The promise in one paragraph

We collect the minimum we need to sell you clothes and get them to your door, we never sell your data to anyone, and every third party that touches your information does so to perform a function you asked for — payment, delivery, or messages about your own order. This page lists everything we hold, why, for how long, and how to have it corrected or erased. It is written to be read; if anything is unclear, ask us and we will answer plainly.

The data controller is Nitara Shankar, C-56, Anand Vihar Railway Colony, Ramnagariya Road, Jagatpura, Jaipur, Rajasthan 302017. Contact for all privacy matters: hello@nitarashankar.com.

What we collect and why

Account data — name, email, phone, password (stored only as a salted hash; we cannot read it): to operate your account and orders. Address data — delivery addresses and pincodes you save: to deliver and to quote shipping accurately. Order data — items, amounts, timestamps, invoices: to fulfil contracts and meet tax law. Payment data — we hold only the Razorpay reference and status; card and UPI credentials go directly to Razorpay and never touch our servers. Communication data — your WhatsApp and email threads with us: to serve you and to keep a record of what was promised. Technical data — the cookies and identifiers described in the Cookie policy: to keep you signed in, keep your cart, and understand aggregate site usage.

We do not collect data we do not use: no birthdays for fake greetings, no location tracking, no contact-list access, no advertising identifiers.

Who your data is shared with

Razorpay processes payments and holds card data under PCI-DSS; Shiprocket and its courier partners receive your name, address and phone to deliver parcels; Amazon SES carries our transactional email; Meta's WhatsApp Business platform carries order messages when you contact us or opt in to updates; our infrastructure (application, database, backups) runs on servers we control on Oracle Cloud in India with Cloudflare in front for security and speed. Each of these receives the minimum needed for its task and is bound to use it for nothing else. We have never sold personal data and never will; there are no data brokers, no ad-network pixels, and no 'partners' receiving marketing lists.

Retention

Order and invoice records are kept as long as Indian tax and accounting law requires. Account data lives while your account does; delete the account and personal fields are erased or anonymised within 30 days, save what those laws compel us to keep. Support threads are retained for two years so that promises made to you remain checkable, then purged. Backups roll on a fixed cycle and expire automatically; erased data leaves backups as the cycle turns.

Your rights

Ask and we will: show you the personal data we hold on you (access); fix anything wrong (rectification); erase what law does not force us to keep (erasure); stop non-essential processing such as review requests (objection); and hand you your order history in a portable format (portability). Requests go to hello@nitarashankar.com from the email on the account, and are answered within 30 days, usually much faster. You also have the right to complain to the relevant Indian data-protection authority; we would appreciate the chance to fix things first.

We comply with India's Digital Personal Data Protection Act, 2023 as its provisions come into force, and this page will track that law's rules as they crystallise.

Security

All traffic to the site is encrypted in transit; passwords are hashed; database access is restricted, logged and reachable only through a private tunnel; payment credentials are never ours to lose because they never reach us. No system is unbreachable, but ours is small, patched and watched — and if a breach ever touches your personal data we will tell you promptly, plainly, and with exactly what it means for you.

Children: the site sells adult occasion wear and is not directed at children under 18; we do not knowingly collect their data, and a parent's note to our email will remove any that slipped in.

Cookies and messaging, cross-referenced

The Cookie policy inventories every cookie and local-storage key the site sets, and is deliberately short because the list is deliberately short. WhatsApp deserves its own note here: when you message us, Meta processes that conversation under its own terms as the platform operator; we hold the thread's content as part of your customer record, use it to serve you, and never export it into marketing lists. Transactional emails ride Amazon SES with DKIM authentication so that mail claiming to be from us verifiably is; we will never email you asking for your password or full card number, and any such message is a forgery worth reporting to us.

Order notifications carry your order data by necessity; account-recovery links expire quickly and can each be used once. If you receive a message about an order you did not place, contact us immediately — it is either a typo'd address or something we want to know about within the hour.

Changes to this policy

When our practices change, this page changes first, with material changes flagged by a dated note at the top for ninety days. Continued use after a change is acceptance of it, but we do not play that clause as a trick: anything that expands what we collect or who receives it will be announced on the site banner, not buried. The version governing any question is the one published when the relevant data was collected. Yearly, we re-read this page against the running system and delete promises that have drifted from practice or practice that has drifted from promise — a privacy policy is maintenance, not decoration.

Data location and access, concretely

Your data lives on infrastructure we operate in India — application, database and encrypted backups — with Cloudflare providing security and delivery in front of it. Access to production data is restricted to the people who need it to run the store, reachable only through an authenticated private tunnel, and every administrative session is logged. Payment credentials are absent from our systems by design: the strongest protection we can give your card number is never to possess it. Backup copies are encrypted at rest and expire on a fixed cycle. When we retire hardware or rotate providers, storage is wiped to industry standards before it leaves our control. None of this is exotic; it is the ordinary hygiene a store owes the people who trust it with an address and a phone number.

Grievance officer

Questions, corrections or complaints about how your personal data is handled go to our Grievance Officer, Priyanka: phone and WhatsApp +91 86961 55551, email hello@chhayashankar.com, or by post to Nitara Shankar, C-56, Anand Vihar Railway Colony, Ramnagariya Road, Jagatpura, Jaipur, Rajasthan 302017. Complaints are acknowledged within 48 hours and resolved within one month.