Who we are
This website is operated by [registered business name to be confirmed] (“Vastra Vaibhavam”, “we”, “us”), 1-175/4b, Sri Sidhivinayaka Nagar
Near VDO Colony
Kakinada, Kakinada District
Andhra Pradesh 533006. For any privacy question, email vastravaibhavam2026@gmail.com or contact our Grievance Officer (see the end of this policy).
Personal data we collect
- Account data: your mobile number (used to sign in with a one-time code on WhatsApp), and your name if you add it. Store staff accounts also have an email address and password.
- Order and contact data: name, mobile number, delivery address and, if you provide it, an email address; the products you order, prices paid, coupons used and order history; notes you add to an order.
- Payment data: payment status and the payment reference from our payment partner. We do not receive or store your full card number, CVV, UPI PIN or banking passwords.
- Support data: messages, complaints and grievances you send us, and photographs or videos you choose to share for a damage claim.
- Technical data: session and security cookies (see our Cookie Policy), and the IP address and request details our servers log to protect the site against abuse.
We do not use analytics, advertising or social-media tracking on this website.
Why we use your data
- to create and secure your account and sign you in;
- to process, deliver and support your orders, including sending order updates on WhatsApp;
- to process payments, cancellations, refunds and complaints;
- to keep the site secure and prevent fraud and misuse; and
- to meet our legal obligations, such as tax and accounting record keeping and consumer-protection requirements.
We will send you offers or new-arrival messages only if you have opted in (Account › Profile & security). You can opt out at any time. Opting out does not affect order updates.
Legal basis and consent
We process your personal data to provide the services you request (for example, completing your order) and to comply with law, and otherwise with your consent. Where we rely on consent you can withdraw it at any time; withdrawal does not affect processing already carried out, and we may then be unable to provide services that depend on it.
India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 come into effect in phases, with most obligations on businesses applying from May 2027. We are aligning our practices with them and already offer the rights described below.
Who processes or receives your data
We share personal data only as needed to run the store, with service providers that process it for us:
| Provider | Purpose | Data involved |
|---|---|---|
| Razorpay | Online payments and refunds | Order amount, name, mobile number, payment details you enter on Razorpay |
| Meta Platforms (WhatsApp Business) | Sign-in codes and order messages | Mobile number, message content (order number, name, status) |
| Courier partners ([courier partners to be confirmed]) | Delivering your order | Name, delivery address, mobile number |
| Railway | Hosting our website, database and session store (Redis) | All data stored by the website |
| Cloudinary | Hosting product images | None of your personal data |
Some of these providers may process data outside India, under their own security and privacy commitments. We may also disclose information where required by law or to protect our rights or prevent fraud. We do not sell your personal data.
Storage and security
We use reasonable security safeguards, including encrypted (HTTPS) connections, secure and HttpOnly session cookies, hashed one-time codes that expire in five minutes, access controls for staff, and logging of administrative changes. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and will act promptly if an incident occurs.
How long we keep data
- Account data: while your account is active. When you delete your account, we delete your profile and saved addresses.
- Orders and invoices: for as long as tax and accounting laws require (under GST law, generally 72 months from the due date of the relevant annual return), after which they are deleted or anonymised.
- Complaints and grievances: until resolved and for a reasonable period afterwards to deal with follow-up questions and legal claims.
- Sign-in codes: five minutes. Session cookies: up to 14 days.
Your rights
You can ask us to: access a summary of the personal data we hold about you; correct, complete or update it; erase it where we no longer need it (subject to legal retention requirements); and withdraw consent. You can also nominate another person to exercise these rights on your behalf in the event of death or incapacity, and you can raise a grievance with us. Many of these actions are available in Account › Profile & security, including account deletion. For anything else, email vastravaibhavam2026@gmail.com.
Children
Our store is intended for adults. If you are under 18, please use the site with the involvement of a parent or guardian.
Grievance Officer
[grievance officer name to be confirmed], [grievance officer designation to be confirmed]
Email: [grievance officer email to be confirmed]
Phone: [grievance officer phone to be confirmed]
Address: 1-175/4b, Sri Sidhivinayaka Nagar
Near VDO Colony
Kakinada, Kakinada District
Andhra Pradesh 533006
See Grievance Redressal for how to file a grievance.
Changes to this policy
We may update this policy as our services or the law change. The “last updated” date and version at the top of this page show when it last changed.