Privacy Policy

We collect the following categories of information:

• Account Information: When you register, we collect your name, email address, and optionally your phone number. If you sign in with Google, we receive only the profile data you have made public on that account.
• Order Information: Shipping address, billing details, order history, and product preferences associated with each purchase.
• Payment Information: We do not store your card numbers or UPI IDs. All payment data is handled exclusively by our payment partner (Razorpay), which is PCI-DSS compliant.
• Device and Usage Data: IP address, browser type, operating system, pages visited, time spent, and referring URL, collected automatically via cookies and analytics.
• Communications: Messages you send to us via email, contact forms, or WhatsApp, for the purpose of support resolution.

We use your data only for legitimate, necessary purposes:

• Processing and fulfilling your orders, including dispatch confirmations and tracking.
• Sending transactional notifications via email or WhatsApp (e.g., order placed, shipped, delivered).
• Managing your account and providing personalised features such as saved addresses and order history.
• Responding to your support enquiries and resolving complaints.
• Improving our website, products, and services based on aggregated usage analytics.
• Sending promotional emails or offers, only if you have explicitly opted in. You can unsubscribe at any time via the link in any marketing email.
• Complying with applicable laws, regulations, and legal proceedings.

We use cookies and similar technologies to improve your browsing experience and collect analytical data. Cookies fall into three categories:

• Essential cookies: Required for the website to function (e.g., your shopping cart, authentication session).
• Analytics cookies: Help us understand how visitors use our site (e.g., which pages are most visited).
• Preference cookies: Remember your settings and choices to personalise your experience.

You can manage or disable non-essential cookies through your browser settings. Note that disabling essential cookies may affect site functionality.

We do not sell, rent, or trade your personal information. We share data only with trusted third-party service providers who assist us in operating our business:

• Payment gateway (Razorpay): Processes your payment securely. Subject to Razorpay's own Privacy Policy.
• Shipping partners: Your name and delivery address are shared with our courier partner to fulfil your order.
• Authentication provider (Supabase / Google): Manages secure sign-in on our behalf.
• Analytics (e.g., Vercel Analytics): Anonymised usage data only; no personally identifiable information is shared.

All third-party partners are contractually required to handle your data securely and solely for the purposes described above.

We retain your personal data for as long as your account is active or as needed to provide services. Order records are kept for a minimum of 5 years as required by Indian tax regulations (GST compliance). You may request deletion of your account and associated data at any time, see Section 7 for your rights.

We implement industry-standard security measures to protect your personal information:

• All data in transit is encrypted via TLS/SSL.
• Authentication uses secure OAuth 2.0 (Google Sign-In) and Magic Link / OTP flows, so no passwords are stored by us.
• Database access is restricted to authenticated, role-based personnel only.

No method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a data breach that poses a risk to your rights, we will notify you promptly in accordance with applicable law.

Under the Information Technology Act, 2000 and allied rules (and applicable data protection guidelines), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data via your account profile.
• Delete your account and associated personal data (subject to legal retention obligations).
• Opt out of marketing communications at any time by clicking the unsubscribe link in any email.
• Withdraw consent where processing is based on your consent (this does not affect processing already carried out).

To exercise any of these rights, email us at hello@jewelboxbyannesha.com. We will respond within 30 days.

Our services are not directed to children under the age of 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For significant changes, we will notify registered users via email. Your continued use of the website after the changes take effect constitutes your acceptance of the revised policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please reach out:

• Email: hello@jewelboxbyannesha.com
• Support: Contact Us page