Privacy Policy

1. Information We Collect

• Personal Data: Name, address, email, phone number, payment details, purchase history.
• Automatically Collected Data: IP address, browser type, device information (handset/model, operating system name and version, browser name, and whether the page was opened inside an in-app browser such as WhatsApp), cookies, and tracking data. Device details are used only for customer support and payment troubleshooting, and are visible to Baliraja admins — we do not sell them or share them with courier or payment partners.

2. How You Sign In

We identify you by your mobile number rather than a password. There are two ways you may be signed in:

• One-time password (OTP): We send a short code to your mobile number, usually over WhatsApp, and you enter it to confirm the number is yours. If you do not already have an account, one is created for you using that mobile number.
• Signing in from WhatsApp: If you reach our checkout by tapping a link we sent to your WhatsApp number, we may sign you in automatically using a secure, single-use link that expires within minutes. We do this only because WhatsApp has already confirmed that the number belongs to your device. As with an OTP, if you do not already have an account, one is created for you using that mobile number.

To stop the same sign-in link being used twice, we keep a short record that the link was used, along with the mobile number it was issued for. These links cannot be used to access anything beyond your own account.

3. How We Use Your Information

We use your information for the following purposes:

• To process orders, deliver products, and provide customer support.
• To diagnose payment and checkout issues using the customer's handset and OS version.
• To improve our services and communicate with you about offers or updates.
• To send order confirmations, shipping updates, and transaction receipts.
• To prevent fraud and ensure security of transactions.
• To comply with legal obligations and respond to legal requests.
• To analyze website usage and improve user experience.
• To send marketing communications (with your consent, which you can withdraw at any time).

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract Performance: To fulfill orders and provide services you requested.
• Legal Obligation: To comply with applicable laws and regulations.
• Legitimate Interest: To improve our services, prevent fraud, and ensure security.
• Consent: For marketing communications and non-essential cookies (you can withdraw consent at any time).

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your browsing experience:

• Essential Cookies: Required for website functionality and cannot be disabled.
• Analytics Cookies: Help us understand how visitors interact with our website, including session replay (FullStory and Microsoft Clarity) used to diagnose checkout and support issues.
• Preference Cookies: Remember your settings and preferences.
• Marketing Cookies: Used to deliver relevant advertisements (with your consent).

You can manage cookie preferences through your browser settings. However, disabling certain cookies may affect website functionality.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy:

• Order Information: Retained for 7 years as required by Indian tax and accounting laws.
• Account Information: Retained until you request deletion or close your account.
• Marketing Data: Retained until you unsubscribe or withdraw consent.
• Legal Records: Retained as required by applicable laws and regulations.
• Sign-In Link Records: Retained only while needed to stop a used link being reused, and deleted once the link has expired.

After the retention period, we will securely delete or anonymize your personal data.

7. Disclosure of Information

• We do not sell or rent your personal information.
• Data may be shared with third parties (e.g., payment processors, courier partners) solely to fulfill your order.

8. Third-Party Services

We may share your information with trusted third-party service providers who assist us in operating our business:

• Payment Processors: To process payments securely (e.g., PhonePe, Razorpay).
• Shipping Partners: To deliver your orders (e.g., courier services, logistics companies).
• Cloud Services: To store and manage data securely.
• Analytics Providers: To analyze website usage and improve services (including FullStory and Microsoft Clarity for session replay).
• Customer Support: To provide customer service assistance.

These third parties are contractually obligated to protect your data and use it only for specified purposes.

9. Security

We implement industry-standard security measures to protect your personal data:

• SSL/TLS encryption for data transmission.
• Secure servers and databases with access controls.
• Regular security audits and vulnerability assessments.
• Employee training on data protection and privacy.
• Secure payment processing through PCI-DSS compliant gateways.

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

10. Data Breach Notification

In the event of a data breach that may affect your personal data, we will:

• Notify affected users within 72 hours of becoming aware of the breach.
• Report the breach to relevant authorities as required by law.
• Take immediate steps to contain and remediate the breach.
• Provide guidance on steps you can take to protect yourself.

11. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete such information promptly. If you believe we have collected information from a child, please contact us immediately.

12. International Data Transfers

Your personal data is primarily stored and processed in India. If we transfer your data to other countries, we will ensure appropriate safeguards are in place to protect your data in accordance with Indian data protection laws and this privacy policy.

13. Your Rights

Under Indian law, including the Information Technology Act, 2000, and IT Rules, 2011, you have the following rights:

• Right to Access: Request a copy of your personal data we hold.
• Right to Correction: Request correction of inaccurate or incomplete data.
• Right to Deletion: Request deletion of your personal data (subject to legal requirements).
• Right to Object: Object to processing of your data for marketing purposes.
• Right to Withdraw Consent: Withdraw consent for data processing where consent is the legal basis.
• Right to Grievance: File a complaint with the relevant authority if you believe your rights have been violated.

To exercise these rights, please contact us using the information provided in the Contact Us section.

14. Policy Updates

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by posting the updated policy on this page with a new effective date. We encourage you to review this policy periodically. Your continued use of our services after changes are posted constitutes acceptance of the updated policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: