Privacy policy

This policy explains what we collect when you use this site, why we collect it, and what you can ask us to do with it. The data controller is [TODO: registered business/legal entity name], contactable at [TODO: support email address].

What we collect

• Account details: your name, email address, and a securely hashed password. We never store your password itself.
• Order details: shipping address, phone number, the items you bought, and the amount paid.
• Payment data: handled entirely by Razorpay. We receive a payment reference and its status — never your card number, CVV, or UPI credentials.
• Technical data: your IP address for rate limiting and abuse prevention, and basic request logs.

Why we use it

• To take, process, and deliver your orders, and to handle returns and refunds
• To let you sign in and see your order history
• To respond when you contact support
• To keep the site secure and prevent fraud
• To meet tax and accounting obligations

Cookies

We set one essential cookie to keep you signed in. It is HTTP-only, so scripts cannot read it, and it expires after seven days. Your cart is stored in your own browser, not on our servers. We do not use advertising or tracking cookies.

Who we share it with

• Razorpay — to process payments and refunds
• Courier partners — the name, address, and phone number needed to deliver your parcel
• MongoDB Atlas and Vercel — hosting and database infrastructure
• Cloudinary — product image hosting (no customer data)
• Government authorities, where the law requires it

We do not sell your personal data.

How long we keep it

Order records are kept for [TODO: retention period, e.g. 8 years] to satisfy tax and accounting requirements. Account data is kept while your account is open. Request letters and support emails are kept for [TODO: support correspondence retention period].

Security

Passwords are hashed with bcrypt, sessions use signed HTTP-only cookies, the site is served over HTTPS, and payment signatures are verified server-side. No system is perfect, but we take reasonable measures appropriate to the data we hold.

Your rights

You can ask us to show you the data we hold about you, correct it, or delete it. Some data must be retained for tax purposes even after an account is closed. Write to [TODO: support email address] and we will respond within [TODO: data request response time, e.g. 30 days].

Children

This site is not intended for children under 18, and we do not knowingly collect their data.

Changes

If this policy changes materially we will update the date at the top of this page.