Privacy Policy

Kalamkari House (“we”, “us”, “our”) is committed to protecting the privacy of everyone who visits kalamkarihouse.in or places an order with us. This policy explains what personal information we collect, why, how long we keep it, and the rights available to you under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”).

1. What we collect, and why

We do not store your card, UPI, or net-banking details on our own servers — all payment processing is handled directly by our payment partner, Razorpay, under its own security standards. We do not receive your Google password or access any other Google service on your behalf.

2. The basis for processing your data

Most of what we collect is data you give us voluntarily for a clear purpose — creating an account or placing an order — which the DPDP Act recognises as a legitimate use without needing a separate consent form for every field. Where processing isn't strictly necessary to run the store, such as the analytics cookie described in our Cookie Policy, or a future Google Ads tag, we ask for your consent first via the cookie banner shown on your first visit, and you can decline or change your answer at any time as explained there.

3. Sharing with third parties

We share only what is necessary to fulfil your order: your name, address, and phone number with our shipping partner for delivery, and payment details directly with Razorpay to process your payment. We also use Supabase for secure file storage and Resend to deliver transactional emails (order confirmations, shipping updates). These partners are contractually required to use your information only for the service they provide us. We do not sell or rent your personal information to anyone.

To keep automated programs from guessing passwords or flooding our forms, the sign-in, registration, password-reset and contact pages use Cloudflare Turnstile, a privacy-focused security check. When it runs, Cloudflare receives technical details of your browser and your IP address to tell people from bots; it is used for that purpose only, and it shows no puzzles or advertising. For the same reason we briefly keep a count of attempts against your IP address and the email being tried, and delete it automatically within a few hours.

We post our products on social media (Instagram, Facebook, Threads, Pinterest, YouTube, Snapchat, X and Google Business) and list them on Google Shopping, Meta and Pinterest catalogs. Only product details and photos are sent there; no customer information is. If you comment on one of our posts, your public name and comment are shown to us so we can reply, as on any public post.

Right after you pay, Google may show a box offering to email you a short survey about your order (Google Customer Reviews). To show it, your email address, order number, country and expected delivery date are passed to Google. Google uses them to send the survey only if you agree in that box, under Google's own privacy policy; your ratings become our shop's rating on Google. If you declined optional cookies, the box isn't shown.

Some of these providers' infrastructure may be located outside India. The DPDP Act permits this kind of cross-border processing except to countries the Indian government specifically restricts, none of which are involved here.

4. How long we keep it

Account and order records are retained as long as your account is active, or as required to meet our legal and tax recordkeeping obligations. When you delete your account, your email, mobile number and saved addresses are erased and your name is removed from the account, but the order history itself is kept (see Section 5). The one exception is a GST tax invoice for an order you paid for: Indian GST law requires us to keep invoices, including the name, delivery address and any GSTIN printed on them, for 72 months from the due date of that year's annual GST return (about seven to eight years). Those invoice details are visible only to authorised staff and are erased automatically when that period ends. Passwords are stored using industry-standard one-way hashing and are never visible to our staff. Access to customer and order data within our back-office is restricted to authorized Admin and Store-staff accounts only.

5. Your rights

• Access & correction — review and update your name and mobile number any time from Account Settings.
• Download your data — get a copy of everything tied to your account as a file, from Account Settings.
• Erasure — permanently delete your account's personal details from Account Settings. Past orders are kept with personal details removed, except the name and address on a GST invoice, which the law requires us to keep for the period described in Section 4.
• Withdraw consent — change your cookie choice at any time as described in our Cookie Policy.
• Nominate — you may nominate another individual to exercise these rights on your behalf in the event of death or incapacity, by writing to us.
• Grievance redressal — see Section 6 to raise a complaint about how your data is handled.

6. Grievance Officer

Under the DPDP Act, complaints or questions about how your personal data is handled can be raised with our Grievance Officer:

Manager, Kalamkari House
Email: care@kalamkarihouse.in
Phone: +91 9494139351
We aim to acknowledge and respond within 7 business days.

7. If something goes wrong

In the unlikely event of a personal data breach, we will notify affected customers and the Data Protection Board of India as required under the DPDP Act, and take reasonable steps to contain and remediate the issue.

8. Contact us

For any privacy-related questions or requests, write to us at care@kalamkarihouse.in or call +91 9494139351.