Privacy Policy

Overall (“Overall”, “we”, “us”) runs overallapp.in — this site, the demo at /shop, and the Overall marketplace app when it opens. This policy covers all of them.

Under the Digital Personal Data Protection Act, 2023 we are the Data Fiduciary for the personal data described here, and you are the Data Principal. That means the decisions about your data are ours to answer for, and the rights over it are yours.

Overall is run from Ahmedabad, Gujarat, India. A registered office address and a customer-care phone number will be published on this page before the marketplace takes its first order.

Overall has not launched. Nothing on this site can be bought, no payment can be made, and the shops in the demo are samples, not real shops.

So today there is exactly one way we get personal data from you: you type it into the waitlist form. Everything in section 3 is about that. Section 4 describes what the app will collect once it opens, so that nothing about it comes as a surprise later.

When you join the waitlist, we store:

• your mobile number — required, because it is how we tell you Overall has opened;
• your name, city and email address, if you choose to type them — all three are optional, and the form works without them;
• which page you signed up from, and the date, so we know whether the demo is doing its job.

That is the whole record. We do not ask for, and have no way to collect, your address, your date of birth, your gender, your income, or anything about what you buy.

When you use the demo, your cart lives in your browser’s memory and disappears when you close the tab — it is never sent to us. One flag is saved in your browser’s session storage so the sign-up sheet does not keep reappearing at you. It holds no personal data.

Our server, like every web server, records ordinary technical information about requests it receives — IP address, browser type, the page asked for and when. It is used to keep the site up and to stop abuse, and it is not joined to your waitlist record. The waitlist form is rate-limited by IP address so one person cannot flood it; that check happens in memory and is not stored.

We run no analytics and no advertising trackers. There is no Google Analytics, no Meta pixel, no session recorder and no third-party cookie anywhere on this site. If that ever changes, this page changes first and we will ask you before it does.

When you can actually order from a shop, using the app will need:

• an account — your name, mobile number and, if you use it, your email;
• delivery addresses you save, and, only if you turn it on, your device’s location, so we can show shops that are near you rather than across the city;
• your orders — what you bought, from which shop, for how much, and their status;
• payment — handled end to end by a payment gateway. Your card, UPI PIN and bank credentials go to them and never reach Overall’s servers. We are told whether a payment succeeded and for how much.

This section is here for information. None of it is collected today, and when it starts, this policy will be updated and dated before it does.

We process your data on the basis of your consent, which you give by submitting the waitlist form after reading the line beside it, and — once the app opens — for the purposes that are necessary to give you what you asked for.

• Your mobile number: to send you the message that Overall has opened in your city.
• Your city: to decide which cities to open in first, and to tell you when yours is one.
• Your name: to address you like a person.
• Sign-up page and date: to understand which parts of this site work.

We will not use your number for anything else. We do not send marketing blasts, we do not sell, rent or trade personal data with anybody, and we do not share it for advertising.

You can withdraw consent at any time by emailing contact@overall.co.in. Withdrawing is as easy as giving it: one email, no reason needed, and we delete your record.

We use a small number of service providers — Data Processors, in the language of the Act — who handle data only on our instructions:

• Hostinger — hosts this site, the Overall API and the database.
• Razorpay — will process payments; card details go to them, never to us (not in use yet).
• Cloudinary — will store the photographs shops upload for their products (not in use yet).
• An SMS provider — will send the one message telling you Overall has opened (not in use yet).

When the marketplace opens, the shop you order from and, if delivery is used, the person delivering it will be given what they need to fulfil that order — your name, the delivery address and what you ordered. Nothing more.

We will also disclose data where the law requires it: a court order, a lawful demand from an authority, or to protect someone’s safety. We will tell you when we are allowed to tell you.

• Waitlist records: until we have sent you the message that Overall has opened in your city, or until you ask us to delete them — whichever comes first. If Overall has not opened in your city within 18 months of your signing up, we delete the record without being asked.
• Server logs: a short period for security and troubleshooting, then they roll over.
• Orders and invoices, once there are any: for as long as tax law requires records of a transaction to be kept, even if you delete your account. That is an obligation we cannot contract out of.

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• know what personal data of yours we hold and what we have done with it;
• correct or complete anything wrong or missing, and update it;
• erase it, where we no longer need it for the purpose you gave it for;
• nominate another person to exercise these rights if you die or become incapable of exercising them yourself;
• complain to us, and — if we do not resolve it — to the Data Protection Board of India.

To use any of them, email contact@overall.co.in from the address you gave us, or from any address, telling us the mobile number you signed up with. We answer within 30 days, usually far sooner, and we do not charge for it.

Overall is meant for people aged 18 and over, and accounts are not open to children. We do not knowingly collect the personal data of a child. If you believe a child’s data has reached us, write to contact@overall.co.in and we will delete it. We do not use anyone’s data for behavioural advertising or tracking, children included.

The site and the API are served only over HTTPS. Account passwords, when there are accounts, are stored as one-way hashes and cannot be read back — not even by us. Access to the database is limited to the people who run Overall. Bank details, which only shops and delivery partners give us, are encrypted before they are stored.

No system is perfectly safe, and we would rather say so than imply otherwise. If personal data is ever breached, we will inform the Data Protection Board of India and every affected person, as the Act requires, with what happened and what to do about it.

Write to contact@overall.co.in. Until a named Grievance Officer is appointed — which happens before the marketplace takes its first order — every complaint is read and answered at that address.

We acknowledge a complaint within 24 hours and resolve it within 15 days, and in no case later than the one month allowed by the Consumer Protection (E-Commerce) Rules, 2020.

If we have not sorted it out, you can take a data-protection complaint to the Data Protection Board of India, and a consumer complaint to the National Consumer Helpline (1915) or the consumer commission with jurisdiction over you.

When this policy changes, the date at the top changes with it. If a change means we want to use data you have already given us for something new, we will ask you first rather than treat silence as a yes.