Privacy Policy

Pasalae, operated by Anmol Karki. Contact: karkianmol9841@gmail.com

When you sign up and run a store, we collect your name, email, phone number, password, your store details and content, and your plan payments.

Your password is stored only as a one-way hash. Your eSewa secret key and Nepal Can Move token are stored encrypted and are never shown again.

We use this to run your account, take plan payments and send service emails: orders, reminders, password resets and low-stock alerts.

When you order from a Pasalae shop, we collect your name, phone number, optional email, delivery address and the order itself.

We handle this for that shop. It goes to the seller, to Nepal Can Move to deliver your order, and to eSewa if you pay that way.

The seller decides how to use it for their business, so contact them first. You can also contact us.

Sellers get a sign-in cookie. Shoppers' carts and coupon codes are kept in the browser (local storage). We use no advertising or tracking cookies.

If a shopper ticks “Remember my details on this device” at checkout (it's ticked by default), their name, phone, email and delivery address are saved in that browser when they place an order, for next time. Placing an order with the box unticked deletes them, and so does clearing the browser's site data.

• Supabase: database and photos (Tokyo region)
• Vercel: hosting
• Resend: email
• Sentry: error reports, with personal data removed where possible
• eSewa: payments
• Nepal Can Move: delivery

We do not sell personal information.

• We keep your information while your account is active. When a store is closed or deleted it is hidden, but its information is not erased automatically. We keep it until the seller asks us to erase it (email karkianmol9841@gmail.com), except what the law requires us to keep.
• Courier (Nepal Can Move) webhook logs: 30 days.
• Email records: 30 days.
• Abuse-limit counters: only for their short window.

You can ask to see, correct or delete your information by emailing karkianmol9841@gmail.com. We reply within 30 days.

A seller may keep orders they must hold for their tax records.

We use HTTPS everywhere. Passwords are hashed, payment and courier credentials are encrypted, and access is limited to what is needed.

No system is perfectly secure. If a breach puts people at risk, we will tell the people affected.

We post updates here with a new date. Important changes are emailed to sellers.