Privacy policy and cookies

Only what an order actually needs. There is no tracking pixel on this site, no advertising network, and no third-party analytics script.

We do not sell personal data and we do not share it for anyone else’s marketing. It goes to processors who need it to complete your order, and no further.

• Courier. Name, address and phone number, so the parcel can be delivered and so they can call you if they cannot find you.
• Payment gateway. Order value and a contact detail, to process the payment and any refund.
• SMS and email providers. Your number or address, to send the code or the confirmation you asked for.
• The tax authorities, where the law requires it, which for invoices and e-way bills it does.

Data is stored and processed in India. Where a processor operates elsewhere we use providers with an Indian region and keep the data in it.

Different records have genuinely different lifetimes, and the long one is not our choice.

Invoices and tax records

8 years

Abandoned carts

30 days

Sign-in codes and sessions

24 hours

Saved builds on a closed account

Deleted with the account

Eight years comes from section 36 of the CGST Act, which requires six from the due date of the annual return; eight is the practical figure once assessment timelines are accounted for. Section 8(7) of the DPDP Act expressly allows retention where another law requires it, and this is that case.

The DPDP Act gives you the right to access your data, correct it, have it erased, and nominate someone to exercise those rights if you cannot. Ask through the contact page and we respond within 30 days.

If you ask for a copy

You get a machine-readable file containing your profile, addresses, orders, returns and saved builds. It also lists anything withheld and why, so you can see that the answer is complete rather than having to take our word for it.

If you ask for erasure

This is the part most policies are vague about, so here is precisely what happens.

• Your name, email, phone, GSTIN, PAN, company name and any operator notes are removed from your customer record.
• Your name, contact details and address are removed from your past orders, and from the shipment notes, payment records, refund reasons, return comments and order history attached to them.
• Sessions, sign-in codes and saved builds are deleted outright.
• The audit trail of staff actions on your account is redacted too, so erasure does not leave a copy of you inside the record of erasing you.

Erasure is irreversible and it is not reversible by us either. It cannot be undone, and it will not be repeated on a record that has already been erased. If you order again afterwards, that is a new account.

Sign-in is a one-time code to your phone, 6 digits, valid for 5 minutes, with a limit of 5 attempts before the code is burned. There is no password to leak or reuse.

• Everything is served over TLS. There is no unencrypted route in.
• Staff access to customer records is role-based and every change is written to an audit log with the person who made it.
• Staff accounts holding elevated permissions require a second factor.
• Errors reported to our monitoring are scrubbed of phone numbers, email addresses, GSTINs, PANs and tokens before they leave the server.

If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board as the Act requires.

There is no cookie banner on this site because there is nothing to consent to. We set no advertising cookies and no analytics cookies. The only cookies are the ones the site cannot work without.

Blocking these will break sign-in and checkout, which is the only reason they exist.

This store is not intended for anyone under 18, and the DPDP Act requires verifiable parental consent for a child’s data. We do not knowingly collect it. If you believe a child has given us data, tell us and we will erase it.

Material changes are notified by email to account holders before they take effect. The date at the top of this page is the last change.