Privacy Policy

Last updated 30 October 2026

This is the honest version. It tells you what Retriever (formerly Pasal) holds, who else it reaches, how long it stays, and what you can do about it. We do not sell data to anyone. We run no advertising trackers, no tag manager, and no session recorder of our own, on retriever.com.np or on any shop built with it. A shop on its own domain may add its own Google, Meta or Microsoft ad tags to its own shop page; those load only if you say yes on that shop's page. We do use one product analytics service, PostHog, on Retriever's own pages, to see where shop owners get stuck between signing up and their first order. It records no sessions, and a shopper on a shop's page gets no profile in it. Where the answer is uncomfortable, it is written down here anyway, because a privacy policy that describes a tidier product than the real one is worse than no policy at all.

01
Who is behind this, and one word to get out of the way
Retriever is operated by Retriever Labs Pvt. Ltd., a private limited company registered in Nepal on 13 August 2026, registration number 399717/83/84, PAN 623700901, at Bhaktapur Municipality-2, Bhaktapur. In this policy, "we" and "us" mean that company, and "Retriever" means the service at retriever.com.np and the shops built on it.
We say shopper for the person buying from a shop, and customer means the same thing. Shop owner means the person running a shop on Retriever, and staff means someone they invited into the dashboard.
If anything here is unclear, email support@pasal.studio and a person will answer.
02
Who is responsible for what
Retriever has two kinds of data in it, and different people answer for each.
Your own account with us. If you open a shop, invite staff, or sign in as a shopper to see your order history, we decide how that account works and what we do with it. We are the ones to ask about it, and this policy is the answer.
Your customers' details inside your shop. The orders, bookings, khata entries, loyalty points, tickets and repair jobs in a shop belong to that shop. The shop decides what to ask for, what to write down, and what to do with it. We store it and process it so the shop works, and we act on the shop's instructions, not on our own ideas.
If you bought something from a Retriever shop, ask the shop first: it holds the record and can explain it. Corrections and deletion are subject to the protected-record limits below. If the shop has stopped trading or does not answer, email support@pasal.studio and we will review your verified request. Support cannot promise to erase protected originals or archives.
The split above describes how Retriever works and who to contact. It does not transfer or remove the obligations of Retriever or the shop under applicable Nepali law.
03
What we hold about a shop owner
Your account. Your email address, the display name and preset avatar you choose in Settings → Account, when the account was created, when you last signed in, and whether the email has been confirmed. You can sign in with a six-digit email code, a password, Google or Apple. An account does not need a password. You can set one if you want, from Settings → Account or the Forgot password link on the sign-in page, and if you do it is stored hashed, never in readable form.
If you use Continue with Google. Google tells us the email address on your Google account, your name and the link to your Google profile picture, and confirms it is you. We keep them with your sign-in account. We do not get your Google password, your contacts or anything in your Google account, and Google learns that you signed in to Retriever.
If you use Sign in with Apple. Apple gives us an account identifier and, where supplied, your name and email address. If you choose Hide My Email, that email may be an Apple private relay address. We keep the sign-in identity with your Retriever account. We do not receive your Apple password, and Apple learns that you signed in to Retriever.
Linked sign-in methods. Settings → Account → Linked accounts lets you link or unlink Google and Apple while keeping a usable sign-in method. We store the provider identities associated with your account. Signing in separately does not automatically merge two Retriever accounts; sign in to your existing account before linking another method.
Where you are signed in. The dashboard and Retriever Desk tell us which device each sign-in is on: a random ID the device keeps, whether it is a browser, a phone app or Retriever Desk, a short label such as "Safari on iPhone", and when it was first and last used. When a device is signed out, because of a device limit, because you signed it out from Settings, or because the same device signed in again, we record which of these it was and when, so the device can tell you why. This is used for the staff and device limits in our Terms, and is kept with your account.
The shop's audit log. Each time someone opens the shop's dashboard after signing in, signs out, or uses a counter PIN, and each change to a tax record such as an invoice, a return or a khata entry, the shop's audit log records who, when, and for a change the values before and after. The owner and staff with Billing can read it. It cannot be edited or deleted, because the billing rules a shop works under ask for exactly this trail.
Your shop's public profile. Shop name, web address, street address, phone, WhatsApp, Instagram and any other social links, opening hours, tagline, logo, hero image and about photos. All of this is published on your storefront on purpose, so anyone on the internet can read it, including search engines and anyone scraping pages. On a one person shop those are that person's own contact details, so publish only what you want strangers to have.
Where your shop sits on a map. If you put a pin on your loyalty card or on an event, we store a pair of coordinates for it. You get there two ways. Typing an address and pressing look up sends that text to OpenStreetMap and stores what comes back. Pressing use my current location asks your browser for your device's position, and your browser will ask your permission first. Say yes to that one only where the shop is. Location accuracy depends on the device and its surroundings; Retriever does not promise a particular precision. The saved pin is public like the rest of your shop profile. If you run the shop from home and press it in your kitchen, you have published your home. Type the address instead if that is you, and you can clear a pin at any time.
Your private reply address. A separate contact email you can set so your personal inbox is not published. It is deliberately kept out of the public part of your shop record. We use it as the Reply-To on mail we send your customers.
Your tax registration. Your registered legal name and your PAN, if you enter them so those details appear on receipts. These are not published on your storefront. They are printed on a customer's own receipt and invoice, and they are read by the function that sends that email.
Tax setup and inspector access. If supplied, we store your permit office, application, permit number/date, notes and private scan, with a retained before-and-after history. Authorized Settings/Billing users and platform operators can access the relevant setup. A separately authorized inspector account can read numbered billing records for shops matching its assigned PAN, including customer details in those records. This is operator-granted access, not automatic government access. Grant/revocation records are kept; individual inspector reads are not logged. Live IRD remains disabled even when a permit is recorded. Test requests use the published test identity and strip buyer identity and return free text, but send bill/reference numbers, dates and financial totals.
Payment details you publish. Your payment QR image, its label, and your payment note, which usually contains an eSewa number or a bank account and the name on it. These are public, because a shopper has to be able to scan and read them.
Your eSewa merchant key, if you connect one when it is offered. Stored so we can sign and check payments for you. Nobody can read it back through Retriever: not you, not your staff, not us through the ordinary interface. The dashboard can only tell you whether a key is set and when it was last written.
Your catalog. Products, prices, categories, sizes, colours, stock and photos. Also your cost prices, which sit in a separate owner only table and are never shown on a storefront or to a shopper.
Your shop's look. The colours, type, layout and photographs you choose in Design, drafts you or a connected assistant saved, and earlier versions so a change can be undone. Older versions are trimmed: once a shop has more than 20, those over 30 days old are removed, and only the latest 200 are ever kept.
Company email, if you set it up. The address on your own domain and the inbox it forwards to, which only you as owner can see in Retriever. To check your setup we look up your domain's public DNS records through Cloudflare. Retriever never sees the mail itself. One thing to know: if you choose Forward Email, the inbox it forwards to is written into a public DNS record on your domain, so anyone who looks can read it. Cloudflare's own forwarding does not do that.
Web counter PINs. The names you use at the counter are stored with your shop. PINs are stored separately as salted hashes and checked on the server; the dashboard cannot read the original digits back. After a successful check, the browser can keep a derived verifier in the open tab for up to 12 hours so that counter session can continue offline. It is not the server's hash and is not saved to browser storage. A counter PIN does not replace your account sign-in or staff permissions.
Your plan and what you paid us. The plan term, amount, promo code, payment reference, Fonepay status and settlement time, and your billing name, email, phone, business, address and PAN if provided. Billing details are stored by Retriever and appear in the plan invoice sent through Resend. Our Fonepay request carries the amount, merchant/terminal identity, payment reference and generic plan description, not those billing contact fields. Your bank or wallet handles its own payment credentials; Retriever does not collect them in this plan flow. We also record plan changes and trial end.
Order and message alerts. If you turn on order and message notifications, the address your browser gives us to deliver them to, and which account switched it on. A message alert, sent when a customer asks to talk to a person, names the channel (Instagram or Messenger) and nothing else: no customer name, no message. Nobody can read these through Retriever; only the function that sends the alert can.
Alerts on a phone. In the iPhone and Android apps, turning on alerts gives us the push token Apple or Google issues for that phone, whether it is an iPhone or an Android phone, and which alerts you chose (new orders, inbox messages, team chat). We use it only to deliver those alerts, and Apple's or Google's push service carries each alert to the phone. Turning alerts off in the app or signing out deletes the token. If you remove the app, the token stops working and we delete it the next time an alert cannot be delivered to it.
Help chat questions. What you type into the help assistant in your dashboard, plus the last six messages of that conversation, is sent to OpenAI's API so it can write the answer. The question and each earlier message are cut to 2,000 characters first. Two things about your shop go with it. Which features you have switched on, so the answer only covers buttons you actually have. And, so a question about your own money can be answered at all, whether each figure on your dashboard is a number, a zero, a book your account may not read, a book your shop does not keep, or a reading that did not load.
Your AI permission choice, its version and the time it was recorded are saved against your account. You can change that choice in Settings → AI assistants → Zuno. The amounts themselves are never sent to OpenAI. Its answer comes back with named blanks in it, and our own server puts your figures, and the names on your khata, there afterwards. Retriever does not attach product, order or customer records to an OpenAI chat request. Anything personal you type into your question or history is sent with that text. When the assistant is not available to your shop, the dashboard answers from a list of help articles held on your own device and nothing is sent anywhere. Do not paste a customer's details into it.
Help chat usage. How many questions your account asked the help assistant on each day, so we can keep one runaway client from running up a bill. It is a count, not the questions. We also record which family each question came from, out of a fixed list of ten subjects: today's takings, the week, the khata, repairs, orders, unpaid orders, any other money question, a request to change something, a question about using Retriever or about your plan, and one for everything else. Each photo read by Add from photo is counted here too, under everything else.
The family is worked out from your words at the moment you ask, and the words are not kept with it. It is the subject only, never the question you typed and never the answer. It is not filed against you either: the tally holds a day, a family and a number, with no account and no shop on it. We keep it so we can see which kinds of questions owners actually ask, and decide what to build next and what to charge for, without reading anybody's questions.
The AI product writer. When you press Write it with Zuno in the product editor, that product is sent to Anthropic's API so it can draft the words: its name, price, unit, description and category, its first photo, the categories your shop already uses, and your shop's name, trade and area. We send the link to that photo and Anthropic fetches it, so the photograph itself reaches them and the model sees it. It is the product photo your shop already publishes on its own storefront. Nothing else goes, and nothing comes back saved. The drafts sit under the box until you press one.
