This Privacy Policy explains how Go Crazy Offers ("GCO", "we", "us") collects, uses, shares and protects personal data of vendors, shop owners and their staff ("Vendor", "you") and of visitors to gocrazyoffers.com, when using the GCO vendor app, the marketing dashboard, billing.gocrazyoffers.com and our website (the "Platform"). It also explains what customer data Vendors can see. Customers of the Go Crazy Offers app should read the Customer Privacy Policy. We process personal data in line with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the rules made under them.
1. Data we collect
1.1 Account and business data
- Owner and staff name, mobile number, email, password (stored only as a secure hash) and login OTP records.
- Shop details: name, category, address, city, pincode, map location (latitude/longitude you pin), timings, photos and logo, GSTIN, owner name, social-media links, Google review link, reward settings.
- Bank or payout details, only if a feature you use needs them.
1.2 Activity and usage data
- Offers, coupons, vouchers, stamp cards, memberships, catalogs, broadcasts, invoices and other content you create.
- Redemptions, stamps, points, memberships and other actions at your counter, including which staff member performed them (staff activity log).
- Wallet ledger: credits added, used and returned; your credit limit and balance.
- Device and technical data: app version, device model, operating system, IP address, push-notification token, crash and error logs.
1.3 Payment data
Payments for activation and credits are processed by Razorpay. We receive the order and payment IDs, amount, status and method type. We do not receive or store full card numbers, CVV, UPI PIN or banking passwords.
1.4 Messages and chat
Chat messages, photos and videos exchanged between your shop and customers, broadcasts you send, and support conversations with GCO. For chat safety we also keep when and from which device you and your Staff accepted the chat guidelines, customers you blocked, reports made by or about your shop (with a copy of the reported message), messages refused by our abuse filter, and any warnings or suspensions. Messages are checked automatically against a banned-words list before they are sent; GCO staff review reported conversations and do not read chats routinely.
1.5 Connected accounts
If you connect Facebook, Instagram or WhatsApp Business, we store the access tokens and account identifiers Meta provides, your message templates, campaign and delivery data, and content you schedule or publish.
1.6 Website visitors
When you browse gocrazyoffers.com we process standard server logs (IP address, browser, pages requested) and, if you fill in a form (contact, demo request, signup), the details you enter.
2. How we use data
- To create and secure your account, verify you by OTP, and let you and your staff use the Platform.
- To run the features you use — rewards, redemptions, messaging, chat, invoices, catalog, AI tools, analytics.
- To publish your shop's public web page and directory listing from the business details you provide.
- To activate your account, keep your wallet ledger, charge credits for chargeable actions and process payments and refunds.
- To send you service messages (OTP, alerts, low-balance notices) by push, WhatsApp, SMS or email.
- To prevent fraud and misuse — for example location checks on Scan & Earn claims, limits on scratch cards and redemptions.
- To provide support, improve the Platform and produce aggregated statistics.
- To meet legal, tax and accounting obligations.
3. Location data
- Shop location: the map pin you set is shown on your public page and used to show your shop to nearby customers, to target "GCO users nearby" broadcasts (within about 10 km) and to match partner rewards. The pin is locked after it is first set to prevent misuse; contact support to correct it.
- Customer location: customers' device location is used, with their permission, to show nearby offers and to check that a Scan & Earn or reward claim is made near the shop. Vendors do not receive customers' live location.
4. Customer data you can see
For customers who interact with your shop, the Platform shows you what you need to serve them: name, mobile number, visits, rewards, memberships, coupons, invoices, ratings and chat with your shop. You receive this data as an independent party responsible for your own use of it, and must use it only for your shop's dealings with that customer, keep it secure, not sell or share it, and honour customers' requests to stop messaging them. Customers using point sharing or partner rewards may have their reward balances and redemptions visible to the linked partner shop involved.
5. AI processing
When you use AI features, the text and images needed for the request are sent to our AI providers (currently OpenAI and Google) to generate the result:
- AI logos and posts: your shop name, category and the prompt or photos you supply.
- AI shop-page visuals: your shop name, category and public description.
- Growth Assistant: your question and a summary of your shop's activity on GCO (for example counts of customers, redemptions and offers).
- Google review suggestions: your shop name and category, and any words the customer types about their visit, to suggest review text that the customer can edit.
We do not send customers' mobile numbers to AI providers. Under these providers' API terms, data sent through their APIs is not used to train their models.
6. Sharing and disclosure
We do not sell personal data. We share it only:
- with customers, to the extent of your public shop information and the messages you send them;
- with service providers who process it for us — cloud hosting and storage (AWS), Razorpay (payments), Meta (WhatsApp, Facebook, Instagram), Google (Firebase notifications, maps, AI), OpenAI (AI), SMS and email gateways — under contracts or terms that limit their use;
- with partner shops linked to yours, only as described in section 4;
- with authorities when required by law, court order or to prevent fraud or harm;
- with a successor if GCO's business is merged or transferred, under the same protections.
7. Public information
Your shop's public page and directory listing show the business details you provide (name, photos, address, map, timings, owner name, GSTIN, social links, offers, rewards, catalog and aggregate ratings). These can be read by anyone and by search engines and AI assistants. Do not add personal information to these fields that you do not want published.
8. Cookies
Our website uses essential cookies to keep you logged in and remember preferences. We do not use cookies to sell data to advertisers. You can block cookies in your browser; some logged-in features may then not work.
9. Deep links and app links
Links to gocrazyoffers.com may open the GCO app directly if it is installed. A link may carry a reference such as a shop, offer or referral code; this is used only to open the right screen and record the referral.
10. Data security
We use encrypted connections (HTTPS), access controls, hashed passwords, OTP verification, role-based access for staff and monitoring for misuse. No system is completely secure; keep your OTP and password private. If a personal data breach occurs, we will notify affected people and the Data Protection Board of India as the DPDP Act requires.
11. Retention
| Data | Kept for |
|---|---|
| Account and shop details | While your account is active; deleted or anonymised after deletion |
| Payments, invoices and wallet ledger | 8 years, as required by tax and accounting law |
| Chat messages | While the account is active; a deleted message is erased immediately; all chats are deleted with the account |
| Chat reports and moderation decisions | As long as needed for safety, disputes and legal requirements |
| Staff activity logs | While the account is active |
| Server and error logs | Up to 180 days |
| Connected Meta tokens | Until you disconnect or Meta revokes them |
12. Your rights
Under the DPDP Act you may ask to access a summary of your personal data, correct or update it, erase it (subject to legal retention), withdraw consent, and nominate someone to exercise your rights. You can update most data in the app; for anything else email info@gocrazyoffers.com. Withdrawing consent may stop some features from working.
13. Communication preferences
We send service messages (OTP, payments, balance and account notices) as needed to run your account. You can opt out of GCO marketing messages at any time by replying STOP where offered or by contacting us.
14. Children
The vendor Platform is for adults running a business. We do not knowingly collect data of children for vendor accounts.
15. Where data is stored
Data is stored on secure cloud servers. Some service providers (for example Meta, Google, OpenAI) may process data outside India in line with Indian law.
16. Changes to this Policy
We may update this Policy. The current version is always on this page with its date; material changes are notified in the app or by message.
17. Grievance Officer and contact
For privacy questions, requests or complaints, contact our Grievance Officer at info@gocrazyoffers.com. We acknowledge complaints within 24 hours and aim to resolve them within 15 days. If you are not satisfied, you may approach the Data Protection Board of India.