Privacy Policy & Data Protection Notice

OVERC · Effective: 12 November 2026 · Version 1.1 · Under India's Digital Personal Data Protection Act, 2023

1. Who we are

OVERC ("we") operates a web app where shops record credit sales, send purchase notes to customers, and can place automated order-confirmation and payment-reminder calls. Contact & Grievance Officer: overc414@gmail.com

2. What data we collect

About sellers (shop accounts): sign-in email (you sign in with Google, or with email and password), shop name, owner name, mobile number, UPI ID (for rewards), city, business type, and who referred you.
About buyers (entered by the seller): name, mobile number, items, amount, due date, payment status, and any bill photos the seller attaches. When the buyer opens their purchase note: whether they confirmed or disputed it (with the reason), their network-sharing choice and when they made it, and chat messages between buyer and shop.
AI calls: when a signed-in seller starts an order-confirmation or payment-reminder call, the details needed for the call (buyer name, mobile number, amount, items, delivery address or due date, and shop name) are sent to our calling provider. The call's status, transcript, summary, duration and outcome (for example confirmed, cancelled, address changed, call back, paid, promised or disputed) are returned to the seller who placed the call.
Score-lookup abuse prevention: when a signed-in merchant checks a buyer's OVERC payment indicator, anonymous network summary or detailed history, we record the requesting merchant account, the check time and a project-salted, one-way digest of the searched mobile number in a protected internal database table. We do not store the searched mobile number itself in this abuse-detection log. These records help enforce per-minute, hourly, daily and unique-customer lookup limits; records older than 30 days are cleaned up during subsequent lookup activity, rather than on a fixed deletion schedule.
Approved B2C pre-dispatch partners: a verified online seller may submit an order reference, customer name, mobile number, delivery address and a declaration that the buyer received an appropriate processing notice. OVERC uses the mobile number only to obtain the existing eligibility-gated green/yellow/red/gray merchant-payment indicator; names and addresses are not independently validated or stored in the partner usage database. We retain the partner account, request time, one-way project-salted hashes of buyer mobile and order reference, returned color and applicable usage charge for audit, rate limits and billing. Buyer names, delivery addresses and raw phone numbers are not returned to the partner in the indicator response. Such personal data may pass through secure hosting infrastructure while a request is handled.
Requests you make: access, correction, erasure or grievance requests you file with us.
Analytics, only if you tap "Allow" on our consent banner: usage events (PostHog), a device identifier (FingerprintJS), visit count, days since your first visit and where the visit came from (for example Instagram, Google or direct). Your IP address reaches PostHog as part of these requests. Tap "Only essential" and none of this is loaded. Your choice is saved on your device; you can change it with the button below.

3. Why we use it (purposes)

To run the seller's account and store their deals.
To deliver the purchase note to the buyer and record confirmation or dispute.
To help the seller remind the buyer about payment, by WhatsApp message or, if the seller chooses, an AI reminder call.
To let the seller confirm a cash-on-delivery order by AI call before shipping.
To provide approved online sellers with an optional pre-dispatch payment-history indicator for COD orders. This is separate from voice confirmation and never independently proves a customer identity, validates an address or determines whether a package must be sent. The online seller makes its own dispatch decision. Only eligible buyer-consented records enter the merchant network indicator.
Network payment indicator: a signed-in shop first sees a color (gray, green, yellow or red). When eligible records come from two or more independent other merchants, the Score page also shows anonymous totals for paid-on-time, paid-late/uncertain, pending and overdue transactions. No individual amount, date or reporting-shop name is included in this free summary. Only buyer permissions explicitly given or renewed after seeing the revised OVERC network-sharing notice (version v1.2, introduced 13 November 2026) contribute to the free aggregate view. A timestamp alone is not treated as proof of accepting the revised notice. Older consents remain subject to the original color and metered-detail permissions. A seller can separately see a summary of its own records. Up to two detailed checks per calendar month are free; an active paid plan can allow more. A detailed check reveals only the amount, due date and days overdue, never the reporting shop name, buyer name, items or bill photos. Private, disputed, not-yet-eligible or non-consented deals are excluded. This is a merchant-reported indicator, not a bureau credit score or fraud finding. See our Terms.
To run the seller rewards program (Kamai) and payouts.
For security, dispute resolution, and legal compliance.

