0 0
Home / Privacy policy

Privacy policy

What we collect, why, and the rights you have under the DPDP Act 2023.

This Privacy Policy explains what personal data the 1stNlast app collects, why we collect it, who we share it with, how long we keep it, and the choices and rights available to you. We publish it as required by Google Play and to meet our notice obligations as a Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”).

  • Who we are
  • Scope of this policy
  • Personal data we collect
  • Why we process your data
  • Consent and legal basis
  • Device permissions
  • Who we share data with
  • Payments and financial data
  • SMS, WhatsApp and notifications
  • PIN codes and the One PIN One Piece model
  • How long we keep data
  • How we protect data
  • Your rights
  • Deleting your account and data
  • Children
  • Storage location and transfers
  • Data breach notification
  • Changes to this policy
  • Contact and grievance redressal

1. Who we are

The 1stNlast app is operated by 1stNlast Scarcity Comm Private Limited (“1stNlast”, “we”, “us”), a private company limited by shares, incorporated in India under the Companies Act, 2013.

Our registered and corporate office is:

1stNlast Scarcity Comm Private Limited
Prop No 55, Second Floor, Westend Marg, Saidulajaib, Gadaipur, New Delhi, South West Delhi – 110030, Delhi, India
CIN: U47912DL2026PTC468125 · GSTIN: 07AADCZ0836D1ZI

For the personal data described in this policy, we act as the Data Fiduciary. 1stNlast operates a scarcity-based commerce platform: only one unit of any given product variant is ever sold within a single PIN code. Understanding this matters for privacy, because your PIN code is central to how the service works.

2. Scope of this policy

This policy covers:

  • the 1stNlast Android customer app distributed through Google Play;
  • our customer-facing website and any web pages opened from within the app; and
  • our backend services that the app communicates with.

It does not cover our separate distributor and stockist portal or our internal admin console, which are governed by our agreements with those partners, nor any third-party website or app you reach through a link from our app.

3. Personal data we collect

We collect only what the service needs. The table below is an itemised description of the categories of personal data we process.

What we do not collect

  • We do not collect precise or background GPS location.
  • We do not read your contacts, call logs, SMS inbox, photos or files.
  • We do not collect biometric data.
  • We do not store your full card number, CVV, UPI PIN or net-banking credentials.
  • We do not sell your personal data to anyone, ever.
  • We do not use your personal data to train third-party advertising profiles.

4. Why we process your data

Each purpose below is specific. We do not repurpose your data for unrelated uses.

5. Consent and legal basis

We process your personal data on the basis of your consent, and for certain legitimate uses permitted by law, such as complying with a legal obligation or responding to a request you voluntarily make.

Consent you give us is:

  • Free — we do not make the app conditional on consent for unrelated processing;
  • Specific and informed — tied to the purposes listed in section 4;
  • Unambiguous — given by a clear affirmative action, never by silence or a pre-ticked box; and
  • Withdrawable — you can withdraw it at any time, as easily as you gave it.

If you withdraw consent, we stop the related processing. Some records must still be kept where the law requires it — for example tax invoices — and withdrawing consent for essential processing may mean we can no longer provide the service. Withdrawal does not affect processing already carried out lawfully.

Promotional messaging is separate from service messaging. Declining marketing never blocks you from buying, and you will still receive transactional messages such as OTPs and order updates because those are part of the service you asked for.

6. Device permissions

We request the minimum set of Android permissions. You can revoke any of them in Android Settings; the app will keep working with the corresponding feature disabled.

We do not request precise location, contacts, SMS reading, microphone or background location. If a future version needs a new permission, we will ask for it in context and update this policy first.

7. Who we share data with

We share personal data only with the parties below, only for the purposes stated, and only to the extent needed. Each is bound by contract to protect your data and to use it solely for the service they provide to us.

A current list naming the specific service providers we use, and the country in which each processes data, is available free of charge on request from the contact address in section 19.

We may also transfer data as part of a merger, acquisition or restructuring, in which case we will notify you and the acquirer will remain bound by this policy or a policy at least as protective.

8. Payments and financial data

Payments are processed by a PCI-DSS compliant payment gateway. Your card number, CVV, UPI PIN and net-banking credentials are entered on the gateway’s interface and are never transmitted to or stored on our servers. We retain only the gateway’s reference identifiers, the amount, and the payment status, which we need for reconciliation, refunds and dispute resolution.

Wallet balances are an account credit on our platform, not a bank deposit and not a prepaid payment instrument. Redemptions may require OTP verification, so keep access to your registered mobile number.

9. SMS, WhatsApp and notifications

Transactional SMS in India is sent through operator-approved DLT-registered templates using our registered entity and sender identifiers. We keep a log of messages sent to you, including the recipient number, template, content, delivery status and any failure reason, so that we can prove delivery and investigate complaints such as an OTP that never arrived.

