Coffee Bazaar complies with Apple's App Store Review Guidelines. All in-app purchases on iOS use Apple's native In-App Purchase (IAP) system as required by Apple's Guidelines (Section 3.1.1). We do not direct iOS users to external payment mechanisms for digital content or subscriptions. Subscription management and cancellation on iOS is handled through Apple's native subscription management interface. All entitlements are validated server-side using Apple's receipt validation APIs. We do not circumvent, disable, or interfere with Apple's payment infrastructure.

Coffee Bazaar complies with Google Play's Developer Programme Policies. All in-app purchases on Android use Google Play Billing as required by Google Play's Payments Policy. We do not prompt Android users to use alternative payment methods for in-app subscriptions or digital content purchases. Subscription management and cancellation on Android is accessible through Google Play's standard subscription management interface. Purchase entitlements are validated using Google Play Developer API. We do not circumvent Google's billing requirements.

Web subscription payments on coffeebazaar.in are processed by Razorpay Software Pvt. Ltd., a payment aggregator authorised by the Reserve Bank of India (RBI) under the Payment and Settlement Systems Act 2007. Razorpay is PCI-DSS Level 1 compliant. We do not store, log, or process raw card numbers, CVV codes, UPI PINs, or net banking credentials on our servers. All payment data is tokenised and handled exclusively by Razorpay within their secure, compliant environment. Our checkout integration complies with RBI's guidelines on payment aggregators and payment gateways (March 2020 circular).

Coffee Bazaar's data practices are designed to comply with: (a) the Digital Personal Data Protection Act 2023 (DPDP Act) — we collect only necessary personal data, process it for defined purposes, provide data principals with rights of access, correction, and erasure, and maintain reasonable security safeguards; (b) the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 — phone numbers collected for OTP authentication are treated as sensitive personal data; (c) the Information Technology Act 2000 — we maintain appropriate security practices and procedures. We do not transfer personal data internationally except where required for our sub-processors (Firebase, Supabase) under appropriate contractual safeguards.

Phone OTP authentication is provided by Firebase Authentication (Google LLC), which is compliant with SOC 2, ISO 27001, and GDPR. OTP messages are sent via Firebase's telephony infrastructure. Firebase does not store OTP codes after verification. We use Firebase phone authentication solely for identity verification and do not use it for marketing or any other purpose. Our use of Firebase complies with Google's Firebase Terms of Service and Acceptable Use Policy.

Push notifications are sent only to users who have explicitly granted notification permission through the native OS permission prompt on iOS or Android. We comply with Apple's APNs (Apple Push Notification service) and Google's FCM (Firebase Cloud Messaging) usage policies. Notifications are limited to: market intelligence alerts, subscription status updates, TradeBoard activity on your listings, and critical account notices. We do not send unsolicited commercial messages. Users can withdraw notification consent at any time through device settings or the app's Account section.

Product analytics are provided by PostHog Inc., an open-source analytics platform. We use PostHog to track anonymised usage events (screen views, feature interactions) for the purpose of improving platform reliability and user experience. We do not use PostHog to track personally identifiable information beyond what is necessary for session analytics. PostHog data is not shared with advertisers or used for targeted advertising. PostHog is SOC 2 Type II compliant. Users who do not wish to be tracked may contact us at contact@coffeebazaar.in.

Coffee Bazaar complies with the Consumer Protection Act 2019 and the Consumer Protection (E-Commerce) Rules 2020. We display our refund and cancellation policy prominently before purchase. We do not engage in unfair trade practices, misleading advertisements, or deceptive pricing. Our subscription pricing is clearly displayed before confirmation. We provide a grievance redressal mechanism via contact@coffeebazaar.in. Grievances are acknowledged within 48 hours and resolved within 30 days. The designated Grievance Officer can be contacted at the same email address.

Coffee Bazaar is NOT registered with SEBI, FMC (now merged with SEBI), or any other financial or commodity market regulator. The Platform does not provide regulated investment advice, execute commodity trades, or operate as a commodity exchange or broker. All market data (ICE futures, COT reports, certified stocks) is publicly available information presented in an accessible format for informational purposes only. Users should not treat any content on this Platform as regulated market advice. For regulated commodity trading, users must engage with SEBI-registered entities.