How Pattasu Bazaar (pattasubazaar.com) collects, uses, stores, shares and deletes your
information — including the data we receive from your Google Account.
Last updated: 20 September 2026
1. Who we are
Pattasu Bazaar is a fireworks and crackers retailer based in Perambalur, Tamil Nadu, India.
We operate the online store at
pattasubazaar.com, where customers browse products,
build a cart and place orders for pickup or delivery.
This policy applies to that website and to the ordering service behind it. It explains what
we do with the information you give us and with the limited information we receive from
Google when you choose to sign in with your Google Account. We are the data controller for
this information, and you can reach us using the details in
section 12.
We do not sell your personal information, and we do not use it for advertising or profiling.
2. Google Sign-In
Pattasu Bazaar uses Google Sign-In through Firebase Authentication to allow users to
securely create an account and sign in to our website.
When you choose “Continue with Google”, we receive only the basic information
required for authentication, such as:
Google account identifier
Name
Email address
Profile picture, if provided
We use this information only to:
Create and authenticate your Pattasu Bazaar account
Keep you signed in
Associate your account with your enquiries and other account-related information
Display your name and profile picture within your account
We do not access or request your Gmail messages, Google Drive files, Contacts, Calendar,
Photos, location history, YouTube data, or other Google services.
We do not sell Google user data, use it for advertising or personalised advertising, or use
it for purposes unrelated to providing the Pattasu Bazaar service.
Google authentication is provided through Firebase Authentication, a service provided by
Google. Google user data is handled in accordance with the applicable Google policies,
including the
Google API Services User Data Policy
and Limited Use requirements.
Of the information above, we store your Google account identifier, your name and your email
address in our own database so that your account persists between visits. Your profile
picture is loaded from Google each time and is not copied into our database. We never
receive or store your Google password, and we do not request any sensitive or restricted
Google API scopes.
3. Other information we collect
Some information does not come from Google — you give it to us directly, or it is generated
as you use the site:
Contact and delivery details — mobile number, delivery address, city, PIN
code, landmark and any delivery instructions you enter at checkout. These are needed to
deliver your order and to reach you about it.
Order information — the products, quantities, prices, discounts, payment
status and order status that make up your order and invoice history.
Cart and wishlist contents, including a randomly generated guest session
identifier stored in your browser so a guest cart is not lost before you sign in.
Approximate delivery location — only if you use the “deliver
to” picker and your browser asks for and receives your permission. You can decline
and type your area instead; declining does not limit the rest of the site.
Technical and usage data — IP address, browser and device type, pages
requested, timestamps and error logs, recorded by our servers so we can keep the site
secure and diagnose faults.
If you visit our store in person and buy at the counter, our billing system may record your
name and mobile number on the bill. That record is kept for the same accounting purposes
described in section 6.
We do not collect or store your card numbers, UPI PIN or bank credentials. Online payments,
where offered, are handled on the payment provider's own systems and we receive only the
result of the transaction and a reference number.
4. Who we share information with
We do not sell, rent or trade your personal information. We share it only with the service
providers needed to run the store, and only with the data each of them requires:
Google LLC (Firebase Authentication) — operates the sign-in flow and
verifies your session. Google is the source of the account data in section 2 and
processes it under the
Google Privacy Policy.
Our hosting and database provider — stores the site, its database and its
backups on our behalf, under contract and on our instructions only.
Payment provider (Razorpay) — receives the amount, order reference and
the details you enter on its own payment screen, where online payment is used. It acts as
an independent controller for payment and anti-fraud purposes under its own privacy
policy.
Delivery and logistics partners — receive the recipient name, delivery
address and mobile number required to complete the delivery, and nothing more.
WhatsApp / Meta — only when you choose to send us an order summary or
message through WhatsApp. That happens from your own WhatsApp account, on your action, and
is covered by WhatsApp's privacy policy.
Courts, regulators and law-enforcement authorities — where we are legally
required to disclose information, or where disclosure is necessary to establish, exercise
or defend legal claims. We disclose only what is required.
A successor organisation — if our business is merged, acquired or
reorganised, information may transfer as part of that transaction. The successor will
remain bound by this policy, or we will ask for your consent before any different use.
We transfer Google user data to third parties only for the purposes listed
above, which are limited to providing or improving the store's functionality and to meeting
legal obligations. We never transfer it to data brokers, advertising networks, analytics
products that monetise personal data, or any other party for their own independent purposes.
Our own staff access customer records only to process and support orders. Access is limited
to the accounts that need it, and administrator accounts are restricted by role.
5. How we protect your information
We apply technical and organisational safeguards appropriate to the sensitivity of the data
we hold, including your Google account identifier, email address and delivery details:
Encryption in transit — the entire site and all API traffic are served
over HTTPS/TLS. Sign-in itself happens on Google's own domain.
