Privacy Policy

1. Information We Collect

When you place an order or create an account on Ratnakatha, we collect:

• Account data: name, email address, phone number, hashed password
• Shipping data: address, pincode, city, state (for order fulfilment via Shiprocket)
• Payment data: processed by Razorpay; we never store full card numbers, UPI IDs, or bank details
• Browsing data: pages visited, time spent, referral source (via cookies and analytics)

2. How We Use Your Information

• Process and fulfil your orders (address verification, payment, dispatch)
• Send transactional emails (order confirmation, shipping updates, delivery confirmation)
• Provide customer support and handle returns/exchanges
• Improve our website and product offerings based on usage patterns
• Send marketing communications only with your explicit consent (opt-in required)
• Detect and prevent fraudulent activity

3. Legal Basis (DPDPA & GDPR)

We process your data under these legal bases:

• Contract: processing necessary to fulfil your order
• Consent: marketing emails, cookies (except strictly necessary ones)
• Legal obligation: tax records, regulatory compliance
• Legitimate interest: fraud prevention, website analytics, service improvement

4. Cookies

We use the following categories of cookies:

• Essential: cart session, login state, security tokens - no consent required
• Analytics: Google Analytics (page views, click tracking) - consent required
• Functional: remembers your preferences (theme, wrist size) - consent required

5. Data Sharing & Third Parties

We share your data only with trusted service providers necessary for order fulfilment:

• Razorpay - Payment processing (UPI, cards, net banking, EMI)
• Shiprocket - Shipping and logistics (address, phone for delivery label)
• Google Analytics - Anonymous usage analytics (with consent)

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

6. Data Retention

• Account data: until you delete your account or 5 years of inactivity
• Order data: 7 years (Indian tax/legal requirement)
• Analytics data: 26 months (Google Analytics default)
• Marketing consents: until you withdraw consent

7. Your Rights

Under the Digital Personal Data Protection Act (DPDPA, India) and GDPR (where applicable), you have:

• Right to access - request a copy of your personal data
• Right to correction - update inaccurate or incomplete data
• Right to deletion - request erasure (subject to legal retention periods)
• Right to withdraw consent - opt out of marketing anytime
• Right to data portability - receive your data in a machine-readable format
• Right to grievance redressal - lodge a complaint with us or the DPDPA board

To exercise any of these rights, email ratnakatha.studio@gmail.com. We will respond within 30 days as required by DPDPA.

8. Data Security

• Passwords are hashed using bcrypt (not stored in plain text)
• All traffic is served over HTTPS (TLS 1.3)
• Payment pages are PCI-compliant via Razorpay (we never handle raw card data)
• Regular security audits and dependency updates
• API rate limiting to prevent brute-force attacks

9. Contact & Grievance Officer

As required by DPDPA Rule 5(1), we have appointed a Grievance Officer:

10. Changes to This Policy

We may update this policy periodically. Material changes will be notified via email or a banner on our website. Continued use after changes constitutes acceptance of the updated policy.