This Privacy Policy explains how RabitX Technologies Private Limited ("RabitX", "we", "us") handles personal data when you use our website, web app, gift card checkout and hardware wallet shop. We are the data fiduciary for this data under India's Digital Personal Data Protection Act, 2023 ("DPDP Act").
We collect only what we need to provide the Services, keep you safe and meet our legal obligations, and we never sell your personal data.
1. What we collect
Information you give us
- Contact details: your email address and, for some services, your phone number.
- Shop orders: your name, shipping address, city, postcode and country.
- Identity verification: your name, date of birth, government ID (such as PAN, Aadhaar, passport or driving licence), a selfie and, for higher limits, proof of address.
- Transactions: wallet addresses, amounts, tokens, networks, payment method details and the transaction hashes of your orders.
- Messages you send to our support team.
Information collected automatically
- Your IP address and browser user agent, which we use to prevent fraud and abuse and which we pass to Cryptorefills with gift card orders.
- Basic technical logs, such as the pages requested and errors, kept to run and secure the Services.
Information from others: identity verification providers, payment providers and banks, blockchain analytics tools and Cryptorefills may share information with us about your verification, payments and orders.
We do not knowingly collect data from anyone under 18.
2. How we use it
- To provide the Services: process trades, deliver gift card orders, ship shop orders and send receipts and order updates.
- To verify your identity and screen transactions, as required by the Prevention of Money-laundering Act, 2002 and the rules made under it.
- To detect and prevent fraud, abuse and security incidents, including rate-limiting orders.
- To answer your questions and handle complaints, refunds and warranty claims.
- To meet our legal, tax and accounting obligations and respond to lawful requests from authorities.
- To improve the Services, using aggregated information that does not identify you.
We process your data because you consented to it when you used the Services, because it is needed to complete the transaction you asked for, or because the law requires it. We do not send marketing emails unless you have opted in, and you can opt out at any time.
4. Cookies and browser storage
We do not use advertising or analytics cookies, and we do not track you across other websites. The site stores a few items in your browser's local storage so it works as you expect:
- your shopping cart and recent shop orders;
- your recent gift card orders and preferred gift card country; and
- your display preferences.
This data stays on your device and is not sent to us. You can clear it at any time from your browser settings. Product videos are embedded from YouTube in privacy-enhanced mode (youtube-nocookie.com), which does not set cookies until you play a video.
Live crypto prices are fetched by our servers from CoinGecko and Coinbase, so your browser does not contact them directly.
5. How long we keep it
We keep personal data only as long as we need it. Identity verification and transaction records are kept for at least five years after our business relationship ends, as required by the Prevention of Money-laundering Act, 2002. Shop orders and invoices are kept for eight years to meet tax and accounting rules. Support messages are kept for two years. After that, data is deleted or anonymised.
6. How we protect it
We use encryption in transit, access controls, limited staff access and regular reviews to protect your data. No system is perfectly secure, so if a breach affects your personal data we will tell you and the Data Protection Board of India as the law requires.
We will never ask for your seed phrase or private keys. Anyone who does is not RabitX.
7. Your rights
Under the DPDP Act you have the right to:
- get a summary of the personal data we hold about you and how we use it;
- have inaccurate or incomplete data corrected or updated;
- have your data erased when it is no longer needed, unless the law requires us to keep it;
- withdraw consent you have given, without affecting processing that has already happened;
- nominate someone to exercise your rights if you die or become incapacitated; and
- have your complaints handled by our Grievance Officer, and then by the Data Protection Board of India if you are not satisfied.
To use any of these rights, email rabitxtech@gmail.com from the address linked to your orders or account. We may need to confirm your identity first. We respond within 30 days.
8. Changes to this policy
We may update this policy from time to time. The date at the top of this page shows when it last changed, and we will tell you about significant changes by email or in the app.
Grievance Officer
In line with the Information Technology Act, 2000, the Consumer Protection (E-Commerce) Rules, 2020 and the Digital Personal Data Protection Act, 2023, you can raise a complaint with our Grievance Officer:
- Grievance Officer, RabitX Technologies Private Limited
- Email: rabitxtech@gmail.com
- Address: No 55, Poonamallee High Road, Pallavan Nagar, Nerkundram, Chennai, Tamil Nadu 600107, India
- Hours: Monday to Friday, 10:00 to 18:00 IST, except public holidays
We acknowledge every complaint within 48 hours and aim to resolve it within one month of receiving it. Please include your order or transaction ID and any screenshots that help explain the problem.
Contact us
Questions about this policy can be sent to rabitxtech@gmail.com. You can also write to us at:
- RabitX Technologies Private Limited
- No 55, Poonamallee High Road, Pallavan Nagar, Nerkundram, Chennai, Tamil Nadu 600107, India
We reply to most emails within two business days.