Privacy Policy

Effective 19 October 2026 · Version 2026-10-19

This policy explains how Messiah Grace (“Messiah Grace”, “we”) handles your personal data when you visit www.messiahmg.com, buy our products, or join and work with us as a direct seller (“partner”). We are the data fiduciary for this data under the Digital Personal Data Protection Act, 2023.

1. What we collect

  • Account details: your name, email address and mobile number, which your sponsor (the partner who introduces you) gives us to create your partner ID, and who your sponsor is. Your password is held by our sign-in provider (Amazon Cognito) in one-way encrypted form; we never see it.
  • KYC details (partners only): your PAN, optionally the last 4 digits of your Aadhaar (never the full number), the name, number and IFSC of your bank account, images of your PAN card and a bank proof, and, if you give it, a UPI ID for payouts.
  • Orders and earnings: what you order, your delivery address, payment references such as a UPI or bank transfer reference number (we do not collect card details), invoices, sales volume (BV), commissions, cashback, your wallet balances, payouts and the tax (TDS) deducted from them.
  • Website enquiries: if you send an enquiry from our website (the savings scheme, the discount shop, furniture or home appliances), your name, WhatsApp and call numbers, address and what you asked about, plus your IP address to stop misuse of the form. We use them only to reply to your enquiry.
  • Support: what you write to us in a complaint or help ticket, and, if you are not a partner, the name and contact details you give us.
  • Security records: your IP address, browser type, sign-in times and failed sign-in attempts. Every action our staff take on partner accounts is recorded in an audit log.
  • Cookies: one strictly necessary cookie that keeps you signed in. Our network provider, Cloudflare, may set strictly necessary security cookies to block attacks. We use no advertising or tracking cookies.

2. Why we use it

  • To create and secure your account and keep you signed in.
  • To run the direct selling relationship: place you in the network under your sponsor, record sales volume, and calculate commissions under the published compensation plan.
  • To process orders, issue invoices, deliver products and handle returns and refunds.
  • To verify your identity before you can earn or withdraw, as the Consumer Protection (Direct Selling) Rules, 2021 require, and to pay your commissions only to your own verified bank account or a UPI ID in your name.
  • To deduct and report income tax (TDS), and to keep the accounting and GST records the law requires.
  • To answer complaints and help requests.
  • To prevent fraud, abuse and unauthorised access, and to enforce our terms.
  • To publish the partner code, name and date of anyone removed as a partner on our list of delisted partners, as required for direct selling.
  • To send you product news and offers, only if you chose to receive them. You can stop them at any time.

We process your data on the basis of the consent you give when you first sign in and when you submit KYC, and, where the law allows it without consent, to meet our legal obligations (for example tax records) or to respond to lawful requests.

3. Who can see it

  • Our staff, only as their role requires. KYC documents are opened only by authorised staff, and every view is recorded.
  • Partners above you in the network see your name, partner code, status, award level and sales volume in their network view. They never see your contact, KYC or bank details.
  • Service providers who work for us: Amazon Web Services (hosting, storage and sign-in), Cloudflare (website security and delivery), our banks (to pay you), and delivery partners (your name, phone and address, to deliver an order). They may use the data only to provide their service to us.
  • Professional advisers such as our chartered accountants, auditors and lawyers, under a duty of confidentiality.
  • Government authorities when the law requires it, for example the Income Tax Department through TDS returns, or courts and regulators.

We do not sell your personal data.

4. Where it is stored

Our servers, databases, document storage and backups are in India (Amazon Web Services, Mumbai). Cloudflare protects and delivers our website through its global network, so web traffic may pass through servers outside India.

5. How long we keep it

  • Account, order and earnings data: for as long as your account is open.
  • After you leave: KYC, invoices, commission, payout and tax records for up to 8 years, as tax and company law require. Other data is deleted or anonymised once we no longer need it.
  • Security records: up to 1 year.
  • Backups: hourly backups are kept for 7 days and nightly backups for 35 days, then deleted.

6. How we protect it

Everything travels over encrypted connections (HTTPS) and is encrypted where it is stored, including backups. KYC documents are kept in private storage that only our application can read. Access is limited to the people and systems that need it, and staff actions are logged. No security is perfect: if a breach affects your data, we will tell you and the Data Protection Board of India as the law requires.

7. Your rights

  • Ask for a summary of the personal data we hold about you and how we use it.
  • Ask us to correct, complete or update it.
  • Ask us to erase it. We will, except where the law requires us to keep it (for example tax records), and we will tell you what we must keep and why.
  • Withdraw your consent at any time, as easily as you gave it. We will stop processing that depended on it; this may mean we can no longer keep you as a partner or pay you commissions. It does not affect what we did before.
  • Nominate someone to exercise these rights for you if you die or become unable to.
  • Have your complaints about our handling of your data answered.

Partners can use Help after signing in; anyone can write to the grievance officer below. We respond within one month. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

8. Children

Our services and the partner programme are for adults. You must be at least 18 years old to create an account. We do not knowingly collect personal data from children.

9. Changes to this policy

When we change this policy we update the version and date above. If a change affects how we use data you have already given us, we will tell you and, where the law requires, ask for your consent again.

Company
Messiah Grace
Grievance officer
To be announced
—
See grievance redressal.