Privacy Policy
AryaStack
Who we are
AryaStack ("we") decides why and how your personal data is processed and is the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 (DPDP Act). This policy explains what we collect, why, who receives it, and the rights you have.
1. What we collect and why
- Account details (name, email, phone, password hash) — to create and secure your account.
- Orders and delivery details (addresses, items, payment status) — to fulfil orders you place, issue tax invoices and handle returns. We never store card numbers or CVVs; payments are handled by our payment gateway.
- Support conversations — to answer your queries.
- Cart and wishlist — to save what you selected.
- Device and error diagnostics (IP address, device and browser type, crash details) — to keep the service secure and working.
- Analytics and advertising cookies and marketing emails — only if you opt in (see below).
We process this data because you asked us to provide a service, because the law requires it (for example tax records), or — for the optional items above — because you consented.
2. Consent, and how to withdraw it
- Analytics and advertising cookies (Google Analytics, Meta Pixel) load only after you accept them. Change your mind any time via Cookie settings in the page footer.
- Marketing emails: use the unsubscribe link in any email, or the newsletter page.
- Push notifications (mobile app): turn them off in the app or in your phone's settings.
Withdrawing consent is as easy as giving it and does not affect what we did before you withdrew.
3. Who receives your data
We do not sell your personal data. We share what is necessary with these service providers:
| Recipient | Why | Data shared | Processed |
|---|---|---|---|
| Razorpay | Payment processing and refunds | Name, email, phone, order amount | India |
| Courier / logistics partners | Delivering and returning your orders | Name, phone, delivery address, order contents | India |
| Email delivery provider (SMTP or Resend) | Order, account and (with consent) marketing emails | Name, email address, message content | Outside India |
| Cloudflare | Media storage (R2) and content delivery | Uploaded images, request metadata (IP address) | Outside India |
| Expo Push Notification service | Delivering mobile app push notifications (only if you enable them) | Device push token, notification content | Outside India |
| Sentry | Diagnosing application errors | Error details, IP address, device/browser information | Outside India |
| Google Analytics and Meta Pixel | Website analytics and advertising measurement (only if you accept analytics cookies) | Browsing activity, device identifiers, IP address | Outside India |
We may also disclose data when required by law or a court or government order.
4. Transfers outside India
Some providers above (Email delivery provider (SMTP or Resend), Cloudflare, Expo Push Notification service, Sentry, Google Analytics and Meta Pixel) process data outside India. The DPDP Act allows this except to countries the Government of India restricts.
5. How long we keep it
- Order and tax-invoice records are kept for the period the law requires.
- Carts you leave idle are deleted after about 90 days.
- Accounts left unused for a long time may be erased after we email you first, giving you time to sign in and keep the account.
- Everything else is erased when you delete your account, unless the law requires us to keep it.
6. Your rights
- Access: download a copy of your data from Account → Profile → Download my data, including the list of who we share it with.
- Correction and updating: edit your details in Account → Profile.
- Erasure: delete your account from the same page or via our account deletion page. Personal details, addresses, cart, wishlist, notification tokens and sign-in data are erased. Past order and invoice records (which include the delivery details on them) are kept because the law requires it, and we keep a record of your consent choices as proof, with your email anonymised.
- Grievance redressal: contact the officer named below.
- Nominate someone to exercise these rights for you if you die or become unable to: email support@example.com.
7. Children
Accounts are for people aged 18 or over, and you confirm this when you sign up. We do not knowingly collect children's data or track or advertise to children. If you believe a minor has an account, tell us and we will erase it.
8. Security and breaches
We protect data with access controls, encrypted connections and hashed passwords. If a personal data breach affects you, we will tell you what happened, the likely consequences, what we are doing and what you can do — and we report it to the Data Protection Board of India as the law requires.
9. Questions
Email support@example.com. For formal complaints, see the Grievance Officer below.
Grievance Officer
Published under the Consumer Protection (E-Commerce) Rules, 2020 and the Digital Personal Data Protection Act, 2023. Contact this person with any question about your personal data or to exercise your data rights.
- Email:
- support@example.com
If we do not resolve your complaint about how we handle your personal data, you may complain to the Data Protection Board of India. The Board expects you to have raised the matter with us first.