Verified sessions — every request that touches your account carries a
short-lived Google ID token that our server validates against Google's public keys before
returning any data. Tokens expire automatically, and a request for someone else's records
is rejected.
No password handling — we never receive or store your Google password,
and we do not store long-lived Google refresh tokens.
Access control and least privilege — the customer-facing service can only
reach the records it needs. Administrative access is role-based, protected by hashed
credentials, and limited to authorised staff.
Protected database — customer records sit in a private database that is
not reachable from the public internet. Credentials and API keys are held as server-side
secrets, never in the browser.
Input validation and query safety — requests are validated and all
database access uses parameterised queries to guard against injection.
Backups and monitoring — encrypted backups protect against loss, and
server logs are reviewed for unusual activity.
Data minimisation — we keep only the fields we actually use, which is why
we store no payment credentials and no Google data beyond your identifier, name and email
address.
No system can be guaranteed perfectly secure. If a breach affects your personal data and
creates a risk to you, we will notify you and the relevant authorities as required by
applicable law.
6. How long we keep your data
Account data (Google identifier, name, email, mobile number, saved
address) — kept while your account is active, and deleted or anonymised within 30 days of
a deletion request.
Order and invoice records — retained for as long as Indian tax,
accounting and consumer-protection law requires us to keep sales records, even after an
account is closed. When you ask us to delete your account, these records are detached from
your Google identifier and kept only as the financial record of a completed sale.
Cart, wishlist and guest session data — removed once the cart is ordered
or abandoned; guest identifiers stored in your browser are cleared when you clear your
browser storage.
Server and error logs — kept for a short operational period (typically up
to 90 days) and then overwritten.
Backups — retained on a rolling schedule; deleted records disappear from
backups as those backups age out.
We do not keep Google account data longer than we need it for the purposes in section 2, and
we do not retain a copy after deletion other than where the law requires the financial
record above.
7. Deleting your data & revoking access
You are in control, and you have two independent options:
Ask us to delete your account. Email
info@pattasubazaar.com
from the address you signed in with, or call +91 93806 22333. We confirm the request,
delete your profile, saved address, cart and wishlist, and remove your Google account
identifier — normally within 7 days and always within 30 days. We will tell you when it is
done. Only the legally required sales records described in section 6 remain, and they no
longer identify you as a Google user.
Revoke our access from your Google Account. Visit
myaccount.google.com/permissions
and remove access for Pattasu Bazaar at any time. That immediately stops any further
sharing of Google data with us, and you will no longer be able to sign in. It does not by
itself delete the data already stored in our database — use the first option for that.
You can also sign out at any time from the Account page, which clears your session on that
device.
8. Cookies & local storage
We use only what the store needs to work. Firebase Authentication stores your session in
your browser so you stay signed in, and we keep a randomly generated guest session
identifier plus your chosen delivery area in local storage so your cart and area survive a
page reload.
We do not use advertising cookies, cross-site trackers or third-party marketing pixels.
Clearing your browser storage removes these values; you will simply be signed out and your
guest cart will start fresh.
9. Your rights and choices
Subject to applicable law, you can ask us to:
Confirm what personal information we hold about you and give you a copy of it.
Correct information that is wrong or out of date — you can also edit your name, mobile
number and address yourself on the Account page.
Delete your account and the personal information tied to it (see section 7).
Restrict or object to a particular use of your information.
Withdraw a consent you gave earlier, such as marketing messages or browser location
access.
Write to info@pattasubazaar.com and we
will respond within 30 days. We may need to verify that the request comes from you before we
act on it. If you are not satisfied with our response, you may complain to the relevant data
protection authority in your jurisdiction.
Our servers and service providers may process data in India and in other countries. Where
information leaves India, we rely on providers that offer contractual protections equivalent
to those described in this policy.
10. Children's privacy
Our store sells fireworks, which may only be bought by adults. The service is not directed
at children, and we do not knowingly collect personal information from anyone under 18. If
you believe a minor has created an account or placed an order, contact us and we will remove
the account and its data.
11. Changes to this policy
We may update this policy as the store changes. The “Last updated” date at the
top always reflects the current version, and the latest version lives permanently at
pattasubazaar.com/privacy.
If a change materially affects how we handle Google user data or any other personal
information — for example a new purpose, a new category of data, or a new recipient — we will
tell you before it takes effect through a notice on the site and, where appropriate, an
email to the address on your account. Where the law requires consent, we will ask for it
rather than assume it.
12. Contact us
Questions about this policy, or about the data we hold on you? We are the right first stop
for any privacy request.
