Privacy Policy

Effective 12 October 2026 (26 Asoj 2083 BS)

This policy explains how CurryRush LLC, a limited liability company registered in Rhode Island, United States (“CurryRush”, “we”, “us”) handles personal information in the Shamagri mobile app, on shamagri.com and in the shamagri.com bill portal (together, the “Service”). We follow the right to privacy in Article 28 of the Constitution of Nepal, the Individual Privacy Act, 2075 (2018) and its Regulations, 2077 (2020), and the Electronic Transactions Act, 2063 (2008).

This policy is also available in Nepali. If the two versions differ, the English version prevails.

1. Summary

We collect what is needed to issue, share and keep VAT and PAN bills, and nothing is sold.
Your bills, PAN and private items are never public. Items are listed on shamagri.com only when you turn that on.
Barcode and QR scanning happens on your phone. No camera images are uploaded.
You can delete your account in the app. Bills you already issued are tax records, so Nepali tax law requires us to keep them for six years.

2. Information we collect

Information you give us

Account: your email address and password, or your mobile number. Passwords are stored by Google Firebase Authentication in hashed form; we never see them.
2-step verification: the mobile number that receives your codes, or the authenticator app you register.
Business profile: business name, owner name, PAN, whether you are VAT-registered, address, phone number, and, if you choose, your district and your shop’s position on a map.
Catalog: the products and services you add, with prices, units, SKUs and barcodes, and where your device was when you added each item (see Location below).
Bills and credit notes: everything on a bill you issue, including the buyer’s name, PAN, address and phone number if you enter them, the items, amounts, VAT, payment method and notes. We also log each time a bill is printed or exported, so reprints can be marked as copies.
Received bills: bills that sellers share with you, and the lucky-draw status you record for them.

Information collected automatically

App usage (Google Analytics for Firebase): which screens you open and actions such as issuing a bill or saving an item, with your device model, operating system, app version and approximate region. These events never contain PANs, names, phone numbers, email addresses or bill numbers. They are linked to your account by an internal user ID only.
Crash reports (Firebase Crashlytics): technical details of crashes and errors, such as the screen you were on and the device state, linked to the same internal user ID.
Website (Google Analytics): on public pages of shamagri.com we record page views, searches and similar events with your IP address anonymized. Google Analytics uses cookies for this. It is never loaded on, and never receives anything from, your bill pages under shamagri.com/app.
Server logs: our hosting providers keep standard logs (IP address, browser, time and page requested) to run and protect the Service.

Information processed only on your device

Camera: used only when you open the scanner, to read barcodes and bill QR codes. Images stay on your phone.
Location in the app and in your account on shamagri.com: used only with your permission, when you set your shop’s position and when you add a catalog item (or tap to update an item’s location). The shop position you confirm is saved to your profile, and each item’s position is saved with that item, so nearby customers can find it. Buyers see how far away an item is, not its exact coordinates. We do not track your location in the background.
“Near me” on shamagri.com: your browser’s location is rounded to about 100 metres and used for that search only. It is not saved to any account.

3. How we use it

Under the Individual Privacy Act, we use personal information only for the purposes it was collected for:

to create your account, sign you in and protect it with 2-step verification;
to number, issue, store, share, print and export your bills, credit notes and sales register;
to deliver bills to the customers you share them with, and to show customers the bills they received;
to help customers prepare bills for the Inland Revenue Department (IRD) taxpayer lucky draw;
to search your catalog, and to publish the items you choose to list;
to fix crashes, understand which features are used and improve the Service;
to prevent fraud and abuse, and to investigate misuse;
to keep records and respond to requests as Nepali law requires.

We do not sell personal information, and we do not use it for advertising.

4. What becomes public

When you turn on “Show on shamagri.com” for an item, anyone, including search engines such as Google, can see that item’s name, price and unit, together with your business name, address, phone number, district and the shop position you set. Your PAN, your bills, your customers and your other items are never published. Turn the setting off, or delete the item, to remove it; search engines may take some time to drop their copies.

Customers you share a bill with. They see the full bill, including your business details and PAN, as on any printed bill.
Service providers that run parts of the Service for us, under contracts that limit their use of the data:
- Google (Firebase Authentication and SMS codes, Cloud SQL database, Cloud Functions, App Hosting, Analytics, Crashlytics, and Google Maps on Android);
- Apple (Maps on iPhone);
- Algolia (catalog search; holds item details, each item’s position and, for public items, your shop details).
Authorities. We disclose information to the IRD, courts, police or other government bodies of Nepal when the law requires it or a valid order compels it.
Business transfer. If CurryRush or Shamagri is merged or sold, your information may pass to the new owner under this policy.

A small number of authorized CurryRush staff can view accounts, bills and items through an admin panel, to provide support and handle abuse. Every view and action there is recorded in an audit log.

6. Where it is stored

Our database and servers are in Google Cloud’s Mumbai, India region (asia-south1). Our other providers may process data in other countries, including the United States. By using the Service you consent to this transfer outside Nepal. We choose providers that protect data with industry-standard safeguards.

7. How long we keep it

Profile, catalog, received-bill list and lucky-draw records: until you delete them or your account.
Issued bills and credit notes: at least six years from issue, as the Value Added Tax Act, 2052 and Income Tax Act, 2058 require. This applies even after you delete your account, and the customers you shared them with keep access.
Analytics and crash data: for the limited periods set in Google Analytics and Crashlytics (at most 14 months for analytics events).
Admin audit logs: as long as needed to investigate misuse and meet legal obligations.

8. Your rights

Subject to Nepali law, you can:

See your information: most of it is in the app and the shamagri.com portal, and you can ask us for a copy.
Correct it: edit your profile and items at any time. Issued bills cannot be edited; issue a credit note instead.
Export it: download bills as PDF.
Delete it: Profile › Delete account erases your profile, catalog, public listings, received-bill list, lucky-draw records and sign-in, except the issued bills described above.
Withdraw consent for location or camera in your phone’s settings, or unlist any public item.
Complain to us, and if we do not resolve it, to the relevant authority or court in Nepal.

To use a right that the app does not cover, email support@curryrush.com from your account’s email address or mention its mobile number. We may verify your identity first, and we reply within 30 days.

9. Your customers’ information

When you, as a business, record a buyer’s name, PAN, address or phone number on a bill, you decide what to collect and you are responsible for having a lawful reason to do so, as Nepali law requires. We store and process that information on your behalf only to provide the Service. Customers who want their details corrected or removed should contact the business that issued the bill; we will help where the law allows.

10. Security

All traffic is encrypted in transit (HTTPS/TLS), and data is encrypted at rest by Google Cloud. Every account must use 2-step verification or SMS sign-in. Database access is checked on the server for every request, so one business can never read another’s bills or private items, and catalog search keys are restricted to their owner. No system is perfectly secure: keep your password and phone safe, and tell us at once if you suspect misuse. If a breach puts your information at risk, we will notify you and the authorities as Nepali law requires.

11. Children

The Service is for businesses and adults. It is not meant for anyone under 18, the age of majority under the Act Relating to Children, 2075, and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.

12. Changes

We may update this policy. The effective date above shows the latest version. For material changes, we will notify you in the app or by email before they take effect.

13. Contact

CurryRush LLC, 700 Narragansett Park Dr, Pawtucket, RI 02861, USA
Email: support@curryrush.com