Privacy Policy

All policies

Last updated October 18, 2026

Effective date: 18 October 2026

This Privacy Policy explains how MoreBasket Private Limited, a private limited company incorporated under the laws of India, registered at Ozone Techno Park, 24, Rajiv Gandhi Salai, Navalur, Chennai, Tamil Nadu 600130, India (“morebasket”, “we”, “us”), collects, uses, shares and protects personal data when you visit https://www.morebasket.com (the “Website”), join our waiting list, create an account, or use our online-store platform and related services (together, the “Services”). It also explains your rights and how to exercise them.

We wrote it to be read. If something is unclear, write to admin@morebasket.com.

1. Who is responsible for your data

We act in two different roles, and the difference matters.

We are the controller (decide why and how personal data is used) for personal data about:

visitors to our Website;
people on our waiting list;
prospective and current customers of morebasket, including the people you authorise to use your account (“Account Holders”); and
people who contact us.

We are a processor (or service provider) for the personal data your customers and other individuals give you through a Store you build with morebasket (“Store Data”), such as your shoppers’ names, addresses, orders and payment-related details. For Store Data, you (the store owner) are the controller and decide how it is used. We process it only on your instructions under our Data Processing Addendum. If you bought something from a Store built with morebasket, please read that store’s own privacy notice and contact the store owner about your data. If you contact us, we will pass your request to the store owner.

Our contact details for privacy matters are in section 14. Where the law requires us to have a data protection officer, a representative in the EU or UK, or a grievance officer (for example in India), those details are also in section 14.

2. The personal data we collect

2.1 Data you give us

Waiting list and contact: your email address, and anything you write in a message to us.
Account: your name, email address, password (stored in hashed form, never in plain text), company name, role, billing country and billing details, your plan, and your settings and preferences.
Payments for our fees: your billing name, address and tax identifiers where we must collect them. Card details are collected and held by our payment provider, not by us.
What you tell our AI features: text you type into our prompt box, descriptions of your shop and products, and instructions you give to Shopmate or to the AI agents.
Support: the content of your conversations with us and any files you send.

2.2 Data we collect automatically

Device and connection data: IP address, browser type and version, operating system, device type, screen size, language, referring and exit pages, time zone, and the date and time of your visit.
Approximate location: your country, worked out from your IP address by our hosting provider so we can show prices and language options for your country. We do not store your IP address for this, and we do not collect precise location.
Usage data: the pages you view, how far you scroll, what you click or tap (including clicks that do nothing), the features you use, errors, and performance measures (such as page-loading times).
Campaign data: the website you came from and any campaign tags in the address (for example utm_source), so we can see which marketing works. When you join the waiting list, this is saved with your sign-up.
Session recordings: if you accept analytics, we record how you move through our Website (mouse movement, clicks, scrolling and page changes) to find and fix confusing parts. What you type into form fields is masked and is not recorded.
Cookies and similar technologies: described in our Cookie Policy.

2.3 Data from others

Third-Party Services you connect, such as payment, shipping and sales-channel providers, send us data needed to make the integration work (for example payment status or tracking updates).
Our service providers may send us information about the use of our Services, such as analytics reports.
Store owners may give us personal data about their staff when they invite them.

2.4 Special categories and children

We do not ask for sensitive personal data (such as health, biometric, political or religious information) and ask you not to put it into the Services unless you need to for a lawful purpose of your own. Our Services are not directed to children, and we do not knowingly collect personal data from anyone under 18. If you think a child has given us personal data, contact us and we will delete it.

3. Why we use your data, and the legal basis

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases.

What we do	Why	Legal basis
Run the Website, show it correctly in your country and language, keep it secure and prevent abuse	To provide a working, safe site	Legitimate interests (a secure, reliable service)
Create and manage your waiting-list entry and tell you when your access opens	To give you access you asked for	Your consent when you sign up, and legitimate interests in running the beta
Create and manage your account, provide the Services, give you support, and take payment for our fees	To perform our contract with you	Contract
Provide the AI features and process what you ask them to do	To perform our contract with you	Contract
Measure how the Website and Services are used and improve them (analytics, session recordings, performance)	To understand and improve our product	Your consent, which you can withdraw at any time
Work out which campaigns bring sign-ups	To spend our marketing sensibly	Your consent for analytics tools; legitimate interests for the campaign details you give us with your own sign-up
Send service messages (security, changes to terms, billing)	To run the service and meet obligations	Contract and legitimate interests
Send product news and offers	To tell you about relevant features	Consent, or legitimate interests where the law permits, always with an unsubscribe link
Detect, prevent and investigate fraud, abuse and security incidents	To protect you, us and others	Legitimate interests, and legal obligation where required
Comply with law, respond to lawful requests and defend legal claims	To meet our legal duties and protect our rights	Legal obligation and legitimate interests

Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details of that balancing. You can object, as described in section 9.

