DPDP-aligned by design
Our data handling follows the principles of India's Digital Personal Data Protection Act: lawful purpose, data minimisation, transparency, and your right to access, correct and erase your information.
What we collect
Account details (name, email, phone), addresses, order and payment metadata, wishlist and coins activity, and device/usage signals that keep the platform secure and fast. We do not store full card numbers — payments are tokenised by our PCI-compliant gateway.
How we use it
To fulfil and support your orders, run loyalty (coins), prevent fraud, and improve the experience. We never sell your personal data. Vendors only receive the information needed to fulfil your order.
Your rights
From My Account you can update your profile, manage saved cards, and delete your account (which removes your personal profile while retaining legally-required transaction records). You can withdraw consent for non-essential processing at any time.
Security
Encryption in transit, tenant-isolated data access, least-privilege roles, and an append-only audit trail for privileged actions. Breach handling follows DPDP notification expectations.