Nepfa
Cart

Privacy Policy

Last updated: September 6, 2026

1. Introduction

Welcome to Nepfa ("we," "our," or "us"), operated by Nepfa Group Private Limited. We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our marketplace platform, website, and mobile applications (iOS and Android).

2. Information We Collect

2.1 Information You Provide

  • Account information: full name, email address, phone number, profile picture
  • Delivery addresses: recipient name, street address, city, district, zone, pincode, contact number
  • Payment information: selected payment method (Khalti, cash on delivery). We do not store credit/debit card numbers — payment processing is handled entirely by third-party providers
  • Order information: items purchased, quantities, order amounts, delivery preferences, return/refund requests
  • User-generated content: product reviews (rating, comment text, up to 5 photos per review), wishlist items
  • Search queries: keywords and filters you use to find products

2.2 Information Collected Automatically

  • Device information: device type, operating system version, app version, screen resolution
  • Usage data: product pages viewed, categories browsed, sorting preferences
  • Push notification tokens: Firebase Cloud Messaging (FCM) or Apple Push Notification (APN) device tokens for delivering order updates
  • Local storage: authentication tokens, theme preference, and notification tokens stored on your device

2.3 Information from Third Parties

  • Google Sign-In: name, email address, and profile picture when you authenticate with Google
  • Apple Sign-In: name (optional) and email address (optional, may be a relay address) when you authenticate with Apple
  • Payment providers (Khalti): transaction confirmation, transaction ID, and payment status

2.4 Information We Do NOT Collect

  • Location data (neither precise GPS nor IP-based geolocation)
  • Contact list or address book
  • Health or fitness data
  • Biometric data
  • Calendar data
  • Call logs or SMS messages
  • Advertising identifiers (IDFA) — we do not request App Tracking Transparency permission
  • Crash diagnostics or performance telemetry (no crash reporting SDK is integrated)

3. How We Use Your Information

  • To create, authenticate, and manage your account
  • To process and fulfill your orders, including delivery coordination
  • To facilitate communication between you and sellers regarding your orders
  • To send push notifications for order status updates, delivery alerts, and promotional offers (with your consent)
  • To display your reviews and ratings on product pages
  • To maintain your wishlist and shopping cart across sessions
  • To personalize your shopping experience based on browsing and purchase history
  • To improve our platform, services, and user experience
  • To detect and prevent fraud, abuse, and security threats
  • To comply with legal obligations under Nepalese law

4. How We Share Your Information

We do not sell, rent, or trade your personal information. We do not use your data for cross-app tracking or targeted advertising. We may share your information with:

  • Sellers: Your name, delivery address, and contact number — only for orders you place with them, solely to fulfill your purchase
  • Delivery partners (NCM): Delivery address and contact number required to deliver your orders
  • Payment processors (Khalti): Order amount, transaction reference, and your contact information to process payments securely
  • Firebase (Google): Authentication data, push notification tokens, and uploaded images (review photos, profile picture) for platform operation
  • Cloudflare: Product and user-uploaded images for content delivery
  • Legal authorities: When required by law, court order, or to protect our legal rights

5. Data Security

We implement industry-standard security measures including: encryption in transit (HTTPS/TLS for all communications), secure token-based authentication (short-lived JWT access tokens with refresh token rotation), encrypted data storage via our cloud providers, and role-based access controls. Authentication tokens are stored locally on your device and cleared on logout. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as your account is active. Order and transaction records are retained for up to 7 years as required by Nepal's tax regulations. Reviews remain visible until you delete them. Wishlist and address data can be deleted by you at any time from your account settings. Upon account deletion request, we remove your personal data within 30 days, except where retention is required by law.

7. Your Rights

You have the right to:

  • Access your personal information stored in your account
  • Correct inaccurate or incomplete data via your profile settings
  • Delete your reviews, wishlist items, and saved addresses at any time
  • Request complete deletion of your account and associated data by contacting us
  • Withdraw consent for push notifications via your device settings
  • Object to certain uses of your data
  • Request a copy of your data in a portable format

To exercise these rights, contact us at privacy@nepfa.com or use the account settings within the app.

8. Cookies & Local Storage

On the web, we use local storage (not traditional cookies) to maintain your authentication session and remember your display preferences (such as theme). We do not use third-party tracking cookies or analytics cookies. The mobile app stores authentication tokens and push notification tokens locally on your device, which are cleared when you log out.

9. Push Notifications

With your permission, we send push notifications for: order confirmations and status updates, delivery tracking, promotional offers and deals, and important account alerts. You can disable push notifications at any time through your device settings. Disabling notifications does not affect your ability to use the app.

10. Camera & Photo Access

The mobile app requests camera and photo library access solely for: uploading product review photos (up to 5 per review) and updating your profile picture. Photos are uploaded to our secure servers and are not accessed for any other purpose. You can deny camera/photo access and still use all other app features.

11. Third-Party Services

Our platform integrates with the following third-party services:

  • Firebase Authentication (Google): Account creation and sign-in
  • Firebase Cloud Messaging (Google): Push notification delivery
  • Google Sign-In: Social authentication option
  • Apple Sign-In: Social authentication option
  • Khalti: Digital payment processing
  • Cloudflare R2: Image and asset storage/delivery
  • NCM (Nepal Can Move): Delivery logistics

Each third-party service has its own privacy policy. We encourage you to review their policies. We do not integrate any advertising networks or analytics tracking services.

12. Data Transfers

Your data may be processed on servers located outside of Nepal (including Google Cloud infrastructure and Cloudflare's global network). We ensure that any such transfers are protected by appropriate safeguards including encryption and contractual obligations with our service providers.

13. Children's Privacy

Our services are not intended for children under 16 years of age. We do not knowingly collect personal information from children. If we discover that we have collected information from a child under 16, we will take steps to delete it promptly. If you believe a child has provided us with personal data, please contact us at privacy@nepfa.com.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on our platform, sending a push notification, or emailing you. The "Last updated" date at the top indicates when the policy was last revised. Your continued use of our services after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

  • Email: privacy@nepfa.com
  • Platform: Nepfa
  • Company: Nepfa Group Private Limited
  • Business Address: Pokhara-5, Kaski, Gandaki Province, Nepal