Privacy policy

What we collect and why

We collect personal data only when you give it to us, for these purposes:

• Order requests. Your name, phone number, e-mail address (optional), preferred way to be contacted and delivery address; for business orders also the business name, type, GSTIN and expected volume, and any message you write. We use them, with your consent, to answer your request: confirming availability, prices, delivery and payment, and keeping the records the law requires if you go ahead. We also record which version of our notice you agreed to and when.
• Complaints and data requests. Your name, e-mail address or phone number, an order reference if you give one, and your message. We use them to handle your request and to keep a record of how we did, as consumer-protection law requires.

We don’t use your details for marketing, we don’t sell them, and the website has no advertising or analytics trackers.

Cookies and technical data

• When you add packs to an order request, a cookie holds an anonymous cart number for up to 30 days, and a second one holds the number of packs for the header badge. Neither contains personal data.
• After you send a request, a cookie lets this browser show its confirmation for one day.
• To stop automated abuse, forms are checked by Cloudflare Turnstile, which processes your IP address and browser details, and we count recent requests per IP address. We store those counts only as one-way hashes, for at most an hour.
• Our hosting provider keeps short-lived technical logs, including IP addresses, to run and secure the service. We don’t keep your IP address with your request.

Who else handles your data

• If you go ahead with an order, the courier who delivers it receives your name, phone number and address.
• Service providers process data for us under contract and only on our instructions: website hosting, the database (hosted in Mumbai, India), sending e-mail, the Turnstile bot check and request counting. Some of these providers may process data outside India.
• We disclose data to authorities only when the law requires it.

How long we keep it

We keep your details while your request is open, and delete them 2 years after it is closed, unless a law requires us to keep a record for longer (for example, tax invoices). Order lines and amounts stay without your personal details. You can ask us to delete them sooner.

Your rights

Under the DPDP Act you can:

• ask for a summary of the personal data we hold about you and how we use it;
• ask us to correct, complete or update it;
• ask us to erase it, unless we must keep it by law;
• withdraw your consent at any time, as easily as you gave it — this doesn’t affect what we did before;
• have a grievance about our handling of your data resolved;
• nominate someone to exercise these rights if you die or become unable to.

To use any of these rights, send a request through our contact page. We may first confirm that the request comes from you. We acknowledge requests within 48 hours and resolve them within 30 days. If you’re not satisfied with our response, you can complain to the Data Protection Board of India.

How we protect it

Data is encrypted in transit. Only staff who need it can see it: staff sign in with a password and a second factor, each role sees only what its job requires, and every change is written to an audit log that can’t be edited.

Children

Order requests are for adults. If you are under 18, please ask a parent or guardian to send the request.

Changes to this policy

When we change this policy, we update the date at the top. If a change affects how we use data you’ve already given us, we’ll ask for your consent again where the law requires it.