Privacy Policy

CropBid is an agricultural marketplace that connects farmers directly with buyers. This policy covers the CropBid website and the CropBid Android app.

CropBid is based in India and operates only in India. The business is in the process of being incorporated; until that completes it is run by its founder, who is responsible for the personal data described here. We will name the registered company and its address on this page once incorporation is done. The Terms and Conditions set out the rest of the agreement between us.

Account details. Your name, the email address or phone number you signed up with, and a password if you set one. Either one is enough, since many farmers do not have an email address. Your password is stored only as a bcrypt hash; nobody at CropBid can read it. We also hold the sign-in tokens that keep you logged in, and, briefly, a hashed one-time code when you sign in by phone or reset a password.

Profile details. Your role (farmer, buyer or consumer), city, country, preferred language and currency, a profile photo if you upload one, and a trust score calculated from your completed deals.

If you apply to sell, we collect what the application asks for and what your trade requires: whether you are a farmer, a local shop or a wholesaler, your business or shop name and type, your address, your state, farm size and crops grown, an FSSAI licence number for a shop, a GSTIN, an APMC licence, an FPO name, organic certification details, and minimum order value and lead time for a wholesaler. We keep the outcome of the review and any note the reviewer wrote.

If you sell, we ask where to pay you: a UPI id, or the name on your bank account with its account number and IFSC code. You can apply without them and add them later, but we cannot send you money for a sale until they are there. Buyers never see them. When you look at your own details we show them back to you partly hidden, as the last four digits, so they cannot be read off your screen. The only people who see them in full are CropBid staff making a payment to you, and every time one of them looks we record who looked, whose account it was, and when.

If you apply to buy at volume, we collect your company name and type, country, tax identifier and annual procurement volume, and the outcome of that review.

Trading activity. The listings you create, the photographs on them, bids you place or receive, counter-offers and negotiation messages, auctions you take part in, the limits you set for an AI negotiating agent, buyer requirements you post, offers you make against them, equipment enquiries, and the record of every completed deal.

Orders and delivery. What you ordered, from whom, the amount, and the delivery address and contact phone number you enter at checkout. Delivery and payment status is tracked through the life of the order, and shipment details where a logistics partner is booked.

Voice recordings, if you use the microphone. Dictating a listing sends that audio clip to our speech provider to be turned into text. The clip is sent for transcription and the text is what we keep on the listing; we do not build a voice profile, and the feature only appears when the provider is configured.

Images you upload. Listing photographs and profile pictures are compressed and stored with our image host. Anything you photograph for a listing becomes publicly visible on that listing, so take care not to include documents, faces or anything else you did not mean to publish.

Payment information. Payments are processed by Razorpay. Card and bank credentials are entered on Razorpay's checkout and never reach CropBid's servers — we store only the Razorpay order and payment reference for the transaction.

Technical data. Standard server logs, and an internal audit log of significant account actions (for example account deletion) used for security and dispute resolution.

Everything in this section is on your own device, not on our servers, and clearing your browser data removes all of it. None of it is optional, because none of it is advertising: the site cannot do its job without it, which is why the notice you see when you arrive tells you about it rather than asking you to choose.

One cookie. Signing in sets a single cookie named refreshToken. It keeps you signed in as you move between pages, is marked httpOnly so no script on the page can read it, is sent only to our sign-in endpoints, and expires shortly after a period of inactivity. Signing out deletes it. If you never sign in, we set no cookies at all.

Browser storage. Your shopping basket, your chosen delivery city, your language, a marker that this browser has been signed in before, whether you have already dismissed the notice about this page, and the timestamps that drive the idle sign-out are kept in your browser's own local and session storage. That is what lets a basket survive a reload and saves you being signed out on every visit.

No tracking cookies. We run no advertising, retargeting or social-media trackers, and nothing here follows you to other websites or builds a profile of you. The website uses Vercel Analytics to count page views and see which pages are used; it is privacy-focused and cookie-free, and we use it only to know which parts of the site are worth improving.

If we ever add anything optional, we will ask for your consent first and give you a way to change your answer, rather than quietly adding it to this list.

When you list a crop or place a bid, the counterparty sees what they need to trade with you and no more: your name, your general location, and your listing or bid details.

