Legal
Privacy Policy
Effective
Last updated
This policy explains what Multani Traders LLC does with personal information collected through this website, its optional AI assistant, and the emails we exchange with you afterwards. It describes how the site works today rather than how a website of this kind might work.
This site is an informational and business-inquiry website. You cannot create an account here, we do not take payment here, and there is no advertising on it. We do measure how the site is used and how quickly it loads, in the limited and cookieless way described under "Website analytics and performance measurement" below.
1. Who this policy is from
Multani Traders LLC operates this website. Where this policy says "we", "us" or "our", it means Multani Traders LLC.
We have not published a postal address or telephone number on this site, so this policy does not state one. The ways to reach us are the ones listed under Contacting us, at the end of this policy.
2. Information we collect
Almost everything we hold about you is information you typed into a form and chose to send us. There are two such forms, and they ask for different things.
When you send a message through Contact Us
The form asks for, and we store:
your name
your work email address
your phone number
your company or organization, if you enter one — this field is optional
your message
The first three are required, because a message we cannot reply to is not a message we can act on. We also record the date and time of the submission and a fixed internal subject line of "Website contact", which is set by our system and not taken from anything you send.
When you send a product inquiry
A product inquiry is submitted from a product page and asks for slightly more, because it is a question about a specific item. We store:
your name
your email address
your phone number
the quantity you are asking about
your company or organization, if you enter one — optional
your country, if you enter one — optional
your message, if you write one — optional
which product you were asking about, recorded as the product's name and stock-keeping unit alongside your inquiry
The first four are required. We also record the date and time of the submission.
Information handled to keep the forms working
Public forms on any website attract automated abuse, and two protections on ours process technical information about the request rather than about you:
- Abuse rate limiting
We count recent submissions per connection so that one source cannot flood the form. Your IP address is read from the request, converted into an irreversible cryptographic hash, and it is that hash — not the address — that is sent to the service holding the counter. The counter expires on its own within minutes.
- Bot verification
Each form carries a Cloudflare Turnstile challenge. To verify that the challenge was genuinely completed, we send Cloudflare the token from your browser together with your IP address. We receive back only a pass or fail.
We do not store your IP address, your browser's user-agent string or the page you arrived from in our database. Our hosting and infrastructure providers keep their own operational server logs, as any hosting provider does, and those logs may include IP addresses and request details for a limited period.
We do not ask for, and the forms have no field for, any sensitive category of personal data — health, biometric, genetic, precise location, immigration status, race or ethnicity, religious belief, sex life or sexual orientation, or any government identification number. Please do not send such information in a message.
When you use the AI assistant
The assistant sends the message you type, together with up to eight recent messages from the same open conversation, to Anthropic so that it can generate a response. Your latest question is also sent to Voyage AI to find relevant published product information. Please do not put personal, payment, confidential or sensitive information into the assistant.
The recent conversation remains only in the memory of the page open in your browser. We do not save chat messages or replies in our database, browser local storage, analytics or application logs. Refreshing or closing the page clears that visible history.
Before chat begins, Cloudflare Turnstile verifies the session. We then set a signed, HTTP-only security cookie for up to two hours and use irreversible hashes of the session and connection identifiers for short-lived Upstash abuse and usage counters.
3. How we use information
We use what you send us in order to:
read and reply to your Contact Us message
answer your product inquiry and discuss the product, quantity or opportunity you asked about
send you an automatic email confirming that your submission reached us
notify the relevant person at our company that a new message or inquiry has arrived
keep an ordinary business record of the enquiries we have received and how they were handled
protect the website and our forms against fraud, bots and abuse
operate, maintain and secure the website
comply with the law, and respond to a lawful request or legal claim
We do not use your information for behavioural advertising, targeted advertising, profiling that produces decisions about you, marketing automation, or data brokerage. There is no marketing mailing list on this site to subscribe you to.
4. Service providers
We do not run our own servers. The website relies on a small number of specialist providers, each of which handles information in order to deliver the specific function next to its name, and each of which we selected for that function rather than for anything to do with advertising:
- Website hosting
Our hosting provider runs the application and serves the pages you are reading. Requests to the site necessarily pass through it, and it maintains operational logs.
- Database — Railway
Your contact messages and product inquiries are stored in a managed MySQL database hosted on Railway.
- Transactional email — Resend
Your confirmation email and our internal notification are delivered through Resend, which therefore handles your email address and the contents of those messages.
- Bot and abuse protection — Cloudflare
Cloudflare Turnstile verifies that a submission came from a person rather than a script, as described above.
- Rate limiting — Upstash
Upstash holds the short-lived abuse counters. It receives the irreversible hash described above, not your IP address. It also holds short-lived assistant request and token-budget counters.
- AI response generation — Anthropic
Anthropic processes the assistant message and bounded recent conversation context to generate a reply. We do not send contact form or product inquiry records to it.
