Privacy Policy

• Account details: your name, email address, optional mobile number and password. Passwords are stored only in encrypted (hashed) form by our login provider; we can never see them.
• Order details: your delivery name, address, PIN code and mobile number, the products you order and your order history.
• Payment information: the payment status and transaction reference from our payment gateway partner. Card, UPI and bank details are entered on the payment partner's page and are never stored by us.
• Messages: anything you send us by email, phone or WhatsApp.
• Technical data: our hosting provider automatically records basic request information such as IP address, browser type and the pages requested, for security and troubleshooting.

We use your data only to:

• create and manage your account and keep you signed in;
• process, pack, ship and deliver your orders, and handle returns and refunds;
• send you account emails (confirmation, password reset) and order updates;
• answer your questions and resolve complaints;
• prevent fraud and keep the website secure;
• meet our legal, tax and accounting obligations.

We will only send you promotional messages if you have opted in, and you can unsubscribe at any time. We do not sell your personal data.

We keep this to the minimum needed for the shop to work:

• Login cookie: keeps you signed in. It is essential, and is removed when you sign out.
• Cart and theme: your shopping cart and light/dark preference are saved in your own browser (local storage), not on our servers.

We do not use advertising or third-party tracking cookies.

We share only what each service needs to do its job:

• Supabase: account login and our order database.
• DigitalOcean: hosting of this website.
• Our payment gateway partner: to take payment for your order (name, email, mobile number and order amount).
• Courier partners: your delivery name, address and mobile number.
• Email service provider: to deliver account and order emails.
• Government or law-enforcement authorities: only when required by law.

Some of these providers store data on servers outside India, including in Singapore. We use providers that protect data with industry-standard security.

We keep your account data while your account is active. Order and invoice records are kept for as long as tax and accounting laws require. When data is no longer needed, we delete or anonymise it.

The website is served only over secure, encrypted connections (HTTPS). Passwords are hashed, payment details never touch our servers, and our database only lets each customer see their own account and orders. No system is perfectly secure, but if we become aware of a breach affecting you, we will inform you and the authorities as the law requires.

You can ask us to:

• tell you what personal data we hold about you;
• correct or update it (you can also update your details at checkout);
• delete your account and personal data, except records we must keep by law;
• withdraw consent you have given, for example to promotional messages;
• nominate another person to exercise these rights on your behalf.

Email us from the address on your account to make a request. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

This website is meant for adults. If you are under 18, please use it only with the involvement and consent of a parent or guardian.

We may update this policy from time to time. The date at the top shows the latest version. For significant changes, we will let account holders know by email.

For any privacy question, request or complaint, contact our grievance officer. We acknowledge complaints within 48 hours and aim to resolve them within one month.

See also our Terms & Conditions.