Privacy Policy

EverycultureLabs ("we") is the data fiduciary for personal data processed through EverycultureLabs, under the Digital Personal Data Protection Act, 2023. This policy explains what we collect, why, who we share it with, and your rights.

1. What we collect

• Account: name, email, phone number, password (stored only as a secure hash).
• Orders: delivery address, items, amounts, coupons, and a GSTIN and business name if you add them for a business invoice.
• Problem reports: your description and any photos you upload.
• Messages: what you send through contact forms or to brands.
• Technical: cookies that keep you signed in, your saved PIN code, and security checks that protect sign-in from bots.

We don't collect or store your full card, UPI or bank details.

2. Why we use it

To run your account, take payment, route your order to a seller, deliver it, issue invoices, handle problem reports and refunds, prevent fraud, meet tax and legal obligations, and improve the marketplace. We don't sell your personal data or use third-party advertising trackers.

3. Who we share it with

• The seller fulfilling your order sees your name, phone and delivery address, only after they accept your order.
• Payment partner (Razorpay) to process payments and refunds.
• Courier partners (through Shiprocket, our logistics aggregator) to deliver your order and show you its tracking.
• Infrastructure providers that host the site and its database (Cloudflare, Supabase), under contracts that limit their use of your data.
• Authorities when the law requires it.

4. How long we keep it

We keep account data while your account is open. Order and invoice records are kept for as long as tax law requires (currently at least six years). Problem-report photos are kept until the report is resolved and any related claim period has passed.

5. Security

Data is encrypted in transit and at rest. Access inside the platform is restricted by role, staff accounts require two-factor sign-in, and administrative changes are logged.

6. Your rights

You can ask to access a summary of your personal data, correct or update it, or erase it (subject to records we must keep by law). You can withdraw consent, nominate someone to exercise your rights if you can't, and raise a grievance with us. If you're not satisfied with our response, you may complain to the Data Protection Board of India.

7. Children

The site isn't meant for children under 18 without a parent or guardian's involvement.

8. Changes

We'll update the date above when this policy changes and tell you about significant changes.

9. Contact and grievances