- Product search — Voyage AI
Voyage AI converts the assistant question and approved published product text into numerical vectors used to find relevant product information. It does not receive contact form or inquiry records.
- Analytics and performance measurement — Vercel
Vercel Web Analytics and Vercel Speed Insights collect the aggregate usage and page-speed measurements described below. They receive no form field you fill in on this site.
- Images and media — Cloudinary
Product photography and other imagery are stored and delivered by Cloudinary, so your browser requests those image files from it directly.
These providers process information in order to provide their service to us. We have not described their own contractual or privacy commitments here, because those are their statements to make and not ours to summarise; each publishes its own privacy documentation.
Beyond those providers, we may disclose information where we are legally required to, where it is necessary to establish or defend a legal claim, or where you have asked us to. We do not otherwise give your contact details to anyone.
5. Selling data, targeted advertising and profiling
We do not sell personal information, we do not exchange it for anything of value, and we do not use it for targeted advertising. We do not carry out profiling that results in an automated decision about you, and we do not process personal information for those purposes on anyone else's behalf.
That is a statement about how this website works now, not a promise about every future business decision. If any of it changes, we will change this policy before the change takes effect and, where the law requires it, offer you the choice the law provides.
6. Website analytics and performance measurement
We use two measurement tools provided by Vercel — Web Analytics and Speed Insights — to understand how this website is used and how well it performs for the people using it. We use them for four things:
how much traffic the site receives
which pages are visited, and how visitors move between them
how often a visitor takes one of three actions: following a purchase link to an external marketplace, submitting a product inquiry, or sending a message through Contact Us
how quickly pages load and respond in real browsers, including the measurements commonly known as Core Web Vitals
The measurement is aggregate. It tells us that a page was viewed or that an inquiry was submitted; it does not tell us who did it, and we cannot use it to look up an individual or to connect a measurement back to a message you sent us.
We do not send the contents of the Contact Us or product inquiry forms to analytics. Your name, email address, phone number, company, country, quantity and message are never included in an analytics event, and neither is the reference number of the message or inquiry that was stored. The conversion events named above carry, at most, the public web address of the product page you were on and the name of the marketplace a purchase link pointed to.
Vercel's own documentation describes both tools as cookieless. We have not repeated its description of how it counts visitors without them, because that is its statement to make rather than ours; it publishes its own privacy documentation.
Measurement is limited to the public website. The pages our own staff use to administer the site are excluded from it, as are the internal pages used to develop it.
We do not use analytics for advertising, we do not build a profile of you from it, and we do not combine it with the messages and inquiries you send us.
7. Cookies and browser storage
This website sets no advertising cookies and no analytics cookies. It carries no advertising at all, and the measurement described in the previous section is cookieless. What this site does use is limited to the following:
- Your light or dark theme choice
If you switch the site between light and dark, that single preference is saved in your browser's local storage under the name "theme", so the page does not flash back to the other one on your next visit. It stays in your browser, it is never sent to us, and it identifies nothing about you. Clearing your browser storage removes it.
- Security verification
The Cloudflare Turnstile widget is loaded from Cloudflare and may store a short-lived value in your browser in the course of issuing and solving its challenge. It exists to distinguish a person from a script on that one submission.
- AI assistant session
After the assistant's security check, we set a signed, HTTP-only cookie named mt_chat_session for up to two hours. It contains a random session identifier and timing information, not your chat messages or personal details. Page scripts cannot read it.
- Staff sign-in
Our own administrative area sets two session cookies when a member of our team signs in. They are marked so that page scripts cannot read them, they are only ever set after a successful sign-in, and they are never set for a visitor to the public site.
Because this limited security storage is necessary to protect the assistant and nothing here is used for advertising or cross-site tracking, and because our analytics and performance measurement set no cookies and store nothing in your browser, this site does not present a cookie consent banner. A banner asking permission for storage we do not use would tell you less about this site rather than more. If we later add anything that calls for consent, we will ask for it properly at that point and update this section.
8. How long we keep information
We keep contact messages and product inquiries for as long as is reasonably necessary to:
reply to you and follow up on what you asked about
maintain an appropriate record of our business enquiries and the relationship that may follow from one
resolve a dispute or establish, exercise or defend a legal claim
detect and prevent fraud and abuse of our forms
meet a legal, tax or regulatory obligation that applies to us
We have not yet adopted a fixed retention schedule that sets a specific number of months or years for each record, and we would rather tell you that than publish a period we do not actually operate to. The abuse counters described above are the exception: they expire automatically after their configured windows, and the assistant session cookie expires within two hours. If you would like your information deleted sooner, ask us using the channels below.