We never ask for your OTP, password, card details or UPI PIN by phone, SMS, email or WhatsApp. Anyone who does is attempting fraud. Report it to us immediately using the contact details in section 19.

10. PIN codes and the One PIN One Piece model

Our platform sells only one unit of any product variant per PIN code, permanently. To make that work, we must record that a specific variant has been claimed in a specific PIN code.

This scarcity record is retained on a long-term basis because the rule is lifelong: the platform must be able to say, indefinitely, that a variant is no longer available in that PIN code. Where a scarcity record must outlive your account, we retain it in a form that does not identify you personally — we keep the product variant and the PIN code, and sever the link to your identity.

We use only the PIN code you type in. We do not read GPS, Wi-Fi positioning or cell-tower location to infer where you are.

11. How long we keep data

When a retention period ends, we delete the data or irreversibly anonymise it so that it can no longer be linked to you.

12. How we protect data

  • All traffic between the app and our servers uses HTTPS/TLS encryption.
  • Passwords are stored only as salted one-way hashes; we cannot read your password, and no employee can retrieve it for you.
  • OTPs and session refresh tokens are stored hashed, never in readable form.
  • Access to production data is restricted to authorised personnel on a need-to-know basis, with role-based access control and audit logging.
  • Repeated failed sign-in attempts temporarily lock an account to blunt brute-force attacks, and OTP requests are rate-limited per number and per network address.
  • Our infrastructure provider applies managed encryption at rest, and we take regular backups.
  • Product images uploaded by our team have location and camera metadata stripped before publication.

No system is perfectly secure. Please use a strong, unique password, never share your OTP, and sign out on shared devices.

13. Your rights

As a Data Principal under the DPDP Act, you have the right to:

  • Access a summary of the personal data we process about you and the identities of those we have shared it with;
  • Correct, complete or update inaccurate or incomplete data;
  • Erase your personal data, where we are not required by law to keep it;
  • Withdraw consent at any time;
  • Nominate another person to exercise these rights on your behalf in the event of your death or incapacity;
  • Grievance redressal — a readily available means of raising a complaint with us; and
  • Escalate to the Data Protection Board of India if you are not satisfied with our response.

How to exercise a right

Use the in-app option under Profile → Privacy & data, email info@1stnlast.com from your registered address, or write to our Grievance Officer at the address in section 19. We may verify your identity, typically by OTP to your registered mobile number, before we act — this protects you from someone else making requests in your name. We acknowledge requests within 3 working days and respond within 30 days.

There is no charge for exercising your rights.

14. Deleting your account and data

You can request deletion in either of these ways:

  • In the app, open Profile → Privacy & data → Delete my account ; or
  • email info@1stnlast.com with the subject “Account deletion” from your registered email address, or send the request from your registered mobile number.

When we process a deletion request:

  • your profile, contact details and login credentials are deleted or irreversibly anonymised;
  • your sessions are revoked immediately;
  • any remaining wallet balance is dealt with per our Terms — settle or redeem it before requesting deletion, because it may be forfeited on closure;
  • invoices, payment records and tax documents are retained for the statutory 8-year period because the law requires it, and are then deleted; and
  • scarcity records are retained in de-identified form, as explained in section 10.

Deletion is completed within 30 days of verification. Note that uninstalling the app does not delete your account.

15. Children

The app is not intended for anyone under 18, and you must be 18 or older to buy from us. We do not knowingly collect personal data from children. Where the law requires it, processing a child’s personal data needs verifiable consent from a parent or lawful guardian, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child has given us personal data, contact us and we will delete it promptly.

16. Storage location and transfers

Our application servers, database and product images are hosted with a cloud infrastructure provider, and some of our service providers process data outside India. This means your personal data may be transferred outside India. Where that happens we rely on contractual safeguards with every recipient, restrict them to processing on our instructions only, and comply with applicable Indian law and any restrictions notified by the Central Government on transfers to particular territories. You can ask us at any time which countries your data is processed in, using the contact details in section 19.

17. Data breach notification

If a personal data breach affects you, we will notify you and the Data Protection Board of India as required by law, describing the nature and extent of the breach, its likely consequences, the measures we have taken, and what you should do to protect yourself.

18. Changes to this policy

We may update this policy as the service, our providers or the law change. The version number and “last updated” date at the top will always reflect the current version. If a change materially affects how we use your personal data, we will give you prominent notice in the app or by message before it takes effect and, where required, seek your fresh consent. Continuing to use the app after a change takes effect means you accept the updated policy.

19. Contact and grievance redressal

For any question, request or complaint about your personal data, contact us:

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India in the manner prescribed under the DPDP Act and the rules made under it.