4. Analytics, cookies and similar tools

We use the following on our Website. Which of them run depends on your choice in our cookie banner.

PostHog (product analytics, session recordings, performance and error measures). It is switched off until you accept. Hosted in the United States.
Google Analytics 4 (page views and campaign measurement). Before you accept, it runs in a restricted mode that does not set analytics cookies; after you accept it uses cookies. Google acts as our processor for this purpose.
Vercel Web Analytics and Speed Insights (visit counts and page speed, without cookies).

You can change your choice at any time with “Cookie settings” in the footer of every page. Declining does not stop you using the Website. We do not use advertising or retargeting cookies, and we do not allow analytics providers to use your data for their own advertising. Our Website honours the “Do Not Track” and “Global Privacy Control” signals sent by your browser by treating them as a decline of analytics.

5. Artificial intelligence

Our AI features, including the AI store builder, Shopmate and the AI agents, generate drafts and carry out tasks that you request. To do that, the text and store information you provide, and relevant data from your store, are sent to AI model providers that act as our subprocessors (listed in Subprocessors). We do not use your store content, products, customers’ data or prompts to train our own foundation models, and we require our AI providers not to use that data to train their models. We use the content you give the AI features, and what they return, only to provide the feature to you, to keep it secure, to resolve errors and abuse, and to improve how we deliver it in ways that do not expose your content to others.

The AI features support you in making decisions about your own store. We do not use personal data to make automated decisions about individuals that produce legal or similarly significant effects for them. If you use AI agents to take actions in your Store, you decide which actions need your approval, as the AI Features and Agents Terms explain.

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We share it only as follows.

Service providers (subprocessors) that help us run the Services under written contracts: hosting and content delivery, databases, analytics, email, payment processing, customer support and AI model providers. They may use the data only for us and under our instructions. See Subprocessors.
Third-Party Services you choose to connect (for example Stripe, PayPal, Shippo, Gelato, Printrove, Google, Meta, Etsy, TikTok, Pinterest). We send them the data needed for the integration, and they use it under their own privacy policies.
Professional advisers, such as lawyers, accountants and insurers, under duties of confidentiality.
Authorities and other parties where the law, a court order or a valid request from an authority requires, or where needed to protect rights, safety or property, or to detect fraud.
Corporate transactions: if we are involved in a merger, acquisition, financing, reorganisation or sale of assets, personal data may be transferred as part of it, and we will tell you if that changes how your data is handled.
With your consent or at your direction.

7. International transfers

We and our providers operate in several countries, including the United States. When we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland to a country without a decision recognising an adequate level of protection, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, or, for US recipients certified under it, the EU-US Data Privacy Framework and its UK and Swiss extensions. Where a provider has certified under the Data Privacy Framework, we may also rely on that. You can ask for a copy of the safeguards by writing to admin@morebasket.com.

8. How long we keep personal data

We keep personal data only as long as needed for the purposes in this policy, and then delete or anonymise it. As a guide:

Waiting-list data: until you ask us to delete it, until we have invited you and your sign-up is no longer needed, or 24 months after your last activity, whichever is first.
Account data: for as long as your Account is active, and then for up to 12 months to handle claims and disputes, unless the law requires us to keep it longer (for example, accounting and tax records are kept for the period the law sets, often 6 to 10 years).
Store Data: while your Account is active, and then as the Data Processing Addendum says. Where you export or delete it earlier, it is removed on request, except for backups, which are overwritten on a regular cycle.
Analytics data: up to 14 months for Google Analytics and up to 12 months for PostHog. Session recordings are kept for up to 30 days.
Support communications: up to 3 years after the conversation ends.
Security logs: up to 12 months, or longer where needed to investigate an incident.