Add from photo. When you press Add from photo on the Add a product screen, the photo you take or choose is sent to Anthropic's API so it can suggest a name, a short description, a category and a few highlights. Your phone or computer first shrinks the photo and saves it again as a new picture, which removes its location and camera details. The photo goes with your shop's name, trade and area and the categories your shop already uses. No price, stock or customer details are sent, and Zuno never fills in the price or the stock. Nothing is saved until you press Save; the photo becomes your product's photo only then. Each photo read counts as one of your daily Zuno questions.
An Instagram account, Facebook Page or WhatsApp number you connect. Its ID and name, the access token Meta issues for it, encrypted by our server, the token's expiry where it has one, and which owner connected it and when. When you connect a Facebook Page, Facebook Login for Business shows you the permissions Retriever asks for, and Retriever reads the list of Pages you manage so you can pick one. That list, with each Page's access token encrypted, is held for ten minutes while you choose and cannot be used after that. If your Page belongs to a business portfolio, Retriever uses that access only to list the Page; it reads and changes nothing else in the portfolio. Your own Facebook login token is used for those few requests and not stored, and Retriever does not read your personal Facebook profile. Retriever does keep your app-scoped Meta ID (an ID Meta gives only to Retriever's app, not your profile), so that removing Retriever in Meta's settings can find the connection. It is kept only as long as the connection (and, for a Facebook Page, up to ten minutes while you choose the Page), and deleted with it. What the connection then stores about your customers is in Instagram, Facebook Messenger and WhatsApp below.
If you asked us about opening a shop. Older shops came through a Create Shop form that recorded the shop name, your name, your phone, your email, what you sell and your note. We no longer use that form: you open a shop yourself at retriever.com.np/create. Nothing in Retriever sends us a lead any more, so no new record is being made. The records the form left are kept, and only our own founder account can read them. Ask us and we will delete yours.
04
Team conversations and personal notes
Team stores message text, the sender and recipient, the shop, timestamps and read markers. A direct conversation is available to its two participants while they still belong to the shop. Group conversations also store the group name and membership. Only current group members can read and reply; a newly added member can read earlier messages. Removing a member ends their access. Account names and avatars appear to the people you can message.
Personal notes belong to your signed-in account across shops. Other shop users, including the owner, cannot read them through Retriever. Removing a note hides it and allows restoration for 30 days; it does not permanently erase the stored record. Team messages and notes have no scheduled automatic deletion. The 30-day deletion rule for customer Inbox messages does not apply to them. Retriever stores these records in its database; they are not end-to-end encrypted.
05
What we hold about a shop's staff
If you are a staff member at a Retriever shop, this is what exists about you.
Your roster entry. Your email address, display name, the dashboard permissions the owner grants and, if entered for wage records, your PAN. The owner enters this, and only that shop's owner can read the roster row. The owner is responsible for telling you about it and can send an optional staff invitation. The shop also appears when you sign in with the invited address.
Your payslips. If your shop issues you one through Retriever, the slip holds the period it covers, your basic pay and your allowance kept apart, every earning and every deduction as its own line with the amount and, for a deduction, which of the grounds the Labour Act allows it was taken on, the two totals and the net, how you were paid and on what date, the reference the owner typed for the transfer, the slip number, your name, your email address, your PAN if the owner recorded one, and any note the owner added. It is the most sensitive thing Retriever holds about anybody, so the two paragraphs after this one say who can read it and what can be done to it.
Who can read a payslip. You, and the owner of the shop that issued it. Nobody else, and this is the one place in Retriever where the tabs an owner grants make no difference at all: a colleague holding every permission there is reaches none of your payslips. That is deliberate. Sight of another person's wages is not something a shop can hand out, in the same way and for the same reason that staff management itself is not. Until you have signed in, a slip issued to you can be read by the owner and by no one else. It becomes yours to read the first time you sign in with the address on the roster. Your name, your email address and your PAN are copied onto the slip at the moment it is issued and are never read back off the roster afterwards, so correcting the roster cannot restamp a document already in somebody's hands.
A payslip is never edited and never deleted. If one is wrong, the shop issues a correction, which is a new slip that supersedes the old one, and both stay on the record. There is no way to rewrite one: not for the shop, not for you, and not for us. If you close your Retriever account the slips stay with the shop, because they are the shop's own wage record as well as yours, with the link to your account removed.
Your own Retriever account. The same as any owner account: email, when it was created, when you last signed in.
Your name on the sales you rang. A counter sale records who rang it as plain text, so it stays correct in the shop's records after you leave. Removing you from the roster removes your access and your roster entry. It does not rewrite the sales you already rang, the loyalty points you granted, or the orders you handled.
When you are removed from a shop. Your roster entry, your access and that shop's order alerts on your devices are deleted. The entries the shop's audit log holds about you (your sign-ins to that shop, your PIN use and the changes you made to its tax records) stay, as described above. Your own Retriever account is not deleted with them; to close it, follow our deletion steps.
Your web counter PIN, stored as a salted hash and checked as described above. The original digits cannot be read back through the dashboard.
06
What a shop holds about its customers
If you run a shop, this is what Retriever stores for you about the people who buy from you. All of it is stored by us on the shop's behalf. Shop access, platform support and separately authorized inspector access are described below; ordinary shop accounts cannot browse another shop's records.
Orders. An order holds:
- the customer's name, phone number and email address;
- the delivery address, but only for a delivery order, because pickup and dine-in send an empty one on purpose;
- which table a dine-in order came from, read from the QR sticker the guest scanned and not from anything their phone claims;
- the note the shopper typed, which can hold anything they choose to put in it, such as a landmark, a gate code or an allergy;
- every line of the order with quantities, prices, sizes and colours;
- the money, meaning subtotal, discount, any promo code, delivery fee, service charge, VAT and total;
- whether it is paid, its status, and the time.
If the order is cancelled, it also holds the reason the shop typed, which is sent to the customer word for word.
Serials and service history. A shop can record each unit's serial number, optional IMEI, warranty details and stock movements, and link a unit to its sale, return or repair. Authorized shop users can look these up; a customer's own receipt may include the assigned serial. Private stock identifiers are not published as a public inventory list. Billing and archive records can retain these links with the customer's contact and transaction details.
Optional review invitations. If a shop saves a review link, qualifying purchase or visit events can create request records even while sending is paused. We store the recipient name/email, source record, limited visit description, timing, prepared email, review and opt-out links, send attempts, provider result and suppression/cooldown state. Automatic email requires the shop to enable sending. The recipient's opt-out is kept for that shop and address. Retriever does not fetch Google review text, star ratings or the outcome; following the Google link is your separate visit to Google.
Back-in-stock alerts. On a sold-out item, a shopper who is signed in can ask to be told once when it is back. The alert goes only to the address of their own account, which sign-in has already checked with a code. We store that address, the item and option, the language, when it was asked and when it was sent. One email is sent when the item is back, with a link to stop; then the request is spent. A request not yet sent lapses after 180 days; a sent or cancelled one, with its email, is deleted 30 days later, and a shop's requests are deleted when the shop closes. A stop is kept for that shop as a one-way code made from the address, not the address itself. The address is read only by Retriever's sending system, by Resend to deliver the email, and by Retriever staff when needed to run the service; the shop sees how many people are waiting, not who they are.
Product reviews. If a shop takes reviews, a shopper who is signed in can review an item from an order they placed themselves on that shop's page with their own email address, once the shop has marked it done and paid and for 180 days after the order, once per item. Orders the shop entered for them, orders whose email address the shop filled in or changed afterwards, chat and Instagram orders, and counter sales cannot be reviewed. We store the stars, the text they write (with formatting and hidden characters removed), a short form of the name on the order (the first name and the first letter of the last name; a single name as it is; nothing if the name holds an email address or numbers), the order and item it is about, the date it was bought, when it was written, their account, and a one-way code made from their email address so the same person cannot review the same item twice. The address itself is not stored with the review. The shop chooses which reviews to show, and cannot change what a buyer wrote; the shop owner sees the order number and can reply once in public. A published review shows the short name (or "A buyer"), the stars, the text, the date of purchase (not the time) and any reply, to anyone visiting the shop's page, for as long as the order stays done and paid. The shopper can take their review down from their account; it is then never shown again. A review the shop hides, or the shopper takes down, is kept as a record and is not shown. If the shopper's Retriever account is deleted, the review stays without the link to the account or the short name, and shows as "A buyer".
Who can read an order. The shop owner and staff granted Orders, Billing, Customers, Returns or Events permission can read that shop's orders, including the customer names, phone numbers, email addresses and delivery addresses. Those permissions cover the shop's orders, not only the sales that staff member handled. An account with none of those permissions does not by itself grant this access. A shopper signed into their own Retriever account sees the orders that carry their email address. Someone holding an order link, and nothing else, can see only whether it is paid and what its status is. A separately authorized inspector can also read numbered orders in its assigned PAN scope, as described above.
Payment evidence. If a shop takes money by QR, the customer can type the transaction number from their bank or wallet and attach a screenshot. The screenshot is a photograph of somebody's banking app, so it usually shows their account name, an account or wallet number, and often a balance. Retriever treats both as a claim, never as proof: nothing is marked paid because a customer said so. The screenshots sit in a private store; authorized shop users can obtain a signed link that stops working after five minutes. Anyone holding that link can use it before expiry. The transaction number is also printed on the customer's own invoice email.
Khata, the credit book. If a shop lets a regular take goods on a tab, it records that person's name, phone number, the amount, whether each line is credit taken or money settled, a note, and the date. This one is different from everything else here and deserves the difference stated: the person named did not type any of it, has no Retriever account, is not told by Retriever that the record exists, and cannot see or correct it themselves. The shop's agreement with us requires the shop to tell them, and to answer them within 14 days if they ask. Only that shop, and the staff it granted the khata tab to, can read it. It is never published, never shared with any other shop, and never used to score anyone's credit. We are not a credit reference agency and we do not report a shop's khata to anyone. If you believe a shop has written something about you that is wrong, write to the shop, and write to us if you cannot reach them.
