Privacy Policy

Last updated: May 2026

This Privacy Policy explains how Hanmela (“we”, “us”, “our”) collects, uses, and protects personal information when you use our marketplace platform at hanmela.com.

1. Information We Collect

Account information: name, email address, and password (hashed) when you register.
Profile information: shipping addresses, phone number, and profile photo if provided.
Transaction data: orders placed, products purchased, payment references (we do not store card details — all payments are processed by Razorpay).
Communications: messages sent through the platform between buyers and sellers.
Usage data: pages visited, search queries, browser type, IP address, and timestamps collected via server logs.

2. How We Use Your Information

To process orders and facilitate transactions between buyers and sellers.
To send order confirmations, shipping updates, and support responses.
To verify seller identities and prevent fraud.
To improve platform features and fix technical issues.
To comply with legal obligations under applicable Indian and Korean law.

3. Sharing of Information

With sellers: buyers' shipping name, address, and order details are shared with the relevant seller to fulfil orders.
With payment processors: Razorpay receives payment information necessary to complete transactions.
With service providers: hosting and analytics providers under confidentiality agreements.
We do not sell personal information to third parties.
We may disclose information if required by law, court order, or government authority.

4. Cookies

We use session cookies for authentication (NextAuth.js). These are strictly necessary and cannot be disabled.
We may use analytics cookies to understand usage patterns. You can opt out via your browser settings.
No third-party advertising cookies are currently in use.

5. Data Retention

Account data is retained for as long as your account is active, plus 2 years after closure for legal compliance.
Order records are retained for 7 years as required by Indian tax law.
You may request deletion of your account and non-transactional data by contacting privacy@hanmela.com.

6. Security

All data is transmitted over HTTPS/TLS.
Passwords are hashed using bcrypt with a cost factor of 12.
Payment data is handled exclusively by Razorpay, which is PCI-DSS Level 1 certified.
We conduct periodic security reviews and promptly patch identified vulnerabilities.

7. Your Rights

Access: you may request a copy of personal data we hold about you.
Correction: you may update profile and address data at any time from your account settings.
Deletion: you may request account deletion by emailing privacy@hanmela.com.
Portability: you may request your data in a machine-readable format.
For users in the EU/EEA, additional rights under GDPR apply.

8. Children

Hanmela is not intended for children under 13. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact privacy@hanmela.com.

9. Changes to This Policy

We may update this policy periodically. Material changes will be communicated via email or a prominent notice on the platform. Continued use of Hanmela after changes constitutes acceptance.

10. Contact

For privacy questions or requests: privacy@hanmela.com
Hanmela — Blue Ridge Trade LLP + Kindra Global