Privacy Policy

Legal

Privacy Policy

Last updated: 5 August 2026

This policy explains how TOOLS TRIBE SYSTEMS PRIVATE LIMITED ("Tools Tribe", "we", "us") handles personal data collected through www.toolstribe.store and our customer app. We are the data fiduciary for that information under the Digital Personal Data Protection Act, 2023.

Registered office: Road No. 5, Doctor Colony, Kharauniya, Chhoti Pahari, Behind Big Apollo Spectra Hospital, Patna, Bihar – 800007, India. GSTIN 10AANCT1172A1ZY.

You give us:

• Your mobile number. This is how you sign in — we send a one-time password to it rather than asking you to remember another account credential. It is the main way we identify you.
• Your name and delivery address, including the pincode, so the shipment can reach you.
• Your email address, if you choose to give one. It is optional; we use it for order confirmations and invoices.
• Your GSTIN and billing details, if you want a GST invoice you can claim input tax credit against. Also optional — you can buy without one.
• What you write to us — support tickets, quotation requests, product enquiries, and any photographs or documents you attach to them.

We record automatically:

• Your orders, their status, and the invoices raised against them.
• Basic technical information — IP address, browser and device type, pages viewed, and the time of the visit — in our server logs and through analytics.

• To fulfil your order — take it, pack it, ship it, and tell you where it is.
• To raise a lawful GST invoice. Indian tax law requires certain details on the invoice; where you supply a GSTIN, it must be printed on it.
• To confirm it is really you — the one-time password protects your account and your order history from someone else using your number.
• To answer you when you raise a ticket, ask for a quotation, or request an exchange.
• To keep the site working and secure — to detect fraudulent orders, abuse and attacks.
• To meet our legal obligations under tax, company and consumer law.

We do not use your personal data to build advertising profiles, and we do not make automated decisions that produce legal effects for you.

• Essential cookies keep you signed in, remember what is in your cart, and protect forms against cross-site request forgery. The site cannot function without them.
• Google Analytics, loaded through Google Tag Manager, tells us which pages and products people look at, so we know what to stock and what to fix. It records visits, not identities — we do not send it your name, phone number or address.
• Cloudflare sits in front of the site to serve it quickly and to block attacks, and sets cookies for that purpose.

You can block or delete cookies in your browser settings. If you block the essential ones, sign-in and checkout will stop working.

Only where the work cannot be done otherwise, and only the part each one needs:

• Invoices and financial records are kept for at least eight years, because the Companies Act, 2013 and GST law require it. We cannot delete these on request, and neither can you — they are statutory records.
• Your account and address book are kept while your account is open, and removed when you close it, apart from what the line above requires us to retain.
• One-time passwords expire within minutes and are not kept afterwards.
• Server and security logs are kept for a short period and then discarded.

• The whole site runs over HTTPS, so what passes between your device and us is encrypted.
• Passwords are stored hashed, never in readable form.
• Documents you upload — GST certificates, photographs supporting an exchange — are stored outside the public web root and served only to the account that owns them.
• Access to customer records is limited to the staff whose work requires it, and is logged.
• If a breach ever affected your data, we would notify you and the Data Protection Board as the law requires.

No system is perfectly secure, and we will not pretend otherwise. Please keep your one-time passwords to yourself — our staff will never ask you for one.

Under the Digital Personal Data Protection Act, 2023, you may:

• Ask what we hold about you and who we have shared it with.
• Correct anything wrong — most of it you can edit yourself from your account.
• Ask us to erase it, except the records the law obliges us to keep.
• Withdraw consent you have given, such as for WhatsApp updates.
• Nominate someone to exercise these rights if you die or become incapable of doing so.
• Raise a grievance with the officer named below, and escalate to the Data Protection Board of India if we do not resolve it.

Write to the address in section 10. We respond within 30 days.

To stop WhatsApp messages, reply STOP to any of them. To stop marketing emails, use the unsubscribe link at the foot of the email, or write to us.

Messages about an order you have actually placed — the one-time password, the order confirmation, the dispatch and delivery updates, the invoice — will continue, because they are part of the service you asked for, not marketing. They stop when you close your account.

This site is meant for business buyers and is not directed at children. We do not knowingly collect data from anyone under 18.

We acknowledge complaints within 48 hours and aim to resolve them within one month.

We update this policy when what we do changes. The date at the top tells you when it last changed. If a change materially affects how we use your data, we will tell you directly.