Loyalty points. The ledger stores the customer's name, their phone number where they left one, and every adjustment: how many points, the reason a staff member typed, who made it, and when. Adjustments cannot be edited or deleted, so a correction is a new line rather than a rewrite. The other half of a balance is not stored at all. It is worked out each time from what that person has spent at that shop. Which spending counts depends on who is asking, and that split is deliberate. The shop's own screens match you by your phone number, or by your name if you never left one, because a person is standing at the counter and staff can see who it is. Anything you see yourself, on the website or on a card in your phone, matches only the email address you signed in with and proved. Points a shop typed against your phone number therefore show at that counter and can be spent there, and they do not show on your card. We tried joining a proved email to an unproved phone three times, and each attempt let somebody spend points that were not theirs, so we stopped joining them. So a loyalty scheme is, mechanically, a lasting link between a named person and everything they have ever bought from that shop. The owner and staff granted Customers or Orders permission can read the loyalty ledger. Granting or redeeming points also requires an authorised permission.
Bookings and appointments. The name, phone, optional email, date, time, how many people, a free text note, the status, and the shop's reason if it declines. Anyone can request a booking without signing in. For a garage, the booking form also asks for the vehicle plate, which is stored at the front of that booking's note. Nobody outside the shop can read a booking. A shopper signed into Retriever sees bookings that carry their own verified email address.
Event tickets. The name printed on each ticket, copied from the buyer at checkout, and whether and exactly when that person walked through the door. The ticket buyer's name, phone and email are also recorded as an ordinary order. One thing to know before you forward a ticket: the ticket code is the key. Anyone holding the code, including anyone in a group chat where a screenshot was shared, can look up the holder's name and whether they have been admitted. Treat a ticket like a boarding pass, not like a poster. That warning matters more now the ticket can live in your phone's wallet, because a wallet card can be set to show on a locked screen. Anyone who can see your screen can photograph the code, and the code is the whole key. A ticket in a wallet is also not a receipt: it carries the name and the tier and nothing about what was paid.
Repairs. For a shop that takes work in, the customer's name and phone, the device they handed over, the fault they described, the quote, any deposit and the final charge. Like khata, this is typed by counter staff about somebody who never touched the software. The owner and staff granted Repairs can read it. A separately authorized inspector can read numbered repairs within its assigned PAN scope, as described above.
Returns. What came back, the size, the reason, the refund and how the money went back. A return recorded from a receipt is stored against that order, and the order carries the customer's name, phone and email, so that return is about an identifiable person and the shop's customer list relies on it: refunds are subtracted from what that person has spent with the shop. A return recorded with no order number names an item and an amount and nobody. Only the owner and staff granted returns can read either.
The Ledger. Revenue and expense lines a shop types. The labels are free text and in practice they name sponsors, venues and hired people. Only the owner and staff granted Ledger can read it.
The customers list. Not a separate collection. It is the order table read back and grouped, so a shop can search for a customer from months ago and see what they have spent in total.
Invoices. When an order is marked paid, it is given the next number in that shop's own tax invoice series for the current Nepali fiscal year, with the fiscal year and the moment it was allocated. The number and the document belong to the shop, which is the taxpayer.
Bill links. When a counter sends a receipt on WhatsApp or another chat app, it can add a link that opens that one bill, with a button to download it as a PDF. Anyone holding the link can open it. The bill it shows carries the items, the money, the shop's details and, as a tax invoice must, the customer's name and, where the shop recorded them, their business name, PAN and address. It leaves out the customer's phone, email, delivery address and order note. A link has no expiry date, and stops working when the shop is closed on Retriever: it then shows no bill, only that the shop has closed. The shop can turn off one bill's link from the counter, or every link at once in Settings. We count how often each link is opened and when it was last opened.
A shopper's own Retriever account. If you sign in on a storefront, we email a one-time six-digit code and create an account for that email address. The account is ours, not the shop's, and it is what lets you see your own orders, tickets and bookings across every Retriever shop you have bought from. It is keyed on the verified email in your session, so it shows you the orders that carry your email address and nothing else. One caveat we would rather state than hide: a shop's checkout does not verify the address a shopper types, so if somebody types your address by mistake their order can appear in your account. Tell us and we will take it out.
Your saved details, and where they travel. You can tell Retriever your name, phone and delivery address once, so you are not retyping them at every shop. That is one record for your account, not one per shop, and it is yours to change. It fills in your checkout. It is not handed to shops to browse, and no shop can search it.
There is one door into it and we would rather name it than let you find it. If you add a shop's loyalty card to your phone and a staff member scans that card at the counter, they are shown the name and phone on your account, along with the email the card was issued to. That is the point of scanning it: they are trying to find out who is standing there. It means a shop can learn your name and number from the card alone, even if you have never bought anything from them, because adding a card only takes a Retriever sign-in. Only staff that shop trusted with its orders can do it, only for a card you chose to add, and only one person per scan. If you would rather a shop did not have that, take their card out of your wallet, or leave the name and phone on your account blank.
07
Instagram, Facebook Messenger and WhatsApp
Meta runs Instagram, Messenger and WhatsApp. A shop on Retriever can connect its own account on them so its customers' messages arrive in the shop's Inbox, and Retriever answers people who message Retriever's own accounts. This clause covers both. The short version, if you messaged a shop: that shop's owner reads your messages in Retriever, Retriever deletes each one within a day of its turning 30 days old, and you can have them deleted sooner by following our data deletion instructions.
A shop's Instagram inbox. Once a shop connects its professional Instagram account, Retriever stores the messages customers send that account and the replies sent from it, whether sent from Retriever or from Instagram itself, each with the customer's Instagram ID for that account and the time. Conversations from before the connection are not imported. Photos, videos and files are not copied into Retriever: the inbox notes that something was attached, and it stays in Instagram. Retriever also asks Meta for the name, username and profile photo of a customer who has messaged the shop, as Meta provides them, and keeps them with that conversation.
A shop's Facebook Messenger inbox. Once a shop connects its Facebook Page, Retriever stores the Messenger messages customers send the Page, the label of any button they tap, and the Page's replies, whether sent from Retriever or from Meta Business Suite or the Messenger app, each with the customer's ID for that Page and the time. A message Meta delivers while another app is handling that conversation is kept too. Conversations from before the connection are not imported, and attachments are not copied into Retriever. Retriever also asks Meta for the customer's first and last name and profile photo, as Meta provides them, and keeps them with that conversation.
A shop's WhatsApp inbox, once it is available. When a shop connects its WhatsApp Business number through Meta's sign-up window, Retriever stores the business account's ID, the number as it is displayed, its verified business name and whether it is registered. The number's registration PIN is never stored. Retriever then stores the messages customers send that number and the shop's replies, including replies sent from the WhatsApp Business app on the shop's phone, each with the customer's WhatsApp number, or the ID Meta uses for them when it does not share the number, the profile name WhatsApp sends with each message, and the time. Photos, voice notes and files are not copied into Retriever, but a caption is kept, a shared location as its place and coordinates, and a shared contact as its name. WhatsApp's delivery reports are used only to mark whether a reply arrived.
Sending your order on WhatsApp. After you order from a shop that has a WhatsApp number, the order's page can offer "Send this order on WhatsApp", unless the shop has turned it off. Tapping it opens WhatsApp with your order typed out: the order number, the items, the total, pickup or delivery, and a link to the order's status. Your name, phone, address, email and note are never added. Nothing is sent until you press send in WhatsApp, and Retriever does not see that message. WhatsApp is Meta's service, and its own terms and privacy policy apply to what you send there.
Who can see a shop's conversations. Only the owner who connected that account, signed in to Retriever. Staff do not see the inbox, whatever permissions they hold. Another owner of the same shop would have to connect the account again, which starts an empty inbox. No other shop sees them, and they are never shown on the storefront. These conversations are the shop's records in the sense of Who is responsible for what above: Retriever stores them for the shop. The people at Retriever Labs who can reach the database, described in Security below, can reach them too.
Replies. Retriever sends a reply only to someone who wrote first, and only within 24 hours of their last message, which is the time Meta allows. It never starts a conversation, and on WhatsApp it never sends a template message. A reply or product card goes to Meta, which delivers it. A product card carries a product's name, price, photo and a link to it on the shop's website, and one sent by automatic product help also carries the product's code. On WhatsApp, automatic product help sends the same facts as text with the product's link, which WhatsApp previews.
Comment replies, once Retriever offers them. A shop that turns this on picks trigger words, such as "price" or "कति". When someone writes one in a comment under the shop's Instagram post or Reel, Retriever posts one of the shop's short public replies under it and sends that person one private message with the product the shop linked to that post. Meta allows one private message per comment, within 7 days of it. Retriever keeps the comment's text, the commenter's Instagram ID for that account, which post it was on, and whether each reply went, and deletes them within a day of their turning 30 days old, or at once when the shop disconnects. No AI is used, and a person who sent HUMAN or STOP, or whose conversation the owner took over, gets no private message.
How long it stays. Messages are kept for 30 days. A job that runs every hour deletes each message, and automatic product help's copy of it, within a day of its turning 30 days old, and drops the name, username and photo of a customer within a day of their 30th day without writing. The customer's ID for that account, the time of their last message, when the owner last read it and whether another app was handling the conversation are kept on a private list while any message of theirs is kept, and deleted within a day once they have not written for 30 days and none of their messages is left. On WhatsApp that ID is usually the customer's phone number, and Meta's other ID for them is kept beside it when Meta sends both. If a customer unsends or deletes a message in the app, Retriever's copy is not removed with it: it goes with the rest once it is 30 days old, or sooner if they ask us.
Labels. The owner's marks on a conversation (Priority, Follow up and Done) and the time a customer asked to talk to a person are kept on the same private list, and deleted with it.
Disconnecting deletes it. The owner can disconnect at any time from Inbox settings in the shop's Inbox; only while a reply sent in the last minute is still on its way does the Inbox ask them to wait a minute. Disconnecting immediately deletes every message, customer ID, name and photo Retriever holds for that account, product help's settings and the messages and replies it was holding, and the encrypted access token. Copies inside our encrypted backups are not edited; they expire within 35 days. When the owner disconnecting is the one who connected the account, Retriever then asks Meta to stop: for Instagram it withdraws Retriever's permission, for a Facebook Page it stops the Page sending messages to Retriever, and for WhatsApp it unsubscribes Retriever from the shop's business account unless another shop on Retriever still uses it. If Meta does not confirm, the Inbox says so, and the owner can remove Retriever in Meta's own settings, as the data deletion page explains. Connecting a different account or Page, or a different owner connecting, deletes the previous conversations the same way.
