Privacy Policy

At Paisoo, protecting your commercial confidentiality and personal data is fundamental to our marketplace. This Privacy Policy outlines how we collect, use, process, and safeguard your information in full compliance with the Individual Privacy Act, 2075 (2018) and the Electronic Transactions Act, 2063 of Nepal.

1. Categories of Information We Collect

We collect only the information necessary to provide a secure, authenticated, and verified transaction environment:

• Account & Contact Information: Full legal name, email address, phone number, professional role (buyer, owner, investor, advisor), and encrypted password hashes.
• Document KYC & Verification Data: Government-issued document numbers and photo uploads—including Nepali Citizenship Certificates (Nagrikta), National Identity Cards (NID), Passports, or Driving Licenses, as well as business PAN/VAT certificates. This data is collected solely for fraud mitigation and issuing verified status badges.
• Confidential Business Records: Audited Balance Sheets, Inland Revenue Department (IRD) Kar Chukta certificates, historical P&L records, commercial lease agreements, and startup cap tables uploaded to the encrypted Vault.
• Technical & Session Logs: IP addresses, browser user-agent data, session tokens (Supabase JWTs), and navigation timestamps collected to maintain active login sessions and detect suspicious login attempts.

2. Lawful Basis & Purpose of Data Processing

We process collected data under explicit user consent and legitimate commercial interest to:

• Authenticate user accounts and confirm verified ownership of listed businesses and startup pitches.
• Safeguard confidential business metrics through our two-tier blind teaser and encrypted Vault architecture.
• Facilitate direct, auditable communications between verified buyers, sellers, and accredited investors.
• Compile aggregated, fully anonymized industry benchmarks (e.g. Kathmandu cafe or SaaS valuation multiples) without exposing private entity details.
• Comply with statutory reporting, fraud prevention, and anti-money laundering obligations in Nepal.

3. Two-Tier Privacy: Public Teasers vs. Encrypted Vault

Paisoo implements strict structural boundaries between public marketplace discovery and confidential deal evaluation:

• Public Blind Teasers: General business overviews, broad geographic regions (e.g. Lalitpur, Pokhara), normalized annual turnover, and asking multiples are displayed publicly without disclosing exact registered company names or street locations.
• The Encrypted Vault: Identifying corporate documents, tax clearance certificates, customer records, and lease terms are stored in the encrypted Vault. They remain completely inaccessible until a verified buyer executes an electronic Non-Disclosure Agreement (NDA) and the seller explicitly approves access.

4. Strict Non-Disclosure & Permitted Disclosures

Paisoo does not sell, rent, monetize, or trade your personal information or business financial records to any third-party marketing companies or external advertisers. Information is disclosed strictly under the following narrow circumstances:

• Authorized Buyer Access: Vault records are decrypted and made accessible solely to prospective counterparties whom you have approved under a valid electronic NDA.
• Trusted Technical Infrastructure: Encrypted data is hosted on secure cloud infrastructure providers (such as Supabase and AWS) bound by strict enterprise data processing agreements.
• Mandatory Legal Process: We may disclose data if required to do so by a formal, lawful court order issued by a competent judicial authority in Nepal.

5. User Rights Under the Individual Privacy Act 2075

As a data subject in Nepal, you possess statutory rights regarding your personal information:

• Right to Access: You may inspect your stored profile information and KYC verification status at any time via your Account Settings.
• Right to Rectification: If your registered details, contact numbers, or business metrics change, you may update them directly or request an update through our support team.
• Right to Erasure (Account Deletion): You may permanently close your account from Account Settings. Upon account closure, public listings are removed immediately, and confidential documents and identity scans are permanently purged from active production servers within 30 days.

6. Cookies & Session Authentication

Paisoo uses essential session cookies and secure authentication tokens solely to keep you logged in, protect your account against cross-site request forgery (CSRF), and remember your persona preferences. We do not deploy third-party advertising cookies or cross-site tracking pixels.

7. Amendments to Privacy Policy

We may update this policy periodically to reflect statutory amendments in Nepal or enhancements to our platform security architecture. Continued use of Paisoo following the publication of an updated policy represents your acknowledgment of the revised terms.