Privacy policy

We collect what an account and a listing need, and one anonymous measure of how the site is used. We do not sell your data, we do not run advertising trackers, and we do not use cookies to follow you around the internet.

You can download everything we hold, correct it, or delete it — all three from your Settings page, all three taking effect immediately.

Account: your name, email address, and mobile number if you give one. Needed to create the account, sign you in, and contact you about it. The password is handled by our authentication provider and is never stored by us in a readable form.

Listings: everything you type into your shop's listing. This is published deliberately — a directory nobody can find is not a directory.

A callback request: if you ask a shop to call you back without an account, the mobile number you type and your note. The shop sees the note at once and your number only if it chooses to unlock it. We delete the number after 90 days.

Walk lists and plans: if you use Plan the walk, the shops you put on a list, what you typed beside each (a note, a quantity, a target price, things to check), and for a plan the day, times, ticks, amounts paid and notes you write. Only you can see them. They are never shown to a shop or counted into anything a shop is sold.

Messages you send us: the text of a correction, a contact message or a grievance, and the name, email or phone you choose to leave with it. Those are optional except on a grievance, where we need some way to answer you.

Usage: which pages and categories get looked at, how many results a search returned, and which tower pages get opened. This is how we work out what the market actually looks for.

If you arrive through a link carrying campaign tags (utm_source and the like), we record those tags once, so we can tell which links bring people. They are joined to what you do later that day by the same daily hash, and to nothing else.

That is the whole list. We do not collect location, device identifiers, contacts, or anything from your browser beyond what is described here.

Two things, separately, and you can change either at any time in Settings.

Running your account — creating it, keeping you signed in, and telling you about things you asked for: replies to your messages, quotes on your requests, and changes to a shop you own. This one is required, because there is no version of an account that does not involve it. Withdrawing it means deleting the account, which you can do yourself.

Email about the platform — occasional news about features and the market. Entirely optional, off unless you turn it on, and refusing it changes nothing else.

We record each decision separately with the date, the exact wording you were shown, and the version of this notice. If we change this notice we ask again rather than assuming the old answer still stands.

We do not set a tracking cookie, and the usage measure itself never stores your IP address. Instead, a one-way hash is computed from your network address, your browser's user-agent string, a secret held on our server, and today's date. That digest is what gets stored.

One correction, because the distinction matters: our hosting provider, Vercel, records your IP address and browser in its own request logs whenever you load a page, in the ordinary course of serving the site. Those are records we control, so it would be wrong for us to tell you your IP address is stored nowhere. It is never joined to your account, and never to the usage measure described above.

Because the date is part of it, the same visitor produces a different value tomorrow. Actions can be joined up within a day — which is what tells us whether people find what they came for — and cannot be joined up across days, by us or by anyone who obtained the data.

Search terms are stored separately and in aggregate, to find gaps in the catalog. They are never attached to a person.

We save each question you type into the chatbot, the previous question and answer topic, and a copy of the reply it showed you. A random chat ID groups turns during one visit; no account ID is attached. Staff review whether the reply fit the question, add missing written answers, and can download a month of turns. These records are deleted after 365 days. Staff may manually upload a monthly export to ChatGPT to help improve the written content after checking it for personal details; the chatbot itself does not send your messages to an AI service.

The person responsible for how this site handles personal data is Ishaan Walia, the developer who built and runs it. They decide what is collected and why, and they answer for it. They are also the Grievance Officer named below, so a question about your data and a complaint about it reach the same person.

The Act also lets a person manage their consents through a Consent Manager — a separate company, registered with the Data Protection Board, that holds your consents in one place and passes your decisions to every service you use. We are not a Consent Manager, and we do not yet take instructions from one: the registration process the Act describes has not opened.

Until it does, consent is given and withdrawn on this site, in Settings. When registered Consent Managers exist we will accept a withdrawal made through one as being as good as one made here, and we will say so on this page.

The Act treats every service we use as a transfer, and makes us — not them — responsible for it. So here is the full list, what each one gets, and where it is. Each one handles your data only to provide the service named, on the provider's own published data-processing terms, and for nothing else.

That is the complete list. There is no advertising network, no tag manager and no third-party tracker on this site. The one measurement product, Vercel Web Analytics and Speed Insights, is cookieless and is served from our own domain; it counts page views and how fast pages load without following a person from one day to the next. Typefaces are served from our own domain, not from Google.

Anyone at all sees the parts of a shop listing that are published — that is the point of a listing. And law enforcement, if we are legally required to hand something over.

We do not sell your personal data, and we do not "share" it in the sense privacy laws such as California's CCPA use the word — handing it to an advertiser or a data broker so that you can be followed or profiled across other sites.