Removing Retriever in Facebook's or Instagram's own settings has the same effect as disconnecting: Meta tells Retriever, and Retriever deletes at once everything it holds for every Instagram account and Facebook Page that person's login connected, in every shop. If the person also asks Meta to have their data deleted, Meta gives them a confirmation code and a link to a Retriever page that shows whether the deletion was received or completed, and on which day. Retriever keeps a record of each such notice (the confirmation code, when it arrived and finished, and how many connections, messages and customers it removed), with a coded form of the person's Meta ID for a day and the rest for a year, and no message or name. A WhatsApp number is not covered, because Meta's notice does not say which number it was.
Automatic product help. On Instagram, and on Messenger and WhatsApp where Retriever has switched it on, it is off unless the shop's owner turns it on for a connected account, after reading which AI provider is used and confirming that the shop's own privacy notice tells its customers. So a customer's WhatsApp messages to a shop may be answered automatically only when that shop has turned it on, and only within 24 hours of the customer's last message. On the chat on a shop's own page it is on by default, where Retriever has switched it on, unless the shop turns it off ("Chat on a shop's page" below). When it is on, Retriever answers a customer's message itself where it can: a greeting, a product code or a product's name is matched by Retriever's own code, with no AI involved. When that finds nothing, the customer's latest message is sent to Anthropic, the provider named on the owner's consent (and, for the chat on a shop's page, on this page), together with the shop's public catalogue: product names and codes, prices, sizes and colours with whether each is in stock, units, photo links and the shop's web address, for up to 100 products. The model can suggest up to three of them, or ask for a person. The customer's name, photo and ID, their earlier messages, other conversations, buying prices and stock counts are not sent. Anything a customer types into the message goes with it, so personal details they write there reach Anthropic too. Anthropic handles it for Retriever under its commercial terms and data processing addendum, which do not allow it to train its models on it. Anthropic deletes it within 30 days, unless its safety systems flag it as breaking Anthropic's usage policy, when it can keep it for up to two years, or the law requires longer. Deleting a conversation in Retriever does not delete Anthropic's copy.
Its answers are short texts, product cards and links to the shop's website. Nothing is ordered or paid for in the conversation. A copy of each message product help handles, and its reply, is kept for 30 days and deleted with the rest of the inbox within a day after that. Anyone can send HUMAN to stop automatic replies in their conversation. They stay off until the customer sends START or the owner hands the conversation back, or until the customer writes again after 30 days without writing; automatic replies then start again, and on Messenger, on WhatsApp and on a shop's page chat the first of them says it is automatic. When the owner takes a conversation over, by pressing Take over conversation or by replying from Retriever (or, on Messenger, from Meta Business Suite, and on WhatsApp, from the WhatsApp Business app on the shop's phone), automatic replies stay off for that customer the same way, and the owner can turn the feature off altogether. If Retriever changes the provider, product help stops until the owner agrees to the new one, and on a shop's page chat until this page names it.
Messages to Retriever itself. When you message @pasal.studio on Instagram, or Retriever's own Facebook Page once Retriever receives that Page's messages, Retriever stores your ID for that account, your message text, the time and the replies we send, so the founder can read the conversation in a private founder inbox. These messages are deleted within a day of turning 30 days old. Attachments are not copied into Retriever, and a message you unsend stays until then. Automatic replies come from Retriever's public guides and answers the founder has written, and do not send your message to an AI provider. Type HUMAN to pause them and START to resume. On Facebook, they also pause when someone at Retriever answers you in person. Retriever also keeps a record of each message the automatic replies handled, including ones they chose not to answer: which message it was, your ID, the reply text if one was sent and whether it was delivered. These records are deleted within a day of turning one year old. We keep them for a year as a record of what our automatic replies said; in their first days they also stop a reply being sent twice. Your ID is deleted with the last of these records, unless automatic replies to you are paused (you sent HUMAN, or on Facebook someone at Retriever took the conversation over or answered you in person): then your ID and the pause are kept, with no fixed deletion date, until you send START or we resume them. If you message Retriever's support number on WhatsApp, that conversation stays in WhatsApp on Retriever's phone and is not stored in Retriever.
One exception, for completeness. While the founder runs a short test of product help on @pasal.studio, switched on for at most 15 minutes at a time, a message sent to it in that window may go to our AI provider with a sample shop's catalogue. The test keeps your ID, the message and its reply, and deletes them within a day of their turning 30 days old.
What Meta keeps. Instagram, Messenger and WhatsApp hold every conversation under Meta's own terms and privacy policy, before Retriever sees it and after Retriever deletes its copy. Deleting a message in Retriever does not delete it in Meta's apps, and the shop can still see it there.
Separately from all of this, several buttons in Retriever open WhatsApp with the recipient's number, the text, or both already filled in: a receipt or a thank-you from the counter, a message to a customer about an order or a booking, or a shopper's message to a shop from its storefront. The number and text travel to WhatsApp inside the link, so Meta receives them when the link is opened, and the message is sent only if the person presses send in WhatsApp. These buttons do not use a shop's connected inbox.
08
Chat on a shop's page
A shop can turn on a chat button on its page. Anyone can write to the shop there without an account. Their browser keeps a random key so the conversation is there when they come back; Retriever keeps only a one-way code made from that key (a SHA-256 hash), not the key itself. We store the messages and when they were sent, anything the visitor chooses to give so the shop can reach them (a name, a phone number, an email address), when their page last read the conversation, and the shop's labels on it. To limit how many chats and messages one place can send, we also keep a code made from their internet address (for IPv6, the network part only) with a secret key that only Retriever's database holds. It is not the address, but anyone holding that key could match it to an address, so we delete it after a day.
Signed-in shoppers. If the visitor is signed in to their shopper account on that page, the conversation is tied to that account so it follows them to another device, and a conversation they started before signing in joins it. The shop then sees the name and phone number on the account, its email address, and how many orders were placed with that shop under that email. It is never shown to another shop.
Who reads it. The shop owner, in the Inbox. Staff accounts cannot open the Inbox. When a visitor writes, the owner's phone can show an alert that says only that a message arrived on the shop page, at most once every 15 minutes for one conversation.
Email. When a visitor gives an email address, Retriever first sends one email asking them to confirm it, with no words from the shop in it. If nobody presses its link, nothing else is sent there. Once it is confirmed (or if the visitor is signed in, to their account's own address), a reply the shop writes after the visitor has left the page is emailed to them through Resend, from "the shop's name via Retriever", with the shop's contact email as the reply-to address: one email per reply, at most every 30 minutes. Nothing else is sent to that address.
How long. Each message is deleted 30 days after it was sent. A conversation with no message left is deleted, with the name, phone number and email the visitor gave. A chat that was opened and never written in is deleted after a day. Deleting a shopper account deletes that account's conversations. When a shop closes, its chat stops at once and its messages go on the same 30-day rule; deleting a shop deletes them all.
Automatic replies. Messages in this chat may be answered automatically by default, using Anthropic's Claude, unless the shop turns automatic product help off in its Inbox; Retriever switches it on shop by shop. Where it is on, the chat says, before anyone writes, that replies may come from the shop's automatic assistant until the shop answers, and it works as described under "Automatic product help" above: a greeting, a product code or a product's name is answered by Retriever's own code; otherwise the visitor's latest message (only one of up to 500 characters) is sent to Anthropic with the shop's public catalogue, and nothing the visitor gave to be reached (their name, phone number or email) and none of their earlier messages go with it. The reply is written into the chat as the shop's assistant and marked as automatic, and it is never emailed. A visitor can type HUMAN to stop automatic replies in their conversation, and any reply the shop writes stops them too. Where the shop has turned it off, or Retriever has not switched it on, no message from this chat is sent to any AI service.
09
ChatGPT and Claude, if you connect them
A shop's owner can let people who work in the shop ask ChatGPT (run by OpenAI) or Claude (run by Anthropic) about the shop. It is off until the owner turns it on in Settings → AI assistants, and it is part of Retriever Pro. Then each person who wants it connects their own ChatGPT or Claude account to Retriever. Retriever asks them to sign in on retriever.com.np and choose what to allow, for one shop.
What the assistant receives. When the person asks a question, Retriever sends the assistant the answer for that one shop, and only within that person's own Retriever permissions. That can be sales totals and the payment-method split, best-selling items, stock levels, the shop's products with their prices, sizes, barcodes and stock, open orders (with order numbers, times, totals and whether they are paid), bookings, what customers owe on khata in total, and a day's close (sales by payment method, the cash expected in the drawer, refunds, and khata given and received). For the shop owner's own sign-in only, it can also be each counter shift's cash (opening, expected and counted), the buying (cost) price of products, the shop's revenue, cost of goods, recorded expenses and profit for a period, and what the shop owes each supplier, with the supplier's name and its recent bills (bill number, date and amount). Customer names and phone numbers, the name of the person on a counter shift, and suppliers' phone numbers are sent only if the person ticked "customer names and phone numbers" when connecting; that box starts off. Suppliers' email addresses, addresses and PAN, and any PAN or VAT number, are never sent. An assistant can also read a shop's look from what its storefront already shows, and make a preview link, without signing in.
Looking things up. The assistant can also, within the same permissions: list what is missing from the shop's products and shop page (photos, descriptions, categories, prices, and whether the logo, address, phone, hours and About text are filled in); give totals from the shop's IRD sales book for a period (bills, taxable sales, VAT, cancelled bills and notes, with no buyer names or PAN numbers), for people who hold the Sales permission; and find a customer by name or phone number, showing their orders, what they have spent, their khata balance and loyalty points. Finding a customer works only for people who hold the Customers permission, and only if they ticked "Also customer names and phone numbers" when connecting. It also answers how-to questions from Retriever's public help guides, which carry no shop data.
Operational tools, where enabled. The assistant can read the connected shop's feature settings and the person's current permissions, search permitted products, orders, bookings and repair tickets, and read repair status, intake age and amounts. Customer names, phone numbers, device and issue details require both the customer-details choice and the Customers permission. Only the shop owner can read saved payment connection status or recorded product price and stock audit history. Payment credentials, account numbers, actor email addresses, private repair notes and buying costs are not included. Audit actor labels require the customer-details choice. These additional personal and free-text details also require a new authorization through the updated consent page; existing connections and token refreshes do not gain them automatically. People with Analytics access can request a daily gross paid-order sales CSV containing dates, counts and totals. Its private download link expires within ten minutes, and downloads recheck current access. Anyone holding a still-valid link can download that report; Retriever generates it when downloaded and does not store a separate report file. These tools do not connect payment accounts, test providers, make payments, read private conversations or change records.
Saving a look. If the person ticked "Draft, publish and undo looks", the assistant can change the shop's storefront design when asked. That permission on its own does not let it change anything else.