4. COD order-confirmation and AI payment-reminder calls

Separate services: COD Order Confirmation is solely for confirming cash-on-delivery orders before dispatch. AI Payment Caller is solely for manually contacting customers about overdue credit transactions recorded by the same shop. They have separate on/off switches, separate calling-hour preferences and separate per-customer attempt limits. No automatic calling schedule runs in either service. A shared safety rule restricts total shop call attempts and requires a 24-hour gap between different call types to the same customer.

AI calling beta controls: merchants can set India-time calling hours and maximum attempts per recipient in a rolling seven-day period. Each attempted call records the requesting merchant account, recipient mobile number, call type, timestamp and a declaration that the merchant has permission to call. These records are used to enforce safety limits and may include unsuccessful provider attempts. Calls require a deliberate merchant action; this beta does not run an automatic calling schedule. Reminders are blocked for deals marked paid, disputed or not yet due. The customer may decline calls or request that calls stop; merchants must respect such requests.

Calls are placed only by a signed-in seller, and for order confirmation only after the seller confirms the customer expects the call.
The call is made by an AI voice agent (in Hindi/Hinglish) through Bolna, a third-party voice AI service, on the seller's behalf. It never asks for OTPs, bank, card or PIN details.
The calling agents are set to call only between 9 am and 8 pm.
OVERC does not save the transcript in its own database; it is fetched from Bolna and shown to the seller who placed the call. Bolna keeps the call record on its systems.
The buyer can decline, say they can't talk, or simply end the call at any time.

5. Your rights (DPDP Act)

Access: ask what data we hold about you.
Correction & completion: fix inaccurate data.
Withdraw consent: stop network sharing of a record at any time from its purchase-note link, or by writing to us.
Erasure: request deletion where legally permitted.
Grievance: complain to us first; if unresolved, to the Data Protection Board of India.

Write to overc414@gmail.com. We acknowledge within 72 hours and resolve within 30 days, free of charge.

6. How we protect it

✔ Payment indicators are based on merchant-reported records; a colored signal is not a verified credit score
✔ Disputed records are left out of network checks while under review
✔ Shops can only read their own deals; other shops see only the limited record above, one number at a time, and only when signed in
✔ We never label anyone "defaulter" or "fraudster" — factual wording only
✔ We never sell customer lists, phone numbers, or transaction histories
✔ The app and our providers are reached over HTTPS. Bill photos are stored at an unlisted web link, so anyone who has that link can open the photo.

7. Retention

Deal records are kept while your account is active and for 36 months after the last activity, after which they are deleted or anonymised. Consent logs (timestamp, source, version) are retained as proof of lawful processing.

8. Children's data

Our service is for business owners. We do not knowingly process data of persons under 18. If you believe a child's data is here, write to us and we will erase it.

9. Service providers & where data is stored

Supabase — database, sign-in and bill-photo storage. Our project is hosted in Supabase's Seoul (South Korea) region.
Vercel — website hosting and the server function that starts AI calls.
Google — "Continue with Google" sign-in.
Bolna — AI voice calls. Bolna uses its own telephony, speech and language-model providers to run the call.
PostHog (US) and FingerprintJS — analytics, only after you tap "Allow".
WhatsApp — purchase notes and reminders are sent from the seller's own WhatsApp.

This means some data is processed outside India, as the DPDP Act permits.

10. Breach

If a data breach affects you, we will inform you and the Data Protection Board of India as the DPDP Act and Rules require.

11. Policy changes

Version and date at top. Material changes will be announced in the app.