So there is no "Do Not Sell or Share My Personal Information" switch to look for: there is nothing for it to switch off. If that ever changes it will arrive off, behind a consent you give, and this page will say so before it happens.

These are all the cookies this site sets. Every one is needed to do something you asked for — keep you signed in, remember your language, or finish a password reset. None is used for analytics, advertising or tracking, which is why there is no consent banner: consent is for optional cookies, and there are none.

Sign-in is run by Auth.js inside our own server, against our own Neon database, so no outside company sets a sign-in cookie. The same cookie appears with a `__Secure-` or `__Host-` prefix on the https site, because browsers insist on that prefix there.

Nothing is stored on the visitor's side beyond the two tables below. If you clear your browser's site data, you are signed out and everything here resets.

Account and listing data: while the account is open. If you delete your account, seven days more so you can undo it, and then it is erased — by a job that runs daily, not by us remembering.

Usage measurements: 180 days, then deleted automatically. The daily hash stops being linkable the day after it is written in any case.

A callback number left without an account: 90 days, deleted automatically.

Walk lists: while the account is open. A walk plan and everything written on it: 7 days from the day you create it, or 30 days if you keep it, then deleted automatically. A draft you never create: 7 days after you last touched it. The PDF you download is yours; we do not store it.

Search terms: 365 days. They are not attached to a person at any point.

Messages, corrections and grievances: three years after the matter is closed, so we can show what was asked and what we did about it.

Consent records: for as long as the account exists and then as evidence that we asked — they are the proof that processing was lawful, and deleting them would destroy the record that protects you.

Anything we are required by law to keep, such as records tied to a payment, is kept for the period that law requires and is not used for anything else.

You can see, correct, or ask us to delete the personal data we hold about you, and you can withdraw consent.

None of those need us at all. Signed in, Settings has “Download my data”, which gives you a file containing your profile, your shops, the requests you posted, the quotes you were sent and the reviews you wrote; “Your details”, where you correct your name and mobile number yourself; “What we may use it for”, where you give or withdraw consent in one click; and “Delete this account”.

Deleting signs you out at once and takes any shop you own off the directory. The seven days after that are yours to change your mind in — sign in again during them and everything comes back exactly as it was. Nobody can restore it afterwards, us included. If you would rather not wait, the same form has a box that erases everything immediately.

Your email address is the one thing you cannot change yourself: it is how you sign in, and the new one has to be confirmed before the old one stops working. Ask us and we will do it.

If your shop is listed and the details are wrong, the correction form fixes it faster than anything else — you do not need an account to use it.

The Act gives you something most privacy laws do not: the right to name someone else to exercise these rights on your behalf if you die or become unable to.

The Government's rules for how this works are still to be published. Until they are, write to our Grievance Officer with the person's name and how to reach them, and we will record it against your account. When the rules arrive we will build whatever they specify and honour what we have already recorded.

A nominee proves who they are before we act on anything — we will ask for identification and for evidence of the circumstances.

This site is for people who buy and sell IT hardware, and it is not intended for anyone under 18. The terms of use say so, and creating an account is a statement that you are 18 or over.

We do not knowingly collect data from a child. If we learn that an account belongs to someone under 18, we delete it and everything on it rather than asking for a parent's consent, because there is nothing here a child needs.

We do not profile anyone or serve behavioural advertising, so none of the tracking the Act specifically forbids for children happens to anyone on this site, whatever their age.

If you believe a child has given us data, tell our Grievance Officer and we will remove it.

Our Grievance Officer under the Digital Personal Data Protection Act 2023 is Ishaan Walia. Write to info@webnetasia.com, or use the grievance form on this site — both reach the same person.

We log every grievance with the date it arrived and answer within 30 days.

If our answer does not satisfy you, you may take the matter to the Data Protection Board of India.

If personal data here is exposed or taken, we will tell the Data Protection Board and the people affected. Our own target is 72 hours from confirming it, which is the international norm — the Act's own deadline is still to be set in the rules.

What we tell you will say what was exposed, what it means for you, and what we are doing about it. We would rather say it early and incompletely than wait until we have a tidy story.

Data is encrypted in transit. Our database is not reachable from a browser: the public data API is switched off and every table denies access by default, with authorisation checked on our server for every request. Private messages are encrypted before they are stored, with a key the database does not hold.

No system is perfectly secure. If you find a vulnerability, tell us through the contact page before telling anyone else, and we will not come after you for it.

Newest first. A change that alters what you are agreeing to means we ask for your consent again; the rest are corrections and clearer wording, and we do not pretend they are more.