Making changes. Where Retriever offers it, the owner can also turn on "Let AI assistants make changes", and a person who connects can tick "Make changes" (both start off). The assistant can then prepare a change, within that person's own permissions: for someone with the Products permission, the shop's products, prices, stock counts and what is on sale today; for someone with the Settings permission, its promo codes (up to half off), delivery fees, opening hours, and the shop's name, tagline, About text and social links. Each change is shown to the person first and is made only after they say yes to it in the conversation, and customers see it at once. A new product is added as a draft, which customers cannot see or buy until someone publishes it in Retriever. The assistant cannot move money, mark an order paid or refund it, publish drafts, delete products, promo codes, orders or bookings, change the shop's contact details, address, legal name, PAN, VAT or payment details, or change customer records.
Orders and bookings. Where Retriever offers it, a person who holds the Orders permission can also tick "Update orders and bookings" (it starts off). The assistant can then prepare moving an order to its next step, cancelling an unpaid order nobody has started on yet, changing an order's note, and confirming, cancelling or moving a booking. Each change is shown to the person first and is made only after they say yes to it. A customer who gave an email address gets Retriever's usual email when their order moves on or is cancelled, or their booking is confirmed, exactly as when the change is made by hand; that email cannot be taken back, and these status changes cannot be undone from Retriever's Settings. The assistant cannot cancel a paid or invoiced order, or one with a payment under way, and it sees whether an order has an email address, not the address itself.
Photos from a web address. When making a change, the assistant can give Retriever the web address of a product photo. Retriever fetches that one picture itself, writes it again as a new image, which removes the location and other details stored inside the original file, and keeps it privately. It is put on the shop only if the person says yes to the change; otherwise it is removed within two days.
Where it goes. What Retriever sends reaches OpenAI, Anthropic, or the company behind whichever assistant the person chose, and is handled under that company's own terms and privacy policy and the settings of that person's account with them. Those companies may process it outside Nepal. They are not Retriever's providers here: the person chose them, and Retriever does not control what they keep. Deleting something in Retriever does not delete their copy.
What Retriever keeps.
- For each connection: who allowed it, for which shop, which app it went to, what it covers, when, and when it was last used.
- For each question: the kind of question (sales, stock, orders and so on), who asked, when, and whether it was answered. Not the words, and not the answer. These question records are deleted after three months.
- For each change made after a yes: what it was, who said yes, through which app, when, and the values before and after it (for an order's note, the old note too), so most can be undone. These change records are kept for twelve months.
- For each question, a copy of the same facts in PostHog, Retriever's product analytics service: which tool answered, which assistant asked, whether it was answered or why not, how long it took, the shop's internal number and the person's Retriever account number. Not the words, and not the answer. See What your browser loads from other companies.
The owner sees both in Settings → AI assistants. Retriever does not receive the rest of the conversation.
Taking it back. In Settings → AI assistants the owner can revoke one connection or all of them, or switch the setting off, which stops all reading and saving at once. A person can also remove Retriever in ChatGPT or Claude. Staff who can edit Design can revoke connections that save looks in the same place. A connection that goes unused for three months ends by itself, and permission to save looks ends thirty days after it was given.
10
What we hold about someone just visiting
This applies to everyone, whether you run a shop, work in one, or just bought something.
A visit token. The first time a browser opens retriever.com.np or a Retriever storefront, it makes a random 24 character token and keeps it in that browser's own storage. There is no expiry on it and nothing rotates it. It is sent with visit and browsing counts. It is not written onto an order, a booking, a customer or an account, and nothing in Retriever can turn it into a name. We considered joining it to accounts and decided not to, because that would turn an anonymous token into an identifier for a named person.
Two things about it we would rather say than have you discover. It is a token that lasts, so it does distinguish your browser from another browser until you clear your browser storage, which you can do at any time. And it is the same token for both counts below, so within one web address a browser's marketing page views and its storefront browsing sit under one key. A shop on its own domain or its own subdomain is a different web address and gets a separate token of its own.
Storefront counts. For each arrival, product view, event view and add to cart: which shop, which of those four things it was, a reference (a product or event id, or the campaign tag on the link you followed such as ?s=instagram, or failing that the bare site you came from such as instagram.com), the token, and the time. Never a full web address and never a query string. The shop can read its own, and no one else's.
Marketing site counts. For a page view on retriever.com.np itself: one of ten fixed page names, never a path or a URL, plus the same reference and token and time. Nobody can read these rows one at a time through Retriever, not a shop and not us: the database permission is removed and there is no rule that would allow it, on purpose, so that one browser's movements around our site cannot be pulled out of the product. What is left is direct access to the database itself, which Security below describes. We look at the totals, never at a row.
Account setup counts. On Retriever's own website, we count setup operations such as requesting a code, verifying it, returning from Google and submitting shop setup. Each count carries a fixed outcome or failure category, a narrow or wide screen category and a response-time bucket. We keep totals for the most recent 90 calendar dates. No email, code, account or shop ID, visitor token or URL is attached. A random ID for one delivery prevents duplicates; daily cleanup removes IDs older than one day, and another accepted operation also enforces that cutoff. These IDs do not join operations into a person's history. A temporary timestamp in that tab's session storage recognizes a Google signup return for up to ten minutes; it is never sent to the count tables. The founder reads aggregate totals only.
Product analytics, with PostHog. Retriever's own pages send PostHog the pages you open and a few named steps, and a shop's page sends it one line when an order is placed. Both also send it a report when the page's own code fails, with anything personal taken out. What it receives, what it never receives, and how to say no are under What your browser loads from other companies.
Server logs. Vercel serves every page, so its logs hold the usual things a web server sees: the visiting IP address, the browser's user agent, and the address requested, which on a storefront includes the pages that were browsed.
11
Why we hold it, and on what basis
To do what you asked us to do. Running your shop, showing your catalog, taking an order and passing it to the shop, sending the receipt and the status updates, issuing a ticket and checking it at the door, holding a booking, counting loyalty points, and taking your payment for a Pro plan. Without this the product does not work.
To run a shop's Inbox, and to answer people who message Retriever. Storing a shop's customer messages on Instagram, Messenger or WhatsApp, sending the replies its owner writes, and running automatic product help only when the owner has turned it on: all of this is done for the shop, on its instructions. Reading and answering messages sent to Retriever's own accounts, because the sender asked us something.
Consent, under Nepal's law. Nepal's Privacy Act 2075 asks for a person's consent before their personal data is collected, and limits its use to the purpose it was collected for. Retriever relies on that consent: you give it when you open an account, order, book or message a shop that uses Retriever, for the uses this policy describes and no others. A shop collecting its customers' details through Retriever must tell them what it collects and why, as our Terms require. You can withdraw your consent by asking us, as Your rights, and how to use them describes: it stops further use, and what the law or a shop's records require us to keep stays, as How long we keep it says.
To meet a legal duty. Keeping invoices, tax records and the numbered invoice series a shop needs for PAN and VAT.
Because we have a genuine interest in a service that works and stays safe. Counting visits so a shopkeeper can see how many people came and we can see whether Retriever is growing, keeping the platform secure, limiting abuse, finding and fixing faults, and understanding across the platform how many shops there are and how they are doing, and seeing, through PostHog, which steps from signing up to a first order and a paid plan shop owners finish, and where they stop.
That last one deserves one specific disclosure rather than a vague phrase. We run a founder console, and it can see, for every shop: the shop's name, address, type, plan, when it opened, the owner's email address, how many orders it has, its revenue and profit over the last 30 days, its visit counts, and every plan payment it made to us. It can also list every Retriever account with its email, name and last sign-in. The general shop summary shows counts and money. Separate privileged permit and inspector-access administration is described above; direct infrastructure access is described below.
What it does not do is fence off the database itself. The people named in Security below can reach that directly in order to run and support the platform, and the same access lets us create an owner account, reset a password and change an account's email address when somebody asks us to.
Here is what we do not do, and it is a short list because it is complete. We do not sell data. We do not run advertising or advertising trackers. We do not advertise our products to shoppers using their checkout addresses. Optional review invitations are sent on the shop's behalf, with its authorization and responsibility for permission. We do not build a profile of a person across shops. To be exact about that, because we do hold one thing that spans shops: if you saved your name, phone and address to your Retriever account, that is one record and it fills in your checkout wherever you buy. You typed it and you can change it. We do not add to it by watching you, we do not join your purchases at one shop to your purchases at another, and no shop is given it to browse. We do not read a shop's customer records except when a shop asks us for help with something specific, or when we have to in order to keep the service running.
12
Email we send on a shop's behalf
This is Retriever's own infrastructure sending mail to a shop's customers, so it is worth being precise about.
Who the sender is. Every message goes out from an address we own: orders@pasal.studio for orders, invoices, tickets, bookings and storefront sign-in codes, and hello@pasal.studio for a shop owner's own sign-in and account mail. The shop's own address is the Reply-To, so a reply reaches the shop and not us. That means we are the sender of record on mail carrying a shop's customers' details, and it means one shop's bad practice can affect delivery for every other shop.
What goes to a customer. Their own delivery address or table, every line of the order with prices, and the shop's own address. When an order is marked paid they also get an invoice mail carrying their name, phone and email address, the payment reference they typed, the invoice number and, where the shop has entered one, its registered legal name and PAN. A receipt PDF is attached. For an event, their ticket codes and a ticket PDF.
What goes to a shop owner. A new order notice carrying the customer's name and phone. And the daily summary email, sent every morning on any day the shop had orders or bookings, which for a shop with a diary open also lists today's bookings with the time, the name, the phone number, the party size and whatever the customer wrote in the booking note, including a vehicle plate at a garage. It is on for every shop by default and there is a switch in Settings to turn it off.
What goes to a staff member. An invitation to join the shop, account messages, and, when the owner presses send, your payslip. It carries your name, the slip number, the period, every earning and every deduction line with its amount, the two totals, your net pay, how and when you were paid, the payment reference, and the owner's note if there is one. It goes to the verified address on your Retriever account and to no other address, ever. It is not sent to the address the owner typed onto the slip, and there is no way for anyone to send it somewhere else, because the address a person typed is not proof of who they are. If you have no Retriever account yet there is nowhere to send it and the shop is told to print it and hand it over instead. The subject line names the period and never the figure, so your wages do not appear in a notification on your lock screen for whoever is standing next to you.
Sign-in codes, to whoever typed the address, for owners, staff and shoppers alike. Codes stop working after an hour and are never shown to anyone but the recipient's inbox.
