Privacy
What I keep, and why
Last updated 14 October 2026
This page explains what information I keep when you use this website, write to me, or message DevShop Retail OS on WhatsApp; why I keep it; who helps me handle it; and how you can see, correct or delete it. I've written it in plain language. If anything is unclear, write to me.
Who I am
DevShop Retail OS is a brand of DEVSHOP LLP (LLPIN ADD-2576), whose registered office is First Floor, Enkay Tower, Plot No. B&B1, Vanijya Nikunj, Udyog Vihar, Phase V, Gurgaon, Haryana 122016, India. It is run by its founder, Virat Mohan. In this policy "I", "me" and "DevShop" mean DEVSHOP LLP. For the information described here, I decide why and how it is used (the "data fiduciary" under India's Digital Personal Data Protection Act, 2023), except where I say I act for a brand. You can reach me at founder@viratmohan.com.
What I collect
- WhatsApp. When you message +91 80769 19458: your phone number, the name on your WhatsApp profile, and your messages, including any files you send.
- Forms on this site. What you type: usually your name, email, phone number, your brand and your question.
- Email. Messages you send to founder@viratmohan.com or another viratmohan.com address, and my replies.
- Leads and applications. If you apply to work with me: your details, your brand's details and what you share about your business. This includes signed agreements, such as an NDA (with the signer's name, title, email, the time of signing and the IP address used).
- Brand customers. If you bought from a brand I run the online business for, I may handle your order details (name, contact, delivery address, what you ordered, payment status) on that brand's behalf. For that information the brand decides how it is used, its own privacy policy applies, and I follow its instructions.
- Website visits. The hosting service records basic technical information (IP address, browser, the page requested, the time) to keep the site running and secure.
I don't ask for card numbers, UPI PINs, OTPs or passwords in chat or on forms. Please never send them.
Why I use it
- To reply to you and route your message to the right person.
- To assess and run a working relationship with your brand, and to prepare proposals, agreements and invoices.
- To run the online business of brands I work with, including their orders, deliveries and customer support.
- To keep records the law requires, and to protect against fraud and misuse.
I don't sell your information. I don't send you marketing unless you have agreed to it, and you can stop it at any time.
The automated assistant
The first replies on DevShop's WhatsApp come from an AI assistant (Hugo, the Chief of Staff), not a person. It answers simple questions and passes everything else to a person. It never decides anything about money, prices, contracts or commitments; I do. You can ask for a person at any time.
Who helps me handle it
I use these services to run DevShop. Each gets only what it needs to do its job:
- Meta (WhatsApp Business): carries WhatsApp messages.
- Anthropic: the AI service that helps draft replies and summaries. It is located outside India, so your messages may be processed there.
- Supabase: the database where records are stored.
- Vercel: hosts this website.
- Resend and Google (Gmail): send and receive email.
- Google Fonts: serves the fonts on this site, so Google sees your IP address when a page loads.
- Payment providers and banks, for payments you make.
Some of these services store or process information outside India. I only send what is needed, and I choose providers with recognised security practices. I may also share information if the law requires it, or with my professional advisers (for example, my accountant or lawyer), who are bound to keep it confidential.
How long I keep it
- WhatsApp and chat messages, enquiries and leads: 24 months after our last contact, then deleted.
- Signed agreements: for the life of our relationship, and afterwards for as long as a claim could be made.
- Invoices, payment and tax records: for as long as the law requires.
- Information I hold for a brand: as long as that brand instructs, and returned or deleted when our work for the brand ends.
Cookies
This site doesn't use advertising or tracking cookies, and doesn't run analytics or ad pixels. Some pages remember in your own browser that you closed a banner or chose a view; that stays on your device. The private admin area uses one short-lived security cookie.
Your rights
You can ask me to:
- see the information I hold about you, and who I have shared it with;
- correct or complete it;
- delete it, which I'll do within 30 days unless the law requires me to keep a record;
- stop marketing messages. On WhatsApp, reply STOP, and I'll confirm once and send nothing further;
- withdraw consent you gave earlier. This doesn't affect what was done before;
- name a nominee to act for you if you die or can no longer act yourself.
To do any of these, write to founder@viratmohan.com. If you bought from a brand I work with, you can also ask that brand directly.
Complaints
Write to founder@viratmohan.com with "Privacy" in the subject. I'll acknowledge it within 48 hours and aim to resolve it within one month. If you're not satisfied, you can complain to the Data Protection Board of India.
Children
DevShop is for adults. I don't knowingly collect information from anyone under 18. If you think a child has sent me information, write to me and I'll delete it.
Keeping it safe
Access is limited to the people and services that need it, with sign-in protection, and passwords and payment details are never kept in my records. No system is perfectly secure. If a breach affects you, I'll tell you and the authorities as the law requires.
Changes
If I change this policy, I'll update this page and the date at the top. For significant changes, I'll tell people I'm in touch with.