If a longer period is needed because of a dispute or a legal duty, we keep the data only as long as that need lasts.

9. Your rights

Depending on where you live, you may have some or all of these rights. We apply them to everyone where we reasonably can.

Access the personal data we hold about you and get a copy.
Correct data that is wrong or incomplete.
Delete your data, in the circumstances the law sets out.
Restrict how we use your data while a dispute about it is resolved.
Object to our use of your data based on our legitimate interests, and to direct marketing at any time.
Data portability: receive the data you gave us in a commonly used, machine-readable format and have it sent to another service where technically feasible.
Withdraw consent at any time, where we rely on it. Withdrawal does not affect what we did before. You can do this with “Cookie settings” or by emailing us.
Not be subject to solely automated decisions with legal or similarly significant effects (we do not make such decisions).
Complain to your data protection authority. In the EU and EEA, you can find yours at edpb.europa.eu; in the UK, it is the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to put things right first.

To use a right, email admin@morebasket.com. We may need to verify your identity, and we will reply within one month (or the period your local law sets). If a request covers Store Data, we will direct you to the store owner, or help the store owner to respond, as the law requires. We do not charge for a request unless it is manifestly unfounded or excessive.

9.1 California and other US states

If you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon or another US state with a comprehensive privacy law, you have the rights to know what we collect, to access and delete it, to correct it, to opt out of the sale or sharing of personal information and of targeted advertising and profiling, to limit the use of sensitive personal information, and to not be discriminated against for using these rights. In the past 12 months we have collected these categories: identifiers (such as email address and IP address); internet and device activity (pages viewed, clicks); commercial information (your plan and billing records); professional information (your company name and role); approximate geolocation (country); and the contents of your communications with us. We use them for the purposes in section 3, and we disclosed them to the service providers in section 6. We do not sell personal information and do not share it for cross-context behavioural advertising, and we do not knowingly sell or share the personal information of anyone under 16. We do not collect sensitive personal information for purposes other than providing the Services. You can use an authorised agent to make a request; we will ask for proof of authority. If we refuse, you may appeal by replying to our decision, and you can contact your state’s attorney general.

9.2 Brazil, India, Canada, Australia, Japan, Singapore and elsewhere

If you live in a country with a law that gives similar rights (for example Brazil’s LGPD, India’s Digital Personal Data Protection Act 2023, Canada’s PIPEDA, Australia’s Privacy Act 1988, Japan’s APPI or Singapore’s PDPA), you can exercise your rights in the same way, using section 14. Where the law requires a named officer in your country, you will find them there.

10. Security

We use technical and organisational measures that are appropriate to the risk, including encryption of data in transit, access controls and least-privilege access for our staff, logical separation of each Store’s data from other Stores’ data, hashing of passwords, monitoring, and vendor due diligence. No online service is completely secure, and we cannot promise absolute security. If we become aware of a personal-data breach that is likely to put your rights at risk, we will tell you and the authorities as the law requires. To report a vulnerability, see our Responsible Disclosure Policy.

11. Links to other sites and Stores

The Website and Services may link to other sites and to Stores operated by our customers. We are not responsible for their content or privacy practices. Please read their policies.

12. Marketing messages

We send marketing emails only to people who asked for them or where the law allows. Every message has an unsubscribe link, and you can also email us. We will still send service messages, such as security alerts and billing notices.

13. Changes to this policy

We will update this policy as our Services or the law change. We will post the new version here with a new effective date, and if the change is material we will give you notice, by email or in the Services, before it takes effect where the law requires. The latest version always applies.

14. Contact us

Controller: MoreBasket Private Limited, Ozone Techno Park, 24, Rajiv Gandhi Salai, Navalur, Chennai, Tamil Nadu 600130, India Privacy requests and questions: admin@morebasket.com Data protection officer or privacy lead: Sathish, Privacy Lead, admin@morebasket.com EU representative (GDPR Article 27): Not currently appointed. Please contact our privacy lead above. UK representative (UK GDPR Article 27): Not currently appointed. Please contact our privacy lead above. Grievance officer (India): Sathish, Grievance Officer, admin@morebasket.com, Ozone Techno Park, 24, Rajiv Gandhi Salai, Navalur, Chennai, Tamil Nadu 600130, India Encarregado (Brazil, LGPD): Sathish, Privacy Lead, admin@morebasket.com