A farmer's phone number and email are never shown to buyers browsing listings, bidding, or negotiating. Contact details are exchanged only once an order is confirmed between the two of you, because at that point a delivery has to be arranged.

If you order for your home, the shop or farm you bought from is told what you ordered straight away, but your delivery address and phone number are withheld from them until your payment clears. Placing an order creates it unpaid; the seller sees your contact details only once the money is held, because that is the point at which a delivery has to be arranged. They go only to the seller you bought that order from, and browsing a shop shares nothing.

To create and secure your account, to show your listings to the right buyers, to run bidding and negotiation, to process payments and arrange delivery, to send you notifications about your trades, and to detect and prevent abuse of the platform.

We do not sell your personal data, and we do not use it for advertising.

We do not sell your personal data and we do not share it for anyone else's advertising. The full list of who else touches it:

Other CropBid users — limited to what the section above describes.

Razorpay (payments) — the amount, an order reference and the contact details their checkout asks for. Card and bank credentials are entered on Razorpay's own checkout and never reach us.

Logistics partners — where you book delivery through the platform, the pickup and delivery details needed for that shipment.

Meta (WhatsApp) — your phone number and a one-time code, to deliver your sign-in code. If we cannot reach you there we send the code by email instead, through our email provider.

Sarvam AI (speech and translation) — the audio clip you record when dictating a listing, and listing or requirement text to be translated. Only if you use those features.

Google (Gemini) — where an AI agent negotiates on your behalf, the listing and bid details that negotiation is about. Only if you switch an agent on.

Cloudinary (image hosting) — the photographs you upload.

Our infrastructure providers — Vercel (website), Render (application server) and Neon (database) host the platform on our behalf, and Vercel Analytics counts page views as described above.

data.gov.in supplies the government mandi rates we display. We request published price data and send them nothing about you.

We may also disclose information where the law requires it, or to protect the safety and rights of our users. If CropBid is ever acquired or merged, account data may transfer with the business, and we will tell you before that happens.

CropBid itself operates only in India. Some of the providers we rely on to run the platform — hosting, image storage, messaging — are international companies that may store or process data on servers outside India, including in the United States and Europe. Where that happens we rely on the provider's contractual data-protection commitments. Payments are processed by Razorpay in India.

You can see and correct most of your details yourself in Settings. Beyond that, you can ask us to give you a copy of the personal data we hold about you, correct anything that is wrong or incomplete, delete your account and data as described below, or tell us you object to a particular use of it. You can also nominate someone to exercise these rights on your behalf if you are unable to.

Write to info@cropbid.in and we will respond within 30 days. There is no charge. If you are not satisfied with how we handle a request you can complain to the Data Protection Board of India.

We keep your account data for as long as your account is open. Completed transaction records are retained after that where we need them for tax, accounting and dispute-resolution purposes — Indian tax law expects business records to be kept for several years, and the other party to a settled deal has an interest in them that outlives your account.

Shorter-lived items expire on their own: a sign-in code lasts a few minutes, a password-reset link one hour, and a sign-in session ends when you log out or after a period of inactivity. Notifications and uploaded images are removed with the listing or account they belong to.

You can delete your account from Settings. If you have no settled trades, your account and its data are deleted outright.

If you do have settled trades, we cannot erase the record of a completed transaction the other party is also entitled to. In that case we anonymise your account instead: your name, phone number, location, profile photo and bank details are removed, your login is permanently disabled, and the transaction survives with no personal details attached. Uploaded images that are no longer referenced are deleted.

You can also ask us to access or correct your data by writing to info@cropbid.in.

Passwords are hashed with bcrypt. Password-reset links are stored only as a hash, expire after one hour, and can be used once. Sessions use short-lived access tokens with refresh tokens that are invalidated on logout. All traffic is served over HTTPS. Repeated failed sign-in attempts are rate limited per account.

No system is perfectly secure, but if we ever discover a breach affecting your personal data we will tell you.

CropBid is not intended for anyone under 18, and we do not knowingly collect data from children.

If we change what we collect or how we use it, we will update this page and change the date at the top. Significant changes will also be notified in the app.

Questions about this policy, or about your data, go to info@cropbid.in.