Service messages support the order, account or visit. Separately, an owner can enable optional Google review invitations following eligible completed visits. The email carries your name, a limited visit description and the shop's Google review link. Resend receives the full message and tokenized opt-out link. Confirming the opt-out stops that shop's review invitations to your address, while essential service messages continue. We retain suppression and send history; an opt-out is not a deletion request. Shops must have appropriate permission to contact you, and Retriever is not a bulk newsletter tool.
13
Who else your data reaches
These providers and independent recipients handle data as part of running Retriever. The full list, including where each one sits and exactly what reaches it, is at retriever.com.np/subprocessors.
Supabase. The database, sign-in, file storage and the server functions. This is where Retriever lives, so everything this policy says is stored, is stored there: accounts, orders, khata, loyalty, bookings, tickets, repairs, payslips, photos and payment screenshots, plus serial/unit records, review queues and suppression, plan billing, permits, audit histories and retained archives. Also a shop's Instagram, Messenger and WhatsApp inbox: customers' messages, their Meta IDs, names and photos, and the encrypted access tokens; and messages to Retriever's own Instagram and Facebook accounts.
Vercel. Hosts and serves retriever.com.np and every storefront, and attaches a shop's subdomain. It sees every request, so the visiting IP address, browser and page requested. It also carries a shop's Inbox: customers' messages, their IDs, names and photo links on their way from the database to the owner's browser, the replies and product cards the shop sends on their way to Meta, Retriever's requests to Meta for a customer's name and photo, and the steps that connect or disconnect an account.
GitHub and Cloudflare R2, for backups. Every three hours a GitHub Actions machine copies the database (and once a night every stored file), encrypts the copy there and uploads it to Cloudflare R2, where each encrypted copy is kept for 35 days. The unencrypted copy exists only on that machine, only while the backup runs. Supabase also keeps its own daily backups of the database for 7 days.
Resend. Delivers every email Retriever sends, including sign-in codes. It sees the recipient's address and the whole message, which means order contents, customer name, phone and delivery address, ticket and invoice PDFs, a shop's legal name and PAN, and, when a shop emails somebody their payslip, that person's pay: every line of it, the totals, the net and the payment reference.
Resend also handles plan invoices with the stored billing details, and review invitations with the customer's name, limited visit description, review URL and tokenized opt-out link.
OpenAI. Powers Zuno, the help assistant in the dashboard. It receives your question, the last six messages, which shop features are on, and whether each figure is readable, zero, missing or unavailable. Your dashboard amounts and customer records are filled in by Retriever afterwards. Retriever sends these requests with response storage turned off.
Anthropic. Powers the AI product writer and Add from photo in the dashboard, and automatic product help in a shop's inboxes and shop page chat where enabled. From the writer it sees the product being written for, or a photo you took for Add from photo, and the shop's name, trade and area. From product help it sees a customer's latest message and the shop's public catalogue, as described under Instagram, Facebook Messenger and WhatsApp.
PostHog. Product analytics for Retriever's own pages. It receives page views with every code, token and search taken out of the address, a random browser ID, and for a signed-in owner or staff member their Retriever account number (not their email or name), their role, and their shop's web address name, trade and plan. It also receives a few named steps, including each order created, as its number, channel, item count and total, with no customer name, phone, email, address or note. From a shop's own page it receives only that order line, with no profile. It also receives reports of errors in Retriever's code, from Retriever's pages and from shops' pages, with email addresses, phone numbers, long numbers, codes, names and places, and anything quoted or written in Nepali taken out; and, when someone uses ChatGPT, Claude or another AI assistant with their shop, which Retriever tool answered, which assistant asked, whether it was answered and how long it took, never the question or the answer. The full detail is under What your browser loads from other companies.
Meta. Runs Instagram, Facebook Messenger and WhatsApp. When a shop connects an account there, or when you message Retriever's own accounts, Meta sends Retriever the messages, and Retriever sends Meta the replies and product cards to deliver and asks it for a customer's name and photo. Meta already holds those conversations under its own policies. Meta also receives the number and text in a WhatsApp link when somebody opens one from Retriever, as described in the same clause.
OpenAI, Anthropic or another assistant's company, when you connect an AI assistant. These are independent recipients chosen by the person who connects, not Retriever's providers. What they receive, and when, is set out under ChatGPT and Claude, if you connect them.
eSewa, when offered. The payment gateway where a shop connects its own merchant account for customer payments, when Retriever offers it. Retriever Pro plan payments use Fonepay. It sees the amount, a transaction id we issue, the merchant code and a signature. The shopper's browser goes to eSewa directly, so eSewa also sees them. Retriever does not collect the payer bank or card login credentials in this checkout. Separately submitted payment evidence may contain financial details, as described above.
Fonepay. Processes the QR payment for Retriever Pro. Our requests contain amount, merchant/terminal identity, reference and a generic plan description. Bank or wallet payment activity is also subject to that provider's own terms. Billing contact fields are stored by Retriever and emailed through Resend, not included in our Fonepay request.
IRD and Google reviews. IRD receives the limited CBMS test data described above; Live submission stays disabled. Separately authorized inspectors can read records within their PAN scope. Opening a Google review link sends your browser to Google under its own policies, without Retriever automatically uploading your purchase record or posting a review.
Google Fonts. Serves the Space Mono, Caveat and Instrument Serif webfonts used across the site and every storefront, so it sees your IP address, browser and the page you are on, on every single page load. See the next clause.
Google, for Continue with Google. If you choose it, Google signs you in and tells us your email address, name and profile picture link. Google learns that you signed in to Retriever.
Google, Mozilla or Apple, for push. Deliver an order or message alert to a shopkeeper's device. In a browser, which company depends on the browser, not on us; they see the device subscription and the fact that an alert was sent, and the alert itself is encrypted to that device. In Retriever's phone app the alert goes through Apple's or Google's own notification service, which carries its words: for an order, "New order", how many items, the total and whether it is for delivery, pickup or a table; when a customer in the Inbox asks for a person, that a customer on that channel (Instagram, Messenger or WhatsApp) is waiting for one. No customer name is in either.
Cloudflare, for checking a domain. When a shop connects its own domain or sets up company email, our server asks Cloudflare's public DNS service for that domain's records. Cloudflare receives the domain name and nothing else.
Apple and Google, for wallet passes. Hold a loyalty card or a ticket in the wallet app on a customer's phone. The two differ. A Google pass is built on Google's servers, so a customer's name, their points and an event's name, date and venue reach Google. An Apple pass is a file we sign and the phone keeps, so Apple sees the token used to tell that phone its card has changed, and not what the card says.
OpenStreetMap. Turns an address into coordinates when a shop puts a pin on its loyalty card, or an event puts one on its venue. They receive the address text and nothing else, asked by our server rather than by your browser, so they are not told which shop asked and they never see your visitors.
Unsplash and Pexels. Host the stock photography on Retriever's own demo shops atretriever.com.np/demo and on the pages that preview a template while you are setting up. A new shop's cover photo for its trade is one of these photographs, copied to our own servers under those licences. Shops you run otherwise use photographs you upload. So these two see your IP address, browser and the page you are on, when you are looking at one of our demo shops or a template preview.
We do not sell data to any of them or to anyone else. They handle it to do their part and nothing more.
14
What your browser loads from other companies
Some of the list above is a company we hand data to. Some of it is a request your own browser makes to a third party host, which tells that company your IP address whether we like it or not. Since that distinction is usually hidden, here it is straight.
On every page, without exception, your browser asks Google for a stylesheet at fonts.googleapis.com and opens a connection to fonts.gstatic.com, and downloads Space Mono, Caveat and Instrument Serif from there wherever a page uses them. This happens onretriever.com.np and on every storefront, before you have clicked anything. Google therefore sees the IP address and browser of every person who opens a Retriever shop. The rest of Retriever's typefaces are served from our own servers; these three are not, and on a shop's page this is the one piece of Retriever that hands data to a company you did not choose on an ordinary page view. On Retriever's own pages PostHog is a second, described below.
On every page, your browser also talks to our own database host at Supabase to load the shop, keep a session alive, and fetch product photographs.
On our own demo shops and template previews, images load from Unsplash or Pexels. A shop you buy from shows photographs its owner uploaded, which come from Supabase like everything else.
Only if a shopkeeper turns on order and message alerts, their browser registers with their own vendor's push service.
Only on the eSewa checkout path, when a shop offers it, your browser is sent to eSewa, where you leave our site.
If you open a Google review link, your browser visits Google and its own privacy policy applies. Retriever does not post a review for you or automatically upload your purchase record. Fonepay plan payments are completed in your chosen bank or wallet app.
Only if you choose Continue with Google, your browser goes to Google to sign in and comes back to Retriever.
Only if you press a WhatsApp button, your browser or phone opens WhatsApp at wa.me, carrying the number and any text in the link.
Only when a shop owner connects Instagram or a Facebook Page, their browser is sent to Instagram or Facebook to approve the connection, and comes back to Retriever. Connecting a WhatsApp number, once that is available, loads Facebook's own sign-up script and window in the owner's browser.
Only in a shop's Inbox, the owner's browser loads customers' profile photos from Meta's own servers (fbcdn.net, cdninstagram.com, fbsbx.com), so Meta sees that browser's IP address.
Only if you add a card or a ticket to Google Wallet, your browser is sent to pay.google.com to finish it, where you leave our site. Adding one to Apple Wallet does not do this. That file comes from us and your phone opens it itself, so your browser never visits Apple.
Our own count tables are described above. Besides them, Retriever itself uses one third-party analytics service, PostHog, described below, and no advertising product. A shop may turn on Google Analytics, Google Ads, Meta Pixel or Microsoft Advertising on its own shop page, on its own domain; you are asked first.
Only if a shop turned on its own ad tags, only on that shop's own domain, and only if you say yes. A shop can do this only on its own domain (like yourshop.com.np), never on itsretriever.com.np address, and its tags never load on retriever.com.np or any of its pages. Such a shop shows a short notice at the top of its page naming the companies (Google, Meta, Microsoft) with two equal buttons, Allow and No thanks. Until you press Allow, none of their code loads. "No thanks" loads nothing and removes those companies' cookies from that shop's domain; your choice is kept for that shop in your own browser (for about six months, or until you clear it), not by us. If you allow it, your browser loads those companies' scripts from their own servers, they set their cookies on that shop's domain, and they receive your IP address, your browser's details, the addresses of the pages of that shop you view (Retriever gives Google each address without searches or order links, but Meta's and Microsoft's code reads the whole address, which can include a search you typed on that shop or an order number from an order link), what you add to your bag, that you started the checkout, and an order's number, value in rupees and product codes; Google also receives the product names. Retriever never sends your name, phone number, email or address to them. What their own code may collect on the page beyond that depends on the shop's own settings with them: Meta's advanced matching and Google's user-provided data collection, if the shop turns them on, can read what you type into a form on that shop's page (such as a back-in-stock request or a review), and those settings are the shop's. Their code never loads on the checkout, on a payment page, on your account pages, or at a restaurant table's ordering page. The shop owns those accounts and decides how to use what they collect, and its own privacy notice names the companies it uses. You can change your mind at any time from "Cookie choices" at the foot of that shop's page.
