OneStop Privacy Policy
Last updated: 5 October 2026
This Privacy Policy explains how Infiloop (“Infiloop”, “we”, “us”, or “our”) collects, uses, shares, and protects personal information when you use the OneStop mobile application, related websites, and support channels (collectively, the “Service”).
By creating an account or using the Service, you acknowledge the practices described here. If you do not agree, please do not use the Service.
1. Who we are
Data controller: Infiloop.
Infiloop — registered office address in Nepal (complete before Play Store submission)
Email: [email protected]
Website: https://onestop.infiloop.co
Policy URL: https://onestop.infiloop.co/privacy-policy
Governing law: Nepal. Questions about this policy can be sent to the email above.
2. Information we collect
We collect information in the following ways.
2.1 Account and profile
- Name and display name
- Email address
- Phone number
- Profile or avatar image
- Optional demographics such as age or gender (if you provide them)
- Notification preferences
- User identifier and account role
2.2 Authentication
- Email or phone used for one-time passcode (OTP) login
- Authentication tokens stored securely on your device
- When you use Google Sign-In: your Google account name, email address, profile photo, and Google account identifier, shared with us by Google for sign-in
2.3 Orders, delivery, and payments
- Saved delivery addresses, including recipient name, recipient phone, address lines, landmark or delivery notes, and delivery zone
- Approximate delivery location when you choose location-based options
- Cart, wishlist, order history, shipment and tracking information
- Payment method and payment status (for example cash on delivery)
- QR payment receipt images you upload for manual verification
- Coupon or discount information applied to orders
OneStop does not currently collect card numbers in the app. Payments are cash on delivery or user-uploaded QR receipts verified by our operators. Receipt images are stored to confirm payment and resolve disputes.
2.4 Content you submit
- Product ratings, review text, photos, and videos
- Questions and answers about products
- Support ticket subjects, messages, phone/email, and attachments
- Bulk-order inquiry messages and contact details
- Cancellation reasons and related order notes
2.5 Location, camera, and files
- Device location when you allow it (used for nearby stores, delivery options, and address helpers)
- Cached coordinates or reverse-geocoded addresses on your device
- Photos or videos you capture or select for profile images, reviews, support, or payment receipts
2.6 Device, push, analytics, and diagnostics
- Firebase Cloud Messaging (FCM) device tokens used to deliver push notifications
- Notification delivery, open, dismiss, and conversion events
- Search queries, clicked products, and related usage events used to improve discovery
- Firebase Analytics events on Android builds of the app
- Crash and diagnostic reports via Bugsnag (for example stack traces, app version, and device metadata)
- IP address and user agent information in security and audit logs
- Local app storage such as secure tokens, preferences, and offline caches
3. How we use your information
- Create and secure your account (OTP, Google Sign-In, session management)
- Process orders, deliveries, returns, and payment receipt verification
- Provide customer support and respond to bulk-order inquiries
- Display and improve product search, recommendations, and the storefront
- Send transactional and service notifications (including push)
- Detect abuse, secure the platform, and keep audit records
- Understand app performance and fix errors
- Meet legal, regulatory, and enforcement obligations
- Improve the Service with aggregated or de-identified insights where feasible
4. Why we may process your information
Depending on the context and applicable law in Nepal, we process personal information to:
- Perform our contract with you (account, orders, delivery, support)
- Pursue legitimate interests such as security, fraud prevention, service quality, and analytics
- Act on your consent for optional features (camera, gallery, location, notifications, optional profile fields)
- Comply with legal obligations when we are required to retain or disclose information
5. How we share information
We do not sell your personal information. We may share information with:
- SMS and email providers used to send OTPs and transactional messages (provider depends on environment configuration, for example SparrowSMS, AakashSMS, Twilio, Resend, or SMTP)
- Google Firebase for Cloud Messaging push notifications and, on Android, Firebase Analytics
- Bugsnag for crash reporting and diagnostics
- Cloud storage and infrastructure providers (for example S3-compatible object storage) used to store product media, support attachments, and payment receipts
- Search and operational infrastructure (for example MeiliSearch, Redis, and hosting providers) under contractual confidentiality and security terms
- Professional advisers and authorities when required by law or to protect rights and safety
6. Third-party SDKs in the app
- Google Sign-In / Google APIs — sign-in with your Google account
- Firebase — app infrastructure, push notifications (FCM), analytics on Android
- Bugsnag — crash reporting
These providers process information under their own terms. Review their policies if you want more detail about how they handle data.
7. Payments
OneStop supports cash on delivery and manual QR payment verification. You may upload a QR payment receipt image. We store the receipt reference and related payment status to verify the order and handle disputes. We do not currently process card payments inside the app through a hosted card gateway.
8. Data retention
We keep personal information for as long as needed to provide the Service, including account history, orders, support, security, and legal compliance. Some records may be retained after account closure when required for fraud prevention, dispute resolution, accounting, or legal obligations. Operational logs and audit records may contain limited identifiers such as IP address or user agent. When you request account deletion, we process the request through our account deletion workflow and delete or de-identify data that is no longer required, subject to the retention needs above.
9. Your choices and rights
- Access and correct profile information in the app or by contacting support
- Request account deletion via the app/account deletion flow or by contacting support
- Manage notification permissions in your device settings
- Manage camera, photo, and location permissions in your device settings
- Withdraw consent for optional processing where consent is the basis (this does not affect prior lawful processing)
To exercise rights or ask questions, email [email protected].
10. Security
We use administrative, technical, and organizational measures designed to protect personal information, including secure token storage on devices, access controls for internal systems, and encryption in transit where configured. No method of transmission or storage is perfectly secure. You are responsible for keeping OTPs and your device secure.
11. Children
The Service is not directed at children under 13 (or the minimum age required by applicable Nepali law, if higher). If you believe a child has provided personal information, contact us and we will take appropriate steps to delete it.
12. International transfers
Some service providers listed above may process information outside Nepal (for example cloud hosting, messaging, analytics, or crash reporting). Where required, we use contractual or other safeguards reasonably available to us with those providers.
13. Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will change when we do. Material changes may also be communicated in the app or on our website. Continued use of the Service after an update means you acknowledge the revised policy.
14. Contact us
Infiloop
Infiloop — registered office address in Nepal (complete before Play Store submission)
Email: [email protected]
Website: https://onestop.infiloop.co