गोपनीयता
Buyer phone numbers and street addresses are encrypted at rest with AES-GCM. The key comes from ENCRYPTION_KEY. If that variable is missing, the API uses a development key and says so in the product. Do not store real orders in that mode.
Every order query is scoped to the logged-in seller. Export and delete live in Settings. Phone numbers are masked in lists. Logs are not supposed to contain phones, addresses, passwords, or tokens.
The model sees numbers: order value, COD or prepaid, time of day, prior orders, and address-quality flags. It does not see the phone, the buyer’s name, or the pincode as a risk feature. A pincode can be shown as courier context. It is never a ban.
Phone numbers are not sent to TabPFN, Gemma, SerpApi, or ElevenLabs. The Hindi voice script is shop name and amount only. Addresses are sent to your own ML service so it can score quality. From there they reach Gemma only when GEMINI_API_KEY or OLLAMA_BASE_URL is set.
Ollama is the privacy-max option: Gemma runs on a machine you control, including fully offline. AI Studio serves the same open-weight Gemma family when you prefer not to host it. Closed-model APIs are not on the scoring path.
Uploads are capped (about 5 MB, 5,000 rows). CSV export prefixes cells that start with =, +, -, or @ so a spreadsheet does not treat them as formulas.