Privacy Policy

01 Who we are

Sutra (“Sutra”, “we”, “us”) is a point-of-sale and online commerce platform for independent retailers, operated from Kathmandu, Nepal. This policy covers:

the Sutra dashboard and point of sale at sutranepal.com, used by store owners and their staff (“merchants”);
the online stores merchants run on Sutra, usually at a sutranepal.com address such as yourstore.sutranepal.com;
Sutra's Facebook and Instagram integration, which lets a merchant connect their Facebook Pages and Instagram professional accounts to Sutra's inbox.

For merchant accounts, Sutra decides how data is used and is responsible for it. When a merchant records data about their own customers — or receives messages through Facebook, Instagram or their online store — the merchant decides what to collect and why, and Sutra processes that data on the merchant's behalf. If you're a shopper, you can contact the store directly or write to us; we'll help either way.

02 Information we collect

Information merchants give us

Account details: name, email address and password. Passwords are stored only as a one-way hash, so we can't read them.
Business details: store names, addresses and settings, and the staff members a store invites with the roles and permissions given to them.
Store records: products, stock, suppliers, purchase orders, orders, gift cards, reports and the payments recorded against orders. Sutra records how and how much an order was paid; it doesn't process card payments itself or store card numbers.

Information about shoppers

When someone shops at a store that runs on Sutra, the store collects through us:

name, email address, phone number and delivery addresses;
their customer account (with the password stored as a one-way hash), order history, cancellations, rewards and notification preferences;
messages sent through the store's chat, and comments left on products.

Information collected automatically

your IP address and browser details when you sign in, kept with your login session;
a record of important changes made in the Sutra dashboard — who changed what, when, and from which IP address (the audit log);
the cookies described under Cookies.

Information from Facebook and Instagram

Only when a store connects these accounts — see Facebook and Instagram data for exactly what we receive.

03 Facebook and Instagram data

Sutra connects to Facebook and Instagram through Meta's official APIs, and only when a merchant chooses to. Merchants don't sign in to Sutra with Facebook: Facebook Login is used only to connect a store's Facebook Pages and Instagram professional accounts to Sutra's inbox, so the store can answer its Messenger and Instagram Direct messages alongside its other conversations.

Permissions we ask for

Permission	Why Sutra needs it
pages_show_list	To list the Facebook Pages you manage, so you can choose which ones to connect.
pages_manage_metadata	To subscribe a connected Page to message notifications, so new messages reach Sutra.
pages_messaging	To receive Messenger messages sent to a connected Page and send your team's replies.
instagram_basic	To read the ID and username of the Instagram professional account linked to a Page.
instagram_manage_messages	To receive Instagram Direct messages sent to a connected account and send your team's replies.

What we receive and store

When a merchant connects an account:

the ID and name of each Facebook Page they connect, and the ID and username of any linked Instagram professional account;
an access token for each connected Page, which lets Sutra receive and send that Page's messages. It's encrypted before it's stored. The merchant's own Facebook user token is used once, while connecting, to list their Pages — we don't store it.

When someone messages a connected Page or Instagram account:

the message text, a link to any attachment (attachments stay on Meta's servers — we don't copy them), and the message's ID and time;
the sender's Page-scoped or Instagram-scoped ID — an ID Meta issues for that person and that Page only, not their Facebook or Instagram account ID;
the sender's public profile: first name, last name and profile picture on Facebook, or name, username and profile picture on Instagram.

Replies the store's team writes in Sutra are sent back through Meta and stored with the conversation, along with whether they were delivered. Store staff can also add internal notes and tags to a conversation, and link the sender to a customer record in their store.

How we use it

Only to run the inbox for the store that connected the account: to show its conversations to that store's staff, deliver their replies, keep the conversation history, and measure the store's response times.

What we never do with it

sell it, or share it with advertisers, data brokers or anyone not listed under How we share information;
use it for advertising, profiling, or anything unrelated to the store's own conversations;
read anything else from a Facebook or Instagram account — posts, friends, followers or ads;
send it to an AI service, or use it to train AI models.

We use data from Facebook and Instagram in line with Meta's Platform Terms and Developer Policies.

04 How we use information

To provide Sutra: selling at the till, running online stores, taking and fulfilling orders, tracking stock, running the inbox and producing reports.
To send service emails: order confirmations and updates, password resets, report digests and notices about your account.
To run shoppers' accounts: order history, rewards and the notifications they've chosen.
To keep Sutra secure: signing people in, enforcing each staff member's permissions, keeping audit logs, preventing fraud and abuse, and investigating errors, including bug reports you send us.
To support you when you contact us.
To meet legal obligations, such as keeping financial records.

We don't use personal data for advertising, and we don't sell it.

05 How we share information

We share personal data only in these cases.

With the store you deal with

A store's customers, orders and conversations are visible to that store's staff, according to the permissions its owner gives each role. Stores on Sutra can't see each other's data.

