Privacy Policy
NutsAndCrafts Pvt. Ltd. ("NutsAndCrafts", "we", "our") is committed to protecting your personal information. This policy explains what we collect, how we use it, and your rights.
1. What Information We Collect
Information you provide directly:
- Name, email address, phone number, and delivery addresses
- Payment information (we do not store full card numbers — processed by Razorpay)
- Order history and preferences
- Communications you send us (email, WhatsApp, contact forms)
- Account credentials (password is stored as a one-way hash — we cannot read it)
Information collected automatically:
- IP address, browser type, device information
- Pages visited, time spent, products viewed (via Google Analytics — anonymised)
- Cookies (see Section 6)
2. How We Use Your Information
We use your information to:
- Process and fulfil your orders, including sharing necessary details with courier partners
- Send order confirmation, dispatch notification, and delivery updates via email and SMS
- Respond to your support queries and refund requests
- Improve our website, product selection, and service quality
- Send marketing emails and promotions — only if you have opted in
- Comply with legal obligations under Indian law (GST records, consumer protection regulations)
We do not use your data for profiling or automated decision-making. If you accept analytics cookies, Google and Meta may use your visits to our site to show you our ads elsewhere; if you choose “Only essential”, they do not.
3. Who We Share Your Information With
We share your data with the following categories of third parties — only as necessary to serve you:
Razorpay (Payment Processor)
Your payment information is transmitted directly to Razorpay's PCI-DSS compliant servers. We receive only a transaction confirmation — not your full card details.
DTDC / BlueDart / India Post (Courier Partners)
Your name, phone number, and delivery address are shared with our courier partners to fulfil your order.
Google (Analytics and Ads) and Meta (Facebook / Instagram)
Only if you accept analytics cookies: the pages you visit and, when you order, the order number, value and products are measured so we can see which content and ads bring genuine shoppers. Your name, address and payment details are never sent. Until you accept, Google receives cookieless signals only and Meta receives nothing.
Legal Authorities
We will disclose your information if required by a valid court order, government directive, or to prevent fraud or protect our legal rights.
We do not sell, rent, or trade your personal information to any third party for marketing purposes.
4. How We Protect Your Information
- All data transmission is encrypted using TLS 1.3 (256-bit SSL)
- Passwords are hashed using bcrypt — we cannot read or recover them
- Payment data is processed by Razorpay on their PCI-DSS Level 1 certified infrastructure
- Our databases are hosted on AWS servers within India with encrypted storage at rest
- Access to customer data is restricted to authorised personnel on a need-to-know basis
- We conduct annual security audits and vulnerability assessments
Despite these measures, no internet transmission is 100% secure. In the event of a data breach affecting your information, we will notify you within 72 hours as required by the DPDP Act 2023.
5. How Long We Keep Your Information
7. Your Rights
Under the Digital Personal Data Protection Act 2023 (India) and applicable law, you have the right to:
- Access: Request a copy of the personal data we hold about you
- Correction: Request correction of inaccurate or incomplete data
- Erasure: Request deletion of your account and personal data (subject to legal retention requirements)
- Portability: Receive your data in a machine-readable format
- Withdraw consent: Unsubscribe from marketing at any time via the unsubscribe link in emails
- Nominate: Nominate an individual to exercise rights on your behalf in the event of incapacity
To exercise any of these rights, email privacy@nutsandcrafts.com. We will respond within 30 days.
8. International Transfers
Our primary data storage is on AWS servers located in India (Mumbai region). Some service providers (e.g., Google Analytics) may process data outside India. We ensure all international transfers comply with applicable data protection law and are subject to appropriate contractual safeguards.
9. Children's Privacy
NutsAndCrafts does not knowingly collect personal data from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, contact us at privacy@nutsandcrafts.com and we will delete it promptly.
10. Contact & Grievance Officer
For any privacy concerns, please contact our Data Protection Officer:
NutsAndCrafts Pvt. Ltd.
Attn: Data Protection Officer
Unit 4B, Sheetal Commerce Centre, Linking Road, Bandra West, Mumbai – 400050
Email: privacy@nutsandcrafts.com
Phone: +91 78899 05600
We will acknowledge your request within 48 hours and resolve it within 30 days. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.
11. Updates to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users at least 14 days before they take effect. Continued use of NutsAndCrafts after the effective date constitutes acceptance of the updated policy.