01What we collect
| Data | When | Why |
|---|---|---|
| Name, email, mobile number | When you create an account | To sign you in and contact you about orders |
| Password | When you create an account | We store only a salted scrypt hash, never the password itself |
| Delivery address, PIN code, business name, GSTIN | At checkout | To deliver your order and issue a valid GST invoice |
| Order contents, amounts, payment method | When you order | To fulfil, invoice and support your order, and to meet tax law |
| Messages you send us | Via the contact form | To reply and resolve your query or grievance |
| Saved addresses | When you tick “Save this address” at checkout | One-tap checkout next time. Remove them anytime on your account page |
| Your cart | While signed in | Kept on your account so it follows you across devices and survives signing out |
| Your avatar choice | On your account page | Shown only to you on this site |
| IP address (temporarily) | On every request | Abuse protection and rate limiting. Kept in memory only and discarded within minutes |
We do not collect card or bank details: payment is made on delivery or against an invoice. We do not knowingly collect sensitive personal data such as health or biometric information.
03How we use it — and the legal basis
- To perform our contract with you: processing orders, delivery, invoices, returns and support.
- Legal obligations: GST invoicing and keeping accounts under Indian tax law.
- Consent: your account. You give consent when you sign up and can withdraw it by deleting your account.
- Security: preventing fraud, abuse and unauthorised access.
05How long we keep it
- Account details: until you delete your account.
- Orders and invoices: as long as Indian tax and accounting law requires (currently at least six years), even if you delete your account. After deletion they are no longer linked to a login.
- Contact messages: up to two years after your query is resolved.
06Your rights
Under the DPDP Act you can:
- Access: see your profile and every order on your account page.
- Correction: edit your name and mobile number on your account page, or ask us to fix anything else.
- Erasure: delete your account from your account page. It takes effect immediately.
- Grievance redressal: contact our Grievance Officer (details below). We acknowledge within 48 hours and resolve within 30 days.
- Nominate: someone to exercise these rights for you in case of death or incapacity, by writing to us.
If you're not satisfied with our response, you may complain to the Data Protection Board of India.
07Security
Passwords are hashed with scrypt and a unique salt. Sessions use signed, HttpOnly cookies, and the site is served over HTTPS. Staff access needs a separate admin login. Logins, sign-ups and orders are rate-limited. No system is perfectly secure: if a breach affects you, we will notify you and the Data Protection Board as the law requires.
08Children
Accounts are for people aged 18 and over. Younger customers can shop through a parent or guardian, who creates and manages the account.
09Changes to this policy
If we make a material change, we'll update the date at the top and, where appropriate, email account holders before it takes effect.
10Grievance Officer
For privacy questions, requests or complaints:
- Business
- Lakshamii Traders