Privacy Policy for Sobuh Users and Creators

Sobuh may collect identity data, contact details, account credentials, phone and email verification data, addresses, location or city preferences, orders, bookings, payments metadata, refunds, support messages, creator business details, KYC or verification records where enabled, uploaded media, reviews, chat content, device data, IP address, security logs, cookies, and analytics events.

Sobuh processes personal data to create and secure accounts, enable marketplace discovery, process orders and bookings, verify payments, route refunds, support creator payouts where enabled, deliver notifications, provide customer support, resolve disputes, moderate content, prevent fraud, improve product experience, comply with law, and maintain audit records.

Sobuh should show concise privacy notices at signup, creator onboarding, checkout, address collection, support requests, media upload, KYC, payout setup, marketing consent, and optional personalization. Where consent is the basis for processing, Sobuh should provide an easy way to give, manage, review, and withdraw consent.

Sobuh may share limited data with payment providers, logistics partners, authentication providers, cloud hosting, analytics, messaging, storage, fraud prevention, professional advisors, and government or legal authorities where required. Sobuh should not sell personal data. Processor names and purposes should be kept current before launch.

Sobuh retains personal data only for the period needed for the relevant purpose, legal obligations, accounting, tax, fraud prevention, dispute resolution, security, and audit trails. India DPDP Rules 2025 include staged commencement and specific retention-related obligations for certain classes of entities, so final retention schedules must be checked against Sobuh's actual scale and classification.

Users should be able to access, correct, update, delete, and request information about personal data, withdraw optional consent, manage communication preferences, nominate where legally supported, and raise privacy complaints through /privacy/rights. Some records may be retained where law, disputes, tax, fraud, or transaction integrity requires it.

Sobuh should use reasonable technical and organizational safeguards such as HTTPS, access controls, audit logs, secret management, least privilege, secure payment-provider verification, encryption where appropriate, backups, incident handling, and monitoring. No public policy should disclose sensitive architecture details.

Sobuh is intended for users who can lawfully contract or use the service with valid guardian consent where applicable. Age-related rules are published at /age-policy. Sobuh should avoid collecting children's personal data unless the final product design, consent flow, and legal basis support it.