Effective date: 28 July 2026
Last updated: 28 July 2026

This Privacy Policy explains how Brandbuilder Pvt Ltd (“Brandbuilder”, “we”, “us”, “our”) collects, uses, shares and protects personal information when you use the Stealth Wellness mobile application (the “App”).

Brandbuilder publishes and maintains the App on behalf of the health shop that sells through it (the “Store”). The Store is the merchant of record for the products you order and is the controller of your order and customer records; Brandbuilder operates the App and its supporting systems. If you do not agree with this policy, please do not use the App.

1. Information we collect

Account information

The App requires an account to use. Accounts are created for you by the Store; the App does not offer public self-registration. In connection with your account we process:

  • your name;
  • your email address and/or mobile phone number, used as your sign-in identifier;
  • your password, which is transmitted to our servers to authenticate you and is stored only in hashed form;
  • optional profile details you choose to add: date of birth, a short bio, a profile photo, and a dietary preference;
  • your loyalty points balance.

Delivery addresses and location

You can save one or more delivery addresses. If you grant location permission, the App reads your device’s current position at that moment so it can attach accurate coordinates to the address you are saving. Saved addresses and their coordinates are stored on our servers so they can be reused at checkout and given to the Store for delivery.

Location is read only while the App is open and only when you actively use an address feature. The App does not track your location in the background and does not build a location history.

Orders and shopping activity

We process the contents of your cart, your favourites, the orders you place, order totals, delivery details, order status and your order history.

Payment information

See section 5 below. In short: card and Cash App credentials are entered inside Square’s own payment interface, not into the App, and we never receive or store your full card number.

Photos and camera

If you choose to set a profile photo, the App accesses your camera or photo library so you can capture or select a single image. Only the image you select is uploaded. The App does not scan, index or upload any other media on your device.

Information stored on your device

The App stores the following locally on your device, using the operating system’s standard app storage:

  • your profile record and your session token, so you stay signed in between launches;
  • identifiers of notifications already shown to you, so the same message is not repeated;
  • a local activity feed.

Signing out or uninstalling the App removes this local data from your device.

Technical information

Like any app that talks to a server, our systems receive standard connection data with each request, such as your IP address, the date and time, and basic device and app-version information. This is used for security, fraud prevention, and diagnosing faults.

2. What we do not collect

We want to be specific about this, because it is unusual:

  • The App contains no third-party advertising SDKs and shows no ads.
  • The App contains no third-party analytics or tracking SDKs.
  • We do not collect your advertising ID and do not track you across other apps or websites.
  • We do not sell or rent your personal information to anyone, and we do not share it for cross-context behavioural advertising.
  • We do not collect background or continuous location.
  • We do not access your contacts, calendar, microphone, call logs or SMS messages.
  • We do not receive or store full payment card numbers or Cash App credentials.

3. How we use your information

We use personal information only to run the service you asked for:

  • to authenticate you and keep your session secure;
  • to show you the Store’s catalogue, your cart and your favourites;
  • to take, process, deliver and support your orders, and to maintain your order history;
  • to process payments and issue receipts, refunds or corrections;
  • to send you service messages about your account and orders, including order-status notifications;
  • to operate a loyalty points balance where the Store offers one;
  • to keep the service secure, prevent fraud and abuse, and debug faults;
  • to comply with legal, tax and accounting obligations.

Where the law requires a legal basis (for example the UK/EU GDPR), we rely on: performance of a contract with you (operating your account and fulfilling orders); our legitimate interests (security, fraud prevention, service improvement); your consent (device permissions such as location, camera and notifications, which you can withdraw at any time in your device settings); and compliance with legal obligations (retaining transaction records).

4. Device permissions

The App requests only the permissions below. Each is optional except internet access, and each is requested at the moment the related feature is used. Declining a permission disables only that feature.

  • Internet / network access — Required. To communicate with our servers to sign you in, load products and place orders.
  • Location (precise / approximate, while in use) — To attach accurate coordinates to a delivery address you are saving. Not used in the background.
  • Camera — To take a profile photo, if you choose to.
  • Photos / media — To choose an existing profile photo, if you choose to.
  • Notifications — To display order and account notifications on your device.

You can review or revoke these at any time in your device’s system settings for the App.

5. Payments

Payments in the App are processed by Square, Inc. (including its Cash App Pay service). When you pay, you authorise the transaction inside Square’s own secure interface. Square returns to the App a single-use payment token that identifies the authorisation but not your payment credentials. The App sends only that token and the order reference to our servers, which complete the charge through Square.

We never see, receive or store your full card number, CVV, or Cash App login. Those are handled entirely by Square under its own privacy policy, available at squareup.com/legal/privacy.

