Privacy Policy
This policy explains what personal data NepaIndexcollects, why, who it is shared with, and what control you have over it. It covers this website and the services run from it — not third-party sites you reach through outbound links, such as a listing's own website or social profile.
Who we are. NepaIndex Directory, Tinkune, Kathmandu, Nepal. We are the controller of the data described below. To reach us about anything on this page, email support@nepaindex.com.
What we collect
Data you give us
- Account details — your name, email address, and optionally a phone number, short bio, and profile photo. If you sign in with Google or Facebook, we receive your name, email address, and profile picture from that provider instead of a password.
- Listings you submit or claim — business name, address, contact details, opening hours, description, photos, and anything else you enter in the submission form. Most of this is published on a public listing page, which is the point of submitting it.
- Events, reviews, and reports — event details you publish, reviews and ratings you leave, and the reason you give when reporting a listing or event.
- Featured-placement purchases — the payment method you used (eSewa, Khalti, or bank transfer), the transaction reference you supply, and the payment-proof screenshot you upload. We do not take card details on this site and never see them.
- Messages and subscriptions — your name, email, phone, and message when you use the contact form, and your email address if you subscribe to the newsletter.
Data collected automatically
- Listing view counts— when a listing page is viewed we store a salted SHA-256 hash of the visitor's IP address with the date, so a listing owner can see how many distinct people viewed their page in a day. The raw IP address is never stored and the hash cannot be reversed back into one.
- Sessions — a session record and cookie so you stay signed in, plus the usual server logs kept by our hosting provider for security and debugging.
- Analytics and advertising — Google Analytics 4 and the Meta Pixel, but only after you consent to those categories in the cookie banner. Both are off by default. See the Cookie Policy for the detail.
Why we use it, and on what basis
| Purpose | Data used | Basis |
|---|---|---|
| Creating your account and keeping you signed in | Account details, session data | Performance of a contract with you |
| Publishing your listings, events, and reviews | What you submitted | Performance of a contract with you |
| Processing and verifying a featured-placement purchase | Purchase details, payment reference, proof image | Performance of a contract with you |
| Service email — verification, claim and purchase decisions, replies | Name, email address | Performance of a contract with you |
| Newsletter and marketing email | Email address | Your consent (confirmed by double opt-in) |
| Moderating reports, preventing spam and abuse, keeping the site secure | Account details, report contents, hashed view data, logs | Our legitimate interest in a trustworthy directory |
| Measuring traffic and improving search | Analytics events | Your consent |
| Advertising measurement on Meta platforms | Meta Pixel events | Your consent |
What is public
A published listing is public by design, and so is the contact information on it — that is how customers reach the business. The same is true of events you publish and reviews you leave, which show your display name and profile photo. Please do not put a personal phone number or home address in a listing unless you intend it to be public. Public pages can be indexed by search engines and copied by others, so removing something later will not always remove it from third-party caches.
Your email address, phone number, and the contents of contact-form messages are never published.
Who we share it with
We do not sell personal data. We share it only with the service providers needed to run the site, each acting on our instructions:
- Our hosting and database providers — to run the site and store its data.
- Cloudinary — image hosting for listing photos, avatars, and payment-proof uploads. Uploaded images are stripped of EXIF metadata, including GPS coordinates, before storage.
- Resend — delivery of transactional and newsletter email.
- Google — sign-in with Google, and Google Analytics where you have consented. See Google's Privacy Policy.
- Meta — sign-in with Facebook, and the Meta Pixel where you have consented. See Meta's Privacy Policy.
We will also disclose data where the law requires it, or where it is necessary to establish or defend a legal claim, or to protect the safety of our users.
Some of these providers operate outside Nepal, so your data may be processed in other countries.
How long we keep it
- Account data — for as long as your account exists. When an account is closed we scrub the personal fields but keep the record itself, so reviews and purchase history stay attached to their listings rather than disappearing. A full erasure is available on request (below).
- Listings, events, and reviews — until you or we remove them.
- Purchase and moderation records — kept after the fact as a record of what was approved or rejected and by whom.
- Listing view hashes — retained as daily aggregates for owner analytics.
- Newsletter records — if you unsubscribe we keep the row marked unsubscribed rather than deleting it, so we can honour the opt-out and prove it was honoured.
- Contact messages and email logs — kept for support and delivery troubleshooting.
Your rights
You can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything inaccurate — most of it you can edit yourself in your dashboard;
- delete your account and personal data;
- stop sending you marketing email — every newsletter has a one-click unsubscribe link;
- withdraw analytics or advertising consent, which you can do yourself at any time.
Email support@nepaindex.comand we will respond within 30 days. We may ask you to verify your identity first, so that we are not handing someone else's data to the wrong person.
Sign-in with Google or Facebook. Disconnecting NepaIndex in your Google or Facebook account settings stops that provider sharing further data with us, but does not delete what we already hold — email us for that.
Cookies
Cookies and similar browser storage are covered separately in the Cookie Policy, including how to change or withdraw your consent.
Security
Data is sent over HTTPS, passwords are stored hashed, visitor IP addresses are hashed before storage, and administrative actions are restricted by role. No system is perfectly secure, so we cannot guarantee absolute security — if you believe your account has been compromised, contact us immediately.
Children
NepaIndex is intended for adults running or searching for businesses. We do not knowingly collect personal data from children under 13. If you believe a child has given us their data, email us and we will delete it.
Changes to this policy
We may update this policy as the site changes. Material changes will be announced on the site, and where we rely on your consent we will ask for it again rather than assume it.
Contact
Questions, requests, or complaints: support@nepaindex.com, +977 9864046394, or the contact page.