On Retriever's own pages, for product analytics: PostHog. On retriever.com.np's own pages, such as the home page, pricing, help, sign-up and the shop dashboard, and never on a shop's own pages, code we serve from our own servers (not PostHog's) sends PostHog, Inc. in the United States (us.i.posthog.com) a record of each page you open. The record holds the page's address with everything after the "?" removed (sign-in codes, tokens, order links, searches), except the dashboard's own tab names and a link's campaign tag such as ?s=instagram; the site you came from, cut to its name; and your browser's details: its name, operating system, device type and screen size. PostHog also sees your IP address, as any server your browser talks to does, and can use it to estimate your country. A random ID, kept in a cookie and in browser storage on retriever.com.np, lets it count one browser once. Someone who never signs in stays an anonymous count with no profile.
When a shop owner or staff member is signed in, that ID is joined to their Retriever account number, which is a random code and not their email or name, and to whether they are the owner or staff. The shop they have open is recorded as a group, with its internal number, its web address name, its trade and its plan. A few named steps are sent as well: starting to sign up (by email code or by Google), opening a shop (with the trade, starting design and address style picked), adding the first product, an order being created, and starting and finishing a Retriever Pro payment (the term, how it was paid, and whether it went through). For an order PostHog receives only its number, whether it was online or at the counter, which screen it came from, how many items, the total in rupees, and whether it was for a table or for delivery: never a customer's name, phone, email, address or note. There is no session recording, no capture of clicks or typing, no heatmap and no survey.
On a shop's own page, one line when an order is placed. A shop's page never loads PostHog's code and keeps no ID for it. When an order is placed there, your browser sends PostHog one record: the order facts above and which shop it was, under a new random ID that matches nothing else and makes no profile. PostHog sees your IP address with it, as above. Orders on Retriever's own demo shops are not sent.
When Retriever's code fails, an error report. If a page's own code stops with an error, on retriever.com.np or on a shop's page (checkout included), your browser sends PostHog a report so we can fix it: the kind of error, its message, where in Retriever's code it happened (file, line and function names), the page's address without anything after the "?" and with order numbers, keys and codes in it replaced, and which version of Retriever was running. Before it leaves your browser, email addresses, phone numbers (including +977 and 98 or 97 numbers), runs of six or more digits such as PAN numbers, sign-in codes, tokens and keys, names and places, and anything quoted or written in Nepali are taken out of the message (the names of parts of Retriever's own code stay), and your browser's name, screen and the site you came from are not included. PostHog sees your IP address with it, as above. Errors that happen only in another company's code, such as a browser extension or a shop's tracking tag, are not sent. A browser sends each error once per visit, and at most twenty from one page. On Retriever's own pages a report carries the same random ID and, when you are signed in, the same account number and shop as the records above. From a shop's page it is sent under a new random ID with no profile and no cookie, like the order line, and never from Retriever's own demo shops. The same ways to say no, below, stop these too.
When an AI assistant uses a shop. When someone has connected ChatGPT, Claude or another AI assistant to their shop (see ChatGPT and Claude, if you connect them), Retriever's server sends PostHog one record for each tool the assistant uses: the tool's name (such as the sales summary or a preview of a change), what kind of tool it is, which assistant it was (ChatGPT, Claude or another), whether it was answered or the reason it was refused, how long it took, the shop's internal number and the person's Retriever account number. Never the question, what was typed, what was sent back, or any product, customer or figure from the shop. These records come from Retriever's server rather than your browser, so the browser settings below do not change them.
To say no. Turn on Global Privacy Control or Do Not Track in your browser, and nothing is sent to PostHog from retriever.com.np or from any shop's page. Or open a page with ?analytics=off at the end of its address, such as retriever.com.np/?analytics=off: that browser then sends nothing to PostHog from that web address until you open one with ?analytics=on. The choice is kept in that browser for that web address only, so a shop on its own domain or subdomain needs it once more. PostHog keeps these records in Retriever's account with them. To have what it holds under your account number deleted, email us.
We checked the existing third-party requests against the built site, which is how the Google Fonts request above was found and why it is written down here.
15
Using the camera to scan
The counter can read a barcode, a payment QR or a customer's loyalty card with your phone's camera, and the door can scan a ticket. Your browser will ask your permission the first time, and it is your device asking, not us.
Here is the part worth stating plainly, because a camera is the thing people are right to ask about. No picture leaves the device. The video is never recorded, never uploaded, and never sent to us or to anyone else. The reading is done inside your own browser, by code we serve from our own servers rather than fetching from somebody else's. The only thing that ever reaches us is the text that was decoded, which is a product's barcode number, a ticket code, or the reference on a card. When you close the scanner the camera is switched off.
16
Where the data is kept
Retriever's data leaves Nepal, and there is no way to run it as it stands without that being true. Here is the honest picture.
The application is served by Vercel, whose server functions for Retriever run in Mumbai, India, and whose network is worldwide. The database, sign-in and file storage are with Supabase, on servers outside Nepal. Email is delivered by Resend, also outside Nepal. Zuno uses OpenAI's API. The AI product writer, Add from photo and automatic product help use Anthropic's API in the United States. Meta, which runs Instagram, Messenger and WhatsApp, is outside Nepal too. Backups are made on GitHub's machines and kept, encrypted, in Cloudflare R2, both outside Nepal. Product analytics go to PostHog, in the United States. eSewa is in Nepal. If you need to know the exact country any one of these sits in, ask us and we will tell you.
We chose these because they are the services that run the kind of platform Retriever is, and we chose them knowing where they sit. We are not able to promise that your data stays inside Nepal, so we do not.
Our use of these providers involves processing outside Nepal. If your business has particular data location or confidentiality obligations, check whether this arrangement suits them before entering records. We will update this policy when the actual arrangement changes.
Retriever is offered to businesses in Nepal and priced in Nepali rupees. It is not offered or marketed to people in the European Union, and we do not claim to comply with European or Indian data protection law. We would rather say that plainly than put a badge on a page we cannot stand behind.
17
What is kept in your browser
Retriever uses browser storage for sessions, working records and preferences rather than advertising cookies. The main categories are below. Storage can contain personal and transaction data; access to your device or browser profile can expose it. Clear it only after checking for unsent work.
Your sign-in session. Keeps a shop owner or staff member signed into the dashboard. It lasts until you sign out, and the token inside it refreshes every hour.
A device ID. A random ID per person, kept by the dashboard, so Retriever can tell your devices apart for the device limits described above. Clearing your browser storage replaces it.
A shopper's sign-in session. Kept under its own name so a shopper's session and an owner's session on the same device never overwrite each other. Until you sign out.
The visit token. The random token described above, sent with the visit counts. No expiry. Clear your browser storage to reset it.
Your shopping bag. What you put in the bag at one shop, with quantities. No name, phone or address in it. It is removed when the bag empties or the order is placed. If it is more than 7 days old it is thrown away the next time you open that shop.
Unsent counter sales and working drafts. On a shop's counter device: items, quantities, prices, totals, discounts, payment method, staff attribution and, when entered, buyer name, phone, email, PAN, business/address and selected unit identifiers. Cached orders, table/parked bills, inventory drafts and uncertain serial/IMEI receive attempts can also remain locally while work is pending. Confirm sync before clearing storage; clearing an unsent record can lose it.
Parked bills and the day's opening cash float. On a shop's own counter device, until the bill is finished or the day ends.
Wizard answers. The trade and features you picked in the setup wizard, carried to the publish form. Until the shop is published.
A payment in progress. The transaction you are part way through and the page to return to, kept only in the tab. It dies with the tab.
Preferences. Dashboard theme, kitchen TV settings, landing page language, which prompts you have dismissed, and which dashboard pages you opened most and most recently, for the phone menu's Recent and Most used. Until you clear them. On Retriever's demo shops, whether you have seen or closed the set-up-your-shop card and bar is kept only in that tab.
Connecting Instagram, a Facebook Page or, once it is available, WhatsApp. A random value in a cookie for ten minutes, so the approval that comes back from Meta is matched to the browser that asked for it. The Inbox also remembers which channel you last opened, and while a Facebook Page is being connected or reconnected it keeps any unsent replies, with the customer IDs they were for, in that tab until you come back to it.
PostHog's ID, on Retriever's own pages. A random ID, in a cookie for up to a year and in browser storage on retriever.com.np, so product analytics counts one browser once. Signing out replaces it with a new one. If you open a page with ?analytics=off, a note of that choice is kept for that web address until you open one with ?analytics=on. Apart from that note, nothing is kept for PostHog on a shop's page.
None of it is used for advertising. There is nothing to use it for advertising with.
Retriever Desk on a computer. The native app keeps a local SQLite database with catalog and stock, sales, buyer contact details and pending receipt-email work, plus cached photos. Synced sales can remain locally, and signing out does not wipe these records. Sessions and the local unlock PIN use separate platform secure storage; Retriever does not encrypt its ordinary SQLite records or exported ZIP contents. Protect the device with its own lock and disk protection, especially when shared.
The iPhone and Android apps. App lock (Face ID, fingerprint or the phone's passcode) is checked by the phone itself; Retriever never receives your face, fingerprint or passcode. The barcode scanner reads codes on the phone, and only the code it read reaches us, never a camera image. The apps keep a copy of your shop's figures on the phone so they open without a connection, and signing out removes it. The apps carry no advertising or analytics trackers.
Retriever never deletes these records from the computer by itself. To remove them, first check in Retriever Desk that no sale is waiting to be sent, because until it is sent that computer holds the only copy. Then sign out and quit. On a Mac, delete the folder ~/Library/Containers/studio.pasal.pasalDesk (it holds the database and the photos), remove the items named Pasal Desk (or studio.pasal.desk, on an older install) in Keychain Access (they hold the saved sign-in and the counter PIN), then delete the app. On Windows, uninstall Retriever Desk, which leaves its records behind, then delete the folder %APPDATA%\studio.pasal\Pasal Desk (the database) and the folder %LOCALAPPDATA%\Pasal Desk (the saved sign-in and the counter PIN). Retriever Desk keeps product photos in a folder called photos inside your Documents folder: delete it, or, if you keep photos of your own there, only the files whose names are long codes ending in .jpg. Delete pasal_desk.db in Documents too, if an older version left one there. Deleting them on the computer does not touch the copies in Retriever itself.
18
How long we keep it
Retriever currently has no routine purge schedule for business records, review request/suppression history, audit logs or archives. These can remain indefinitely. We keep originals so a shop can explain a sale, debt, correction or dispute; a link expiring is not the underlying record being erased.
Messages are the exception. Conversations in a shop's Instagram, Messenger or WhatsApp inbox, and in Retriever's own Instagram and Facebook inboxes, are deleted within a day of turning 30 days old, and a shop's are deleted at once when it disconnects, as Instagram, Facebook Messenger and WhatsApp describes, including what is kept longer.