We do retain records of the transaction itself — amount, date, order contents, delivery address, status, and a masked or tokenised payment reference — because we are required to keep transaction records and because you and the Store need them for receipts, refunds and support.

6. How we share information

We share personal information only as described here:

  • The Store. The health shop fulfilling your order receives your name, contact details, delivery address, order contents and order status so it can prepare and deliver your order.
  • Square, Inc. — payment processing, as described above.
  • Our hosting and commerce platform. The App’s backend runs on a third-party ordering and point-of-sale platform that hosts the Store’s catalogue, accounts and orders on our behalf, under contract and on our instructions.
  • Service providers who help us operate the App, such as cloud hosting and email delivery, bound by confidentiality obligations and permitted to use the data only to provide their service to us.
  • Legal and safety. Where we are required by law, court order or a valid request from a public authority, or where disclosure is necessary to protect our rights, your safety or the safety of others, or to investigate fraud.
  • Business transfer. If our business or the App is merged, acquired or reorganised, information may transfer as part of that transaction; we will require the recipient to honour this policy or notify you of any material change.

We do not sell your personal information.

7. How long we keep it

  • Account and profile data — for as long as your account is active, and then deleted or anonymised after a request as described below.
  • Order and transaction records — retained for as long as required by applicable tax, accounting and consumer-protection law, typically up to seven years, even after your account is closed. These records are kept for legal compliance only and are not used to contact or profile you.
  • Saved delivery addresses — until you delete them, or your account is deleted.
  • Data stored on your device — until you sign out or uninstall the App.

8. Security

All communication between the App and our servers is encrypted in transit using HTTPS/TLS. Passwords are stored only in hashed form. Access to production data is restricted to personnel who need it. Payment credentials are handled by Square and never reach our systems.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please keep your password confidential and sign out on shared devices. If you believe your account has been compromised, contact us immediately at mail@brandbuilder.com.np.

9. Your rights

Depending on where you live, you may have the right to:

  • access the personal information we hold about you and request a copy;
  • correct information that is inaccurate or incomplete;
  • delete your account and personal information (see section 10);
  • object to or restrict certain processing;
  • withdraw a permission or consent at any time, without affecting processing already carried out;
  • request portability of information you provided to us;
  • be free from discrimination for exercising any of these rights.

You can update most profile information directly in the App. For anything else, email mail@brandbuilder.com.np. We will verify your identity — normally by confirming control of the email address or phone number on the account — and respond within 30 days. Exercising these rights is free, unless a request is manifestly unfounded or excessive.

If you are in the UK, EU or another jurisdiction with a data protection authority, you also have the right to lodge a complaint with your local regulator. We would appreciate the chance to address your concern first.

10. Deleting your account

You can request deletion of your Stealth Wellness account and its associated personal data at any time.

How to request deletion. Send an email to mail@brandbuilder.com.np from the email address registered on your account, with the subject line “Account deletion request — Stealth Wellness”. Include the name or phone number on the account if you registered with a phone number. You do not need to have the App installed to make this request.

What is deleted: your profile (name, email, phone, date of birth, bio, profile photo, dietary preference), your saved delivery addresses, your favourites, your loyalty points balance, and your sign-in credentials.

What is retained, and why: records of completed orders and payments are kept in anonymised or pseudonymised form where possible, and otherwise retained for the period required by applicable tax, accounting and consumer-protection law (typically up to seven years). We also retain any records needed to resolve a dispute or enforce our agreements.

Timing: we confirm receipt within 7 days and complete deletion within 30 days of verifying your identity. You will receive written confirmation once it is done.

11. Children

The App is intended for adults and is not directed to children. We do not knowingly collect personal information from anyone under 16 (or under 13 where that is the applicable threshold). If you believe a child has provided us with personal information, contact mail@brandbuilder.com.np and we will delete it promptly.

12. International transfers

Brandbuilder Pvt Ltd is established in Nepal, and our service providers — including Square and our hosting platform — operate in other countries, including the United States. Your information may therefore be transferred to, stored in and processed in countries other than your own, whose data protection laws may differ from those of your jurisdiction. Where required, we put appropriate safeguards in place, such as standard contractual clauses, before transferring personal information internationally.

13. Changes to this policy

We may update this policy to reflect changes to the App, our practices, or legal requirements. When we do, we will revise the “Last updated” date above. If a change materially affects how we use your personal information, we will give you prominent notice — for example, an in-app notice or an email — before it takes effect. Continuing to use the App after a change takes effect means you accept the updated policy.

14. Contact us

For any question about this policy, your personal information, or to exercise any of the rights described above:

Brandbuilder Pvt Ltd
Email: mail@brandbuilder.com.np
Application: Stealth Wellness (com.brandbuilder.stealthwellness)