Privacy Policy

House of Urban Vastra ("we", "us", "our") is committed to protecting your personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India. This policy explains what data we collect, why we collect it, and your rights as a Data Principal.

1. Data We Collect

We collect only the personal data necessary to provide our services:

• Account information: Name, email address, phone number, password (encrypted).
• Order information: Shipping address, payment method (we do not store card details), order history.
• Communication data: Messages sent via contact forms, reviews, and inquiry submissions.
• Newsletter subscription: Email address and consent timestamp.
• Browsing data: Pages viewed, device type (for analytics and site improvement only).

2. Purpose of Data Collection

Your data is processed only for the following lawful purposes:

• Processing and delivering your orders.
• Communicating about your orders, returns, and inquiries.
• Sending promotional emails (only with your explicit consent).
• Improving our website, products, and services.
• Complying with legal obligations.

3. Consent

We collect your personal data only with your free, specific, informed, and unambiguous consent. You may withdraw your consent at any time by contacting us. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

4. Data Retention

We retain your personal data only as long as necessary to fulfil the purpose for which it was collected, or as required by law. Once data is no longer needed, it is securely deleted or anonymized.

• Order data: Retained for 7 years (tax/legal compliance).
• Account data: Retained until you request deletion.
• Newsletter subscriptions: Until you unsubscribe.
• Contact form messages: 2 years from submission date.

5. Your Rights (Data Principal Rights)

Under the DPDP Act, 2023, you have the right to:

• Access: Request information about what personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data (subject to legal obligations).
• Grievance redressal: Lodge a complaint with our Grievance Officer or the Data Protection Board of India.
• Withdraw consent: Withdraw previously given consent at any time.

6. Data Security

We implement reasonable security safeguards to protect your personal data against unauthorized access, disclosure, alteration, or destruction. This includes encrypted storage, secure HTTPS connections, and role-based access controls.

7. Third-Party Sharing

We share your data only with:

• Supabase (database & authentication provider) — stores your account data and order records securely on cloud infrastructure.
• Razorpay (payment processor) — to process your payments securely. We do not store card details.
• Shiprocket / courier partners (shipping) — to deliver your orders. Only shipping address and contact details are shared.
• Resend (email service) — to send transactional and promotional emails.
• Cloudinary (image hosting) — to store product images and uploaded designs.

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

8. Data Breach Notification

In the event of a personal data breach that is likely to cause harm, we will notify the Data Protection Board of India and affected individuals within 72 hours of becoming aware of the breach, as required by the DPDP Act.

9. Grievance Officer

For any concerns regarding your personal data, you may contact our Grievance Officer:
Email: houseofurbanvastra@gmail.com
We will acknowledge your request within 48 hours and resolve it within 30 days.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of our website after changes constitutes acceptance.

This privacy policy is compliant with the Digital Personal Data Protection Act, 2023 (India).