With service providers

Companies that run parts of Sutra for us, and only so they can do that:

Our cloud hosting provider, which runs the servers and databases where Sutra's data is stored.
Mailtrap, which delivers Sutra's emails.
Meta Platforms, which carries messages between a store and the people who message its Facebook Page or Instagram account.
TikTok, which does the same for a store that connects a TikTok business account.
Google (Gemini API), when a store turns on its Store Assistant: the text of a signed-in shopper's chat on the store's website — not their name, contact details or orders — is sent to Google to write a reply. Facebook and Instagram messages are never sent.
Google Fonts, which serves the typefaces on some pages, so your browser's IP address is visible to Google when it loads them.

With services a store connects

A merchant can send their own store's data to other systems with API tokens and webhooks. Data sent that way is handled under the receiving service's own terms.

For legal reasons

If the law, a court order or a government request requires it, or to protect the rights, property or safety of Sutra, our users or others.

If Sutra changes hands

If Sutra is merged, acquired or sold, personal data may move to the new owner, and this policy will keep applying to it.

06 How long we keep data

Merchant accounts and store records: for as long as the account is open. When a merchant closes their account or asks us to delete it, we delete or anonymize their data within 30 days — except records that the law requires us or the store to keep, such as invoices and payment records, which we keep only as long as required.
Facebook and Instagram access tokens: until the merchant disconnects the account in Sutra, which deletes the token immediately. Removing Sutra from your Facebook settings instead makes Meta revoke the token, so it stops working.
Messages and sender profiles from Facebook and Instagram: as part of the store's conversation history while the store uses Sutra, until the store or the sender asks us to delete them, and no longer than 30 days after the store's account is closed.
Login sessions: until you log out.
Audit logs and sign-in history: for as long as the store's account is open, to keep it secure.

07 How we protect data

Every connection to Sutra is encrypted with HTTPS.
Passwords are stored as one-way bcrypt hashes.
Facebook and Instagram access tokens are encrypted in our database.
Every message notification from Meta is checked against its signature before we accept it.
Each store's data is kept separate, and staff only see what their role allows.
Important changes are recorded in an audit log.
Access to our servers is limited to the people who operate Sutra.

No system is completely secure. If a breach affects your personal data, we'll tell you — and the relevant authorities, where the law requires it — without undue delay.

08 Your rights and choices

You have the right to:

see the personal data we hold about you, and get a copy of it;
correct data that's wrong or incomplete;
have your data deleted;
object to, or ask us to limit, how we use it;
withdraw consent you've given — for example, by disconnecting a Facebook or Instagram account.

Merchants can update most of their information in the Sutra dashboard, and disconnect a Facebook or Instagram account at any time from the Channels page of the inbox. Shoppers can update their details and notification settings in their account on the store's website. For anything else, email sutranepal01@gmail.com. We reply within 30 days, and may need to confirm your identity first.

You can also complain to the data protection authority where you live.

09 How to delete your data

You can ask us to delete your personal data at any time, including data we received through Facebook or Instagram.

If you messaged a store on Facebook or Instagram

Email sutranepal01@gmail.com with the subject “Data deletion request”.
Tell us the Facebook Page or Instagram account you messaged, and your Facebook name or Instagram username, so we can find your conversations.
We'll delete your messages, your name, profile picture and Page-scoped or Instagram-scoped ID from Sutra within 30 days, and email you to confirm.

If you connected a Facebook Page or Instagram account to Sutra

In Sutra, open the inbox's Channels page and choose Disconnect. This deletes the access token straight away and stops new messages arriving.
In your Facebook settings, open Business integrations, select Sutra and remove it.
To delete the conversations and contacts already stored, email sutranepal01@gmail.com from your Sutra account's email address, naming your store and the connected accounts. We'll delete them within 30 days and confirm by email.

Everyone else

Merchants closing their account and shoppers can email sutranepal01@gmail.com from the email address on their account, telling us which store it's about. We'll delete your data within 30 days and confirm by email.

We only keep what the law requires us or the store to keep — such as the invoice and payment record of a completed order — and use it for nothing else. Deleting data from Sutra doesn't delete it from Facebook or Instagram themselves; Meta handles that under its own privacy policy.

10 Cookies

Sutra only uses the cookies it needs to work:

a login cookie that keeps you signed in to the dashboard or a store's website;
cookies that remember your shopping cart, your store chat and the currency you chose;
a session cookie that protects forms against forged requests.

We don't use advertising or third-party tracking cookies.

11 Children

Sutra is a tool for businesses and isn't directed at children. We don't knowingly collect personal data from children under 16. If you believe a child has given us their data, contact us and we'll delete it.

12 International transfers

Sutra is operated from Nepal, and some of the service providers listed above process data in other countries. We only use providers that commit to protecting the data they handle for us.

13 Changes to this policy

We may update this policy as Sutra changes. When we do, we'll change the “Last updated” date at the top, and if the changes are significant we'll tell merchants by email or in the dashboard before they take effect.

14 Contact us

Questions, requests or complaints about privacy go to Sutra, Kathmandu, Nepal — sutranepal01@gmail.com.

This policy is governed by the laws of Nepal, including the Individual Privacy Act, 2075 (2018).