Privacy Policy

We collect information you provide directly to us, and information generated automatically as part of using our website:

• Account information — your name, email address, and (optionally) phone number when you register for an account.
• Contact information — the name, email, phone number, and message content you submit through our contact form.
• Shipping and billing information — the delivery address, recipient name, and phone number you save to your account or enter at checkout.
• Business/GST information — for business purchases, the legal name, GSTIN, and registered business address you choose to save to your account.
• Order information — the products, quantities, and prices of orders you place, retained as a permanent record of the transaction.
• Payment references — the order reference, payment reference, amount, method and status of your payment, which our payment partner sends us. We never receive your card, UPI or bank credentials.
• Support requests — messages you send us about an order or a product, including any photos you attach, and our replies.
• Account activity — items in your cart and wishlist, and your order history.

• To create and manage your account.
• To process, fulfil, and communicate with you about your orders.
• To take payment and issue refunds through Razorpay, and to arrange delivery through Shiprocket and its courier partners.
• To respond to inquiries submitted through our contact form.
• To send transactional emails related to your account and orders (see "Transactional Emails" below).
• To calculate applicable shipping and GST (Goods and Services Tax) for your order.
• To maintain the security of our website and prevent misuse.

You may create an account and sign in using an email address and password, or using Google Sign-In. If you use Google Sign-In, we receive your name and email address from Google to create your account; we do not receive or store your Google password.

Your session is maintained using a secure, essential cookie set by our authentication provider (see "Cookies" below).

We send email communications that are necessary to operate your account and fulfil your orders, including:

• Email address verification and password reset emails.
• Order confirmation, payment, shipping, delivery and cancellation emails.
• Refund notifications.
• Security notifications, such as confirmation that your password has changed.
• Replies to messages and problem reports you send us.

These emails are sent using Resend, a third-party transactional email delivery service (see "Third-Party Service Providers" below). We do not send marketing or promotional email unless you separately opt in to receive it.

We use a small number of essential cookies set by our authentication provider (Supabase) to keep you signed in and to protect your account. These cookies are required for the website to function correctly for a signed-in user and cannot be disabled while remaining signed in.

We do not currently use analytics, advertising, or third-party tracking cookies.

Payments are processed by Razorpay. When you pay, you enter your card, UPI or netbanking details on Razorpay’s secure payment window, not on our website. We do not collect, see or store those credentials.

Razorpay tells us whether the payment succeeded and gives us a payment reference, the amount and the payment method (for example “UPI”), which we keep with your order so we can confirm it, refund it if needed, and meet our accounting obligations. Razorpay handles your payment data under its own privacy policy.

We share limited information with the following service providers, solely to operate our website and fulfil orders:

• Supabase — our database, authentication, and file storage provider, which hosts your account, order, and product image data.
• Razorpay — our payment partner, which collects and processes your payment and any refund.
• Shiprocket and its courier partners — to deliver your order we share your name, delivery address, phone number and email, and the contents of the parcel, with Shiprocket and the courier that carries it.
• Resend — our transactional email delivery provider, used to send the emails described above.
• Vercel — hosts our website.
• Google — used only if you choose to sign in with your Google account.

We do not sell or rent your personal information to any third party for marketing purposes.

We use industry-standard security practices to protect your information, including encrypted connections (HTTPS), access-controlled database policies that restrict each customer's data to that customer alone, and server-side validation of every request that reads or modifies account or order data.

We retain account and order information for as long as your account remains active, and for as long as necessary to comply with our legal, accounting, and tax record-keeping obligations. Order records are retained as a permanent historical record even if related account details (such as a saved address) are later changed or removed.

You can access and update most of your personal information directly from your account:

• Update your profile, saved addresses, and business/GST profiles at any time.
• Add or remove items from your wishlist.
• View your order history.

To request a copy of your data, ask us to correct inaccurate information, or request deletion of your account, contact us at support@bansalaroma.com. We will respond to verified requests within a reasonable time, subject to our legal and record-keeping obligations (for example, we may need to retain order records for tax purposes even after an account is closed).

We may update this Privacy Policy from time to time as our website and services change. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of our website after a change constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or how we handle your information, contact us at support@bansalaroma.com or through our Contact page. Complaints can also be raised with our Grievance Officer.