Numbered invoices and repairs, collected repairs, returns, Khata, issued notes and payslips, print records and relevant audit histories are protected. Corrections, reversals or replacement documents retain the original. Support cannot promise to bypass those controls to erase a protected record. Removing staff access or a wallet subscription also does not erase earlier business records.
Retriever's archive retention policy is at least six years after the relevant fiscal year ends. No automatic deletion happens when those six years pass. Download logs and retained copies remain; an already-created archive or sent email is not recalled by changing or deleting a source record. This is our implemented retention policy, not a statement that every personal record is required by law to remain forever. Your shop must assess its own recordkeeping duties.
Some unprotected drafts and catalog records can be removed where the product permits. Other requests need our review. Closing or stopping use does not automatically delete an account or shop, and the product blocks deletion of an invoiced or archived shop. We will explain applicable duties and technical limits for a verified request rather than promise complete erasure.
Some access and working data is short-lived: saved bags are discarded on reopening after seven days, payment-evidence links expire after five minutes, and archive download links after ten minutes. Sign-in and wallet handoff tokens also expire. Browser and native records have the device-specific limits described above. Review opt-outs retain a suppression record so requests can stay stopped. Records of questions asked from ChatGPT or Claude are deleted after three months; records of changes made from them, with the values before and after, after twelve months; a photo fetched for a change that was not made, within two days. A connection to them ends after three months unused. The record of a connection itself (who allowed it, when, and when it was revoked or ended) is kept with the shop for as long as the shop is on Retriever.
To slow down abuse, sign-in, checkout and ticket requests leave a coded (hashed) form of the IP address or email they came from. It is only used to count the last two hours, and older ones are cleared out as new requests arrive. Our backups keep copies of the database and stored files for up to 35 days, and Supabase keeps its own daily copies of the database for 7, so something deleted in Retriever can remain in a backup until then, unopened unless we have to restore. When we delete an account or a shop at someone's request, our own admin log keeps a line saying which one it was (for an account, its email address), who deleted it, when and why, so we can answer for it later. That line has no end date.
How to close an account or a shop, and what stays after that, is set out on our account and data deletion page.
19
Your rights, and how to use them
You can ask to see what we hold about you, to correct it, to get a copy of it, and to have it deleted. So can a shopper who bought from a shop built on Retriever.
How to ask. Email support@pasal.studio and say what you want. If you are a shopper, start with the shop you bought from, because they hold the record and can act faster. If they do not answer, or the shop has closed, come to us and we will review your verified request, including retention limits.
Messages, and Facebook or Instagram connections. If you messaged a shop or Retriever on Instagram, Messenger or WhatsApp, or connected one of those accounts to Retriever, the steps are on our data deletion page. A shop owner can delete a whole inbox at once by disconnecting, and anyone can email us to have their own messages deleted. For data that came from Meta, we also act on your own request, as Meta's terms require, not only on the shop's.
Closing your account or your shop. Anyone can delete their own account in Settings, then Delete my account, on the web or in the iPhone app, with a code we email to the account's address. Download your records first: owners are responsible for keeping their own books. When you confirm, a shop you own goes offline at once and you are signed out everywhere. Thirty days later we permanently delete the account and the shop with everything in it: products, orders and customer details, khata, bookings, returns, repairs, staff list, design, settings, photos and files. We keep only our own billing records for the shop (the plan payments it made and the invoices we issued) and a one-line log that the account and shop were deleted at the owner's request, with the date. Those billing records include the name and email address of whoever paid us for the plan. To cancel within the 30 days, write to support@pasal.studio. Our account and data deletion page has the details for a shop owner, a member of staff and a shopper.
What happens then. We will reply within 5 working days to say we have it and what we need from you. We will finish the request within 30 days, and if something makes that impossible we will tell you why before the 30 days are up.
Copies available today. Owners can export monthly orders from Billing, and owners or staff with Backups permission can download selected billing/customer/audit records in a signed ZIP. That ZIP is not a full database or photograph export, nor a restore image. Other personal-data copies can be requested from us in a plain format we can produce. A shopper may request their own verified records, not another customer's data or the shop's whole archive.
Verifying it is you. We will ask you to confirm the request from the email address on the account or, for messages, as the data deletion page describes, because handing someone else's records to whoever asks would be the worse failure.
When a request is limited. Applicable recordkeeping duties and protected originals or retained archives can limit correction or deletion. We will explain what remains and why. We may use a correction or superseding record instead of editing the original. We will not disclose another person's data in a shared record or act on a request we cannot verify.
If you are not happy with our answer. Tell us and we will review it again. Nothing in this policy takes away rights or complaint routes available under applicable Nepali law, including the Privacy Act 2075. Under its sections 30 and 31 you can complain to the concerned District Court, within three months of the act you are complaining about, and ask it for compensation.
20
Security
Here is what is actually true, and only that. There is no certification, no outside audit, no outside security test and no cyber insurance behind this product, and we are not going to imply otherwise.
Online connections to Retriever use encrypted transport. Local files, downloaded archives and connections to a local receipt printer depend on the device and network; they are not all encrypted by Retriever.
In the database, every table has row level security: rules held by the database itself, not by the app, that decide which account can read which rows. A shop's records are fenced to that shop. Several things are fenced harder than that: a shop's eSewa key has no read rule at all, so nobody can read it back through Retriever; order alert subscriptions have none either; the marketing site's page view rows have none and their permission is revoked.
Sign-in is a one-time six-digit code to your inbox rather than a password, so for most accounts there is no password to steal or reuse. Whoever can read your email can sign in, so protect your inbox.
Private files. Authorized shop users obtain short-lived links for payment evidence (five minutes) and archives (ten minutes). Anyone holding a signed link can use it before it expires, so do not share it publicly. Archive access requests are logged; expiry does not remove the file. Archive signatures protect integrity, not confidentiality of downloaded contents.
Access by us. A small number of people at Retriever Labs can reach the database in order to run and support the platform, and that access is not limited by the rules above. The founder summary shows shop figures and owner details; separate privileged administration can access permit and inspector-grant information, as described above.
These access rules and limits matter when deciding who should use your shop's records.
- Staff with Orders, Billing, Customers, Returns or Events permission can read the shop's orders and their customer details. Give those permissions only to people authorised to see that information.
- Web counter PINs are hashed and checked on the server, with a temporary derived verifier for an already-checked offline session. They do not replace account security or staff permissions.
- An event ticket code is a key. Anyone holding it can see the holder's name and whether they have been admitted.
- Retriever keeps no record of which staff member looked at which customer. There is no per-person read log; supervise access with that limit in mind.
No online service can promise perfect security. We take it seriously, we fix what we find, and when something does go wrong the next clause is what we will do.
21
If something goes wrong
If personal data held in Retriever is exposed, we will tell the shops affected within 72 hours of becoming aware of it, with what we know at that point: what happened, what was affected, when, and what we are doing about it, and we will keep telling them as we learn more.
If it reaches a shop's customers we will help that shop tell them, and write the notice with them if they want. If a shop has not told them within 7 days of us asking, or the shop is no longer trading or will not answer, we will tell those people ourselves.
These notice commitments are part of our service. They do not replace any duties or rights under applicable law.
22
Children
Retriever is a tool for running a business and is not aimed at children under 16. We do not knowingly keep a shop owner or staff account for anyone under 16.
A shopper does not need an account to buy from a Retriever shop, and we do not ask a shopper their age. If a child orders from a shop, that shop's own rules and the law where it trades decide what is allowed. If you believe we are holding an account for someone under 16, tell us and we will remove it.
23
If you are a shopper
Everything above applies to you, but here is the short version.
When you order from a Retriever shop, that shop is who decides what happens with your details, and they are the first people to ask about them. We store the order for them, we send you the receipt and the updates you asked for, and, if the shop enables it and has appropriate permission, we can send an optional review invitation. Its opt-out stops review invitations from that shop, while service messages continue.
You can sign in with a code sent to your email and see your own orders, tickets and bookings across every Retriever shop you have bought from. That account is with us, not with the shop. A shop's cost prices, its takings and its own records are never shown to you. The shop's registered legal name and PAN do appear on your own receipts and invoices, because a tax invoice has to carry them. To close that account, or to ask for your details to be removed from a shop's records, see if you bought from a Retriever shop.
Points you collect belong to the shop that gave them, not to us. If that shop closes, the points end with it.
If you message a shop on Instagram, Messenger or WhatsApp and it has connected that account to Retriever, its owner reads your messages in Retriever, which deletes each one within a day of its turning 30 days old. If the shop has turned on automatic product help, your latest message may be sent to an AI provider to suggest products. Send HUMAN to stop that, and see our data deletion page to have your messages deleted sooner.
One thing to be aware of, and we would rather write it down than let you find it. A shop can write its own terms and privacy notice, and many have not. When a shop has written nothing of its own, its storefront has nothing of its own to show you, which means a checkout can collect your name, phone number and address with no notice from the shop attached. That is a gap and we are not going to dress it up. This policy is what applies to what Retriever does with your details in the meantime, and if you cannot find a shop's own notice, or cannot reach the shop, email support@pasal.studio and we will help.
24
Changes and how to reach us
If we update this policy, we change the date at the top. If a change materially alters what we collect, who receives it, or how long we keep it, we will email the address on your account before it takes effect rather than leaving you to notice a date.
Questions about anything here, or a request about your own data, go to support@pasal.studio. They are handled by Rohan Bhaju, who founded Retriever. Retriever is small enough that this is a real person reading, not a queue.

This is written in plain language so it is easy to read. If anything is unclear, email support@pasal.studio and a person will answer. The other pages in this set are the Terms of Service, the Privacy Policy, the Acceptable Use Policy, the Refunds page, the list of companies that help us run Retriever, and how to have your data deleted.

Privacy Policy

Who is behind this, and one word to get out of the way

Who is responsible for what

What we hold about a shop owner

Team conversations and personal notes

What we hold about a shop's staff

What a shop holds about its customers

Instagram, Facebook Messenger and WhatsApp

Chat on a shop's page

ChatGPT and Claude, if you connect them

What we hold about someone just visiting

Why we hold it, and on what basis

Email we send on a shop's behalf

Who else your data reaches

What your browser loads from other companies

Using the camera to scan

Where the data is kept

What is kept in your browser

How long we keep it

Your rights, and how to use them

Security

If something goes wrong

Children

If you are a shopper

Changes and how to reach us