Privacy Policy

What we collect, why we collect it, and the control you have over your information.

Last updated: 27 October 2026

This Privacy Policy explains how [Business legal name] (“Hitayu”, “we”, “us”), with its registered address at [Registered address] [GSTIN, if applicable], collects and uses your personal data when you visit our website, create an account or place an order. We follow the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000 and the rules made under it. By using our website and giving us your information, you agree to the practices described here.

1. Information we collect

  • Identity and contact details: your name, mobile number and email address.
  • Delivery and billing details: shipping address, pincode and any delivery instructions you give us.
  • Account details: your login method (mobile OTP or email and password). Passwords are handled by Firebase Authentication and are never visible to us.
  • Order information: items ordered, order value, payment method used (UPI, card, net banking or Cash on Delivery), payment status, delivery and refund history.
  • Payment information: payments are processed by Razorpay. Your card, UPI or net banking details are entered on Razorpay’s secure checkout and are never stored on our servers. We receive only a payment reference and the payment status.
  • Device and usage data: pages viewed, approximate location, browser, device type and similar information collected through cookies and Google Analytics for Firebase, only if you accept analytics cookies.
  • Communications: messages you send us by email, phone or WhatsApp, such as support or refund requests.

2. How and why we use your data

  • To create and manage your account, and to verify you through OTP.
  • To process, confirm, pack, ship and deliver your orders, and to verify Cash on Delivery orders.
  • To handle payments, cancellations, returns and refunds.
  • To send order updates and service messages by SMS, email or WhatsApp.
  • To respond to your questions and complaints.
  • To prevent fraud, misuse and fake orders, and to keep our website secure.
  • To understand how the shop is used and improve it (analytics), only with your consent.
  • To meet legal, tax and accounting obligations.

We do not sell your personal data.

3. Legal basis and consent

We process your data on the basis of your consent (for example, when you create an account, place an order or accept analytics cookies) and for certain legitimate uses permitted under the DPDP Act, such as fulfilling an order you have asked for, complying with the law, and preventing fraud. You may withdraw your consent at any time as described in section 8. Withdrawal does not affect processing already done, and some services (such as delivering an order) cannot be provided without the relevant data.

4. Who we share data with

We share data only with service providers who help us run the shop, and only as much as they need:

  • Google Firebase and Google Analytics for Firebase (Google LLC): hosting, authentication, database storage and analytics. Our order and account data is stored in Firestore in India (asia-south1, Mumbai).
  • Razorpay: payment processing for UPI, cards and net banking. Razorpay’s own privacy policy applies to the payment details you give them.
  • Courier partners (such as Delhivery): your name, phone number and delivery address, so that they can deliver your parcel.
  • Email and messaging providers: to send order confirmations and updates.
  • Authorities: where required by law, court order or to protect our legal rights.

Some of these providers may process data outside India. We choose providers that maintain reasonable security safeguards.

5. Cookies and analytics

We use essential cookies and local storage to keep you signed in, remember your cart and make checkout work. With your consent, we also use analytics (Google Analytics for Firebase) to understand which pages are popular and how the shop performs. When you first visit, we show a cookie banner where you can choose “Accept” or “Only essential”. If you choose “Only essential”, analytics stays off.

You can change your choice at any time by clicking the “Cookie settings” link in the footer of any page. You can also clear cookies from your browser settings.

6. How long we keep your data

  • Account data: for as long as your account is active, and until you ask us to delete it.
  • Order, invoice and payment records: up to 8 years, or as long as tax and accounting laws require.
  • Support messages: up to 2 years after the matter is closed.
  • Analytics data: according to Google Analytics retention settings, generally up to 14 months.

When data is no longer needed, we delete it or remove anything that identifies you.

7. How we protect your data

We use reasonable security practices, including encrypted connections (HTTPS), access controls on our database and OTP-based verification. No system is completely secure, so we cannot guarantee absolute security. Please keep your login details private.

8. Your rights

Under the DPDP Act you have the right to:

  • access a summary of the personal data we hold about you and who we share it with;
  • correct inaccurate or incomplete data;
  • erase your data, unless we must keep it by law;
  • withdraw consent at any time;
  • raise a grievance and have it addressed; and
  • nominate another person to exercise your rights in case of your death or incapacity.

To use any of these rights, write to us at care@hitayu.store from the email address or mobile number linked to your account. We may need to verify your identity first.

9. Grievance Officer

If you have a concern about how your data is handled, please contact our Grievance Officer:

  • Name: [Grievance Officer name]
  • Email: care@hitayu.store
  • Phone: [Support phone]
  • Address: [Registered address]

We will acknowledge your complaint and aim to resolve it within 30 days of receiving it. If you are not satisfied, you may approach the Data Protection Board of India once it is operational.

10. Children

Our website is not directed at anyone under 18 years of age. We do not knowingly collect personal data from children. If you are a parent or guardian and believe a child has given us data, please contact us and we will delete it.

11. Third-party links

Our website may link to other sites, such as social media pages. We are not responsible for their privacy practices, so please read their policies.

12. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows when it was last changed. If we make significant changes, we will give notice on the website. Continuing to use the shop after changes means you accept the updated policy.

13. Contact us

[Business legal name], [Registered address]
Email: care@hitayu.store
Phone: [Support phone]