Privacy Policy
How we collect, use, and protect your information.
Data Protection Commitment
At NaturallYours, we respect your privacy. This policy clearly outlines what personal data we collect, how we use it, and your legal rights under India’s Digital Personal Data Protection (DPDP) Act.
Information We Collect & Why We Need It
We only collect data that is absolutely necessary to run our store.
- Account & Delivery Details: Your name, email, phone number, and shipping address. We use this to create your account, ship your orders, and email you tracking updates.
- Order & Transaction History: Record of items purchased, billing address, and transaction IDs. We use this to manage returns, prevent fraud, and comply with Indian tax laws.
- Browsing Preferences: Basic website analytics and cookies. We use this to improve our website speed and personalize your shopping experience.
- Customer Support Logs: Text from your chats or emails when you contact our support team. We use this to resolve your order issues.
- Guest Contact Form: If you contact us through our website without logging in, we collect your name, email address, phone number, and message. We use this solely to respond to your enquiry. Unlike account data, guest contact-form submissions are automatically deleted from our systems 90 days after receipt and are not linked to any account.
What We Do NOT Collect (Payment Security via Razorpay)
Your financial security is our highest priority. NaturallYours does not collect, view, or store your raw payment details (such as credit card numbers, CVVs, or bank pins). All checkout payments are processed directly by our secure, RBI-authorized payment partner, Razorpay.
- Razorpay processes your information securely in compliance with PCI-DSS standards. You can read Razorpay's Privacy Policy to see how they protect your data.
Who Else We Share Data With
Besides Razorpay (for payments), we share limited personal data with a small number of service providers who help us run the store, strictly for the purpose stated below. We don't sell your data to anyone.
- Email delivery (Brevo): your email address, to send order confirmations, verification codes, and account notifications.
- Hosting & database: all account and order data is stored on servers located in India.
You can request a full list of processors we've shared your specific data with, and what was shared, by contacting our Grievance Officer below (this is your Right to Access under Section 11 of the DPDP Act).
Security & Consent Records
When you agree to this policy or our Terms & Conditions (e.g. at registration or dealer sign-up), we keep a permanent record of that consent — the time, the policy version you agreed to, and the IP address/browser used — so we can demonstrate compliance if ever asked. This record is kept even if you later close your account, as it is evidence of a past event rather than an active profile.
If we ever experience a data breach that risks your personal data, we will notify the Data Protection Board of India and affected users as required under Section 8(6) of the DPDP Act.
How Long We Keep Your Data
- Active Accounts: We keep your profile data only as long as your account is active. If your account is completely inactive for 3 consecutive years, we will send you a 48-hour notice and permanently delete your profile.
- Tax Regulations: While your user profile can be deleted, Indian tax laws require us to securely store business financial invoices and transaction histories for up to 8 years.
- Guest Contact Form Messages: Messages submitted through our contact form without logging in are automatically and permanently deleted 90 days after receipt. We keep a minimal log (that a message was received and later deleted) for compliance recordkeeping, but the message content itself, along with your name, email, and phone number, is erased at that point.
Your Legal Rights
Under the DPDP Act, you have full control over your data. You have the right to access a summary of your data (Section 11), correct or update it, and withdraw consent or request total erasure (Section 12). You can correct your details or request erasure yourself any time from your Account → Privacy & Erasure page, or contact our designated Grievance Officer (Data Protection Team) at customer.care@naturallyours.store for anything else, including access requests.
If you contacted us as a guest (without an account), your message is deleted automatically after 90 days as described above. If you'd like it deleted sooner, email our Grievance Officer at customer.care@naturallyours.store from the same email address you used to submit the message, so we can verify the request relates to your own submission before deleting it.
Security Measures
We implement industry-standard security protocols including encryption, secure servers, and regular audits to protect your data.