Privacy Policy

Information we collect

Account details you give us: your name, email address and, optionally, a phone number. Your password is stored only as a one-way hash — we cannot read it, and neither can anyone who obtained our database.

Order information: the items you buy, your delivery address, and the status of each order. Payment confirmations: a transaction reference and the amount. We never receive or store your full card number, UPI PIN or bank credentials.

How we use it

To process and deliver your orders, send transactional email (order confirmation, dispatch and delivery updates, password resets), respond to support requests, and detect fraudulent or abusive activity. We only send marketing email if you explicitly subscribe to our newsletter, and every one of those has an unsubscribe link.

Who we share it with

Fulfilment partners receive only what they need to ship your parcel: recipient name, delivery address, phone number and the items ordered.

Payment providers (Razorpay and PayPal) process your payment directly and are the data controllers for your payment details. Our email provider delivers transactional messages on our behalf. We do not share your data with advertisers or data brokers.

Cookies and analytics

We use a small number of strictly necessary cookies to keep you signed in and to remember your cart between visits. These are required for the site to function and are not used for advertising or cross-site tracking.

How long we keep it

Order and invoice records are retained for as long as tax and accounting rules require. If you ask us to delete your account, we remove your personal profile and address book, and anonymise historical order records so the financial data remains intact without identifying you.

Your rights

You may request a copy of the personal data we hold about you, ask us to correct anything inaccurate, or ask for your account to be deleted. Email us from the address on your account and we will action it within 30 days.

Security

Traffic to this site is encrypted in transit. Passwords are hashed with bcrypt, sessions use short-lived tokens that rotate, and administrative functions are restricted by role. No system is perfectly secure, but if a breach ever affected your data we would tell you promptly rather than quietly.