9. Security
We use technical and organizational measures that are reasonable for a site of this kind. Traffic to the website is encrypted in transit; our administrative area requires a password and is restricted to authorised staff; access to stored messages is limited to that area; and the forms are protected by the abuse and bot measures described above. We deliberately do not publish the details of these arrangements.
No method of transmitting information over the internet, and no method of storing it, can be guaranteed to be completely secure. We cannot and do not promise that our safeguards will never be defeated. If you believe you have found a security problem with this website, please tell us using the channels below.
10. Maryland Privacy Rights
The Maryland Online Data Privacy Act has applied since October 1, 2025 to controllers that meet the thresholds it sets. We have not determined that those thresholds are met in our case, and we do not claim here either that they are or that they are not. To the extent that the Maryland Online Data Privacy Act applies to our processing, this section describes the rights it gives Maryland residents and how to use them.
Subject to the conditions and exceptions in the Act, those rights include the right to:
confirm whether we are processing your personal data, and access that data
correct inaccuracies in your personal data, taking into account its nature and the purposes of the processing
delete personal data we hold about you
obtain a copy of the personal data you provided to us, in a portable and readily usable form, where processing is carried out by automated means
opt out of the sale of personal data, of targeted advertising, and of profiling in furtherance of decisions that produce legal or similarly significant effects
not be discriminated against — in price, service or otherwise — for exercising any of these rights
appeal, if we decline to act on your request
On the opt-out right specifically: as stated above, we do not currently sell personal data, do not use it for targeted advertising, and do not carry out that kind of profiling. There is therefore nothing of that sort for you to opt out of today, and we are not implying otherwise by listing the right. You are welcome to send us an opt-out request anyway, and we will record it.
Making a request
We have not set up a separate privacy request address, so please use a channel that we actually monitor:
Use the contact form on our Contact page — linked at the end of this document — and begin your message with "Privacy Request".
Or email support@multanitradersllc.com with "Privacy Request" in the subject line.
Tell us enough to identify you in our records — the name, email address and, where relevant, the phone number you used when you contacted us — and describe what you would like us to do.
We will need to be reasonably able to verify that the request comes from you, or from someone you have authorised, before we act on it — particularly for a request to access or delete data. If we cannot verify it, we will tell you rather than act on it. Using the same email address you originally contacted us from is usually the simplest way to help us match your request to our records.
We aim to respond to a request within the time the applicable law allows, and we will not charge you for a first reasonable request.
Appealing a decision
If we decline to act on your request, our response will say so and will explain why. To the extent the Maryland Online Data Privacy Act applies, you may appeal that decision within a reasonable period:
Use the contact form on our Contact page — linked at the end of this document — and begin your message with "Privacy Appeal".
Or email support@multanitradersllc.com with "Privacy Appeal" in the subject line.
Tell us enough to identify you in our records — the name, email address and, where relevant, the phone number you used when you contacted us — and describe what you would like us to do.
Replying directly to our response is the easiest route, and reaches the same people. We will inform you in writing of the outcome of the appeal and the reasons for it. If your appeal is denied, you may contact the Consumer Protection Division of the Office of the Maryland Attorney General to submit a complaint.
If you live somewhere else
This section is written for Maryland residents because that is the law we have drafted against. If you live elsewhere and another privacy law gives you rights over information we hold, write to us using the same channels and we will consider your request. In practice we would rather honour a reasonable request about your own information than debate whether we are obliged to.
11. Children
This is a business website. It is not directed to children, it offers nothing aimed at them, and we do not knowingly collect personal information from a child. We have not imposed a minimum age to read these pages, because reading a page about a company does not warrant one.
If you believe a child has sent us personal information through one of our forms, contact us using the channels below and we will delete it.
12. Marketplaces and other websites we link to
Some links on this site — including the buttons that let you buy a product — take you to a third-party website such as an online marketplace. When you follow one of those links you leave this site, and from that point the other website's own privacy policy and terms govern what happens, including anything it collects, any cookies it sets and any account or payment details you give it.
We do not control those platforms and this policy does not apply to them. Please read their policies. Separately, some product photography on this site is currently served directly from a marketplace's own image service, which means your browser requests those image files from that third party while you are still on our pages.
13. Changes to this policy
We will update this policy when the website's behaviour changes or when it needs to be clearer. When we do, we will change the "Last updated" date shown at the top of the page. Where a change materially affects how we handle information you have already sent us, we will take reasonable steps to bring it to your attention rather than relying on the date alone.
The dates at the top of this page change only when the document changes. They are not updated because the site was rebuilt.
14. Contacting us
For any question about this policy, or to make a privacy request:
Use the contact form on our Contact page — linked at the end of this document — and begin your message with "Privacy Request".
Or email support@multanitradersllc.com with "Privacy Request" in the subject line.
Tell us enough to identify you in our records — the name, email address and, where relevant, the phone number you used when you contacted us — and describe what you would like us to do.