Privacy

What we collect

• Contact name and business name
• Phone number and email address
• Shipping and billing addresses (line 1, line 2, city, state, PIN, country)
• GSTIN
• Order history (items, quantities, totals, timestamps)
• Server access logs (IP, user agent, timestamps) for security

We do not collect or store card numbers, UPI VPAs, CVVs, OTPs, or bank login details. Razorpay handles all payment data on our behalf.

Where it's stored

• Operations data (orders, customer records) lives in a private Google Sheet accessible only to authorized staff.
• Payment data is held by Razorpay; we never store card or bank details on our servers.
• Server logs are retained on the hosting provider's infrastructure.

Who we share it with

• Razorpay — payment processing
• Courier partners (e.g. Delhivery, Bluedart, India Post) — for delivery; only name, phone, and address shared
• GST authorities — invoices submitted as required by Indian tax law

We do not sell, rent, or share your data with third-party advertisers, marketers, or data brokers.

How long we keep it

• Order records: 8 years (mandatory under Indian GST and Companies Act record-keeping rules).
• Marketing opt-ins: until the customer opts out.
• Server logs: 90 days.

Cookies

We use a single first-party cookie to keep your cart between visits. We do not run Meta Pixel, advertising trackers, or session-replay scripts. Optional Google Analytics may be enabled — when it is, we use IP anonymisation and 14-month data retention.

Your rights under the DPDP Act 2023

• Right to access the personal data we hold about you.
• Right to correct inaccurate data.
• Right to delete data, subject to GST and Companies-Act retention obligations.
• Right to grievance redressal — see contact below.

To exercise any of these rights, email sonaagency15@gmail.com from the address used to place the order.

Grievance officer

Reach out via email or phone for any data-related grievance; we acknowledge within 1 business day. A named individual Grievance Officer should be appointed before scaling, per DPDP Act 2023 Section 10.