. By using Store Manager by Tukaatu, you acknowledge and consent to the transfer of your information to these service providers' servers which may be located outside Nepal.

• All user data is stored on secure, access-controlled servers.
• Personal data is retained for as long as your account remains active or as needed to provide our services.
• Upon account deactivation, your personal data will be deleted or anonymized after the 15-day account recovery period, except where retention is required by applicable law or for dispute resolution.
• Chat messages and shared media are retained as described in Section 4.7.
• Individual messages and conversations you delete are removed from our servers within 30 days.
• Film and video content is retained until you delete it or your account is deactivated.
• Crash logs and technical data are retained for a maximum of 90 days and then automatically purged.
• Firebase Analytics data is retained in anonymized and aggregated form only and does not contain personally identifiable information.
• FCM tokens are retained only while your account is active and are invalidated upon logout or account deactivation.

• Camera — Only when actively capturing photos or video for store, product, or film content.
• Storage / Photos — Only when selecting images or videos from your gallery.
• Location / GPS — Only when using the store address or map features.
• Microphone — Only when using camera or video editor features requiring audio capture.
• Internet — Always required for the App to function.
• Notifications — After you grant notification permission.
• Audio Session — Only when playing video or audio content within the App.

All permissions are requested only when needed. You can revoke any permission at any time through your device settings. Revoking a permission may limit certain features of the App.

• Right to Access — Request a copy of the personal data we hold about you.
• Right to Correction — Request correction of any inaccurate or incomplete personal data.
• Right to Deactivation — Deactivate your account directly from the Profile section within the App.
• Right to Deletion — Request permanent deletion of all your personal data by contacting us at support@tukaatu.com or +977 980 569 2517.
• Right to Restrict Processing — Request that we limit how we use your data in certain circumstances.
• Right to Data Portability — Request a copy of your personal data in a structured, machine-readable format (JSON or CSV).
• Delete Messages or Conversations — Delete individual messages or entire chat conversations at any time directly within the App.
• Opt-Out of Notifications — Disable push notifications via your device settings or the in-app notification settings screen.
• Withdraw Location Permission — Revoke GPS access at any time through your device settings.
• Withdraw Camera / Storage / Microphone Permission — Revoke media permissions at any time through your device settings.
• Opt-Out of Analytics — Contact us at support@tukaatu.com to opt out of Firebase Analytics data collection.

To exercise any of these rights, contact us at support@tukaatu.com or call +977 980 569 2517. We will respond within 7 business days.

Store Manager by Tukaatu is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will take immediate steps to delete such information and terminate the account.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at support@tukaatu.com or +977 980 569 2517.

12.1 Data Transmission Security

• All data transmitted between the App and our servers is encrypted using TLS protocols.
• All API communications use HTTPS exclusively.
• Real-time chat messages are transmitted over Pusher's encrypted WebSocket channels.

12.2 Authentication Security

• Account access is protected by OTP-based phone number verification.
• Authentication tokens (access token and refresh token) are stored locally on your device using SharedPreferences and automatically expire after a defined period.
• Unauthorized token use is detected and blocked by our backend systems.

12.3 Server & Infrastructure Security

• User data is stored on access-controlled servers with strict role-based access permissions.
• Only authorized personnel with a legitimate business need can access user data.
• Regular security audits and vulnerability assessments are conducted on our infrastructure.

12.4 Limitations

Despite our best efforts, no method of data transmission over the internet or electronic storage is 100% secure. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.

Our App integrates the following third-party services, each operating under its own privacy policy:

• Google Firebase — Firebase Privacy Policy
• Pusher — Pusher Privacy Policy
• Amazon S3 — AWS Privacy Policy
• OpenStreetMap — OpenStreetMap Privacy Policy

Store Manager by Tukaatu is not responsible for the privacy practices of these external services.

In accordance with Google Play Store Data Safety requirements, the following data is collected and shared by this App:

When we make material changes:

• We will update the "Last Updated" date at the top of this page.
• We will notify you via push notification or in-app alert before changes take effect.
• The updated policy will be available at https://tukaatu.com/store-manager-policy.
• Continued use of the App after changes are posted constitutes your acceptance of the updated policy.

This Privacy Policy is governed by and construed in accordance with the laws of Nepal. Any disputes arising in connection with this Privacy Policy shall be subject to the jurisdiction of the competent courts of Nepal.

This Privacy Policy applies to the Store Manager by Tukaatu mobile application available on Google Play Store and Apple App Store. It is intended to comply with Google Play Store policies, Apple App Store guidelines, and applicable data protection regulations of Nepal.

18.1 Your Responsibilities as a Seller

• You are solely responsible for the accuracy, legality, quality, and safety of all products and content you list on the platform.
• You must comply with all applicable Nepalese laws and regulations regarding the sale of goods and services.
• You are responsible for fulfilling orders placed by customers in a timely and accurate manner.
• Customer data shared with you (name, address, order details) must be used strictly for order fulfillment purposes only.

18.2 Refunds and Returns

• Refunds, returns, and exchanges are handled by you as the seller in accordance with your own return and refund policy.
• Tukaatu is not directly responsible for processing refunds or returns on your behalf.
• Where a genuine dispute arises between you and a buyer, Tukaatu may, at its discretion, assist in mediating and resolving the dispute.

18.3 Dispute Resolution

If a customer experiences an issue with an order:

1. The customer will first contact you directly through the in-app chat feature.
2. If unresolved, the customer may contact Tukaatu support at support@tukaatu.com or +977 980 569 2517.
3. Our support team will review the dispute and assist where appropriate within 7 business days.

18.4 Limitation of Liability

To the maximum extent permitted by applicable Nepalese law:

• Tukaatu shall not be held liable for any direct, indirect, incidental, or consequential damages arising from transactions between buyers and sellers on the platform.
• Tukaatu's liability in any dispute shall be limited to facilitating communication and mediation between the buyer and seller.
• Tukaatu does not guarantee continuous, uninterrupted, or error-free access to the platform and shall not be liable for any losses resulting from platform downtime or technical issues.