Privacy Policy

Introduction

This policy explains what personal information Thota Vaikuntam Art LLP collects when you use thotavaikuntam.in, why we collect it, who we share it with and how long we keep it. We have written it to follow the principles of India’s Digital Personal Data Protection Act, 2023, and we will update it as the rules under that Act come into force.

What we collect

When you place an order: your name, email address, phone number and delivery address; the prints you ordered and the amount paid; and the order and payment identifiers that Razorpay gives us, together with the payment method type (for example card or UPI). We never receive or store your card number, CVV, UPI PIN or bank login.

When you use the contact form or email us: your name, email address and the contents of your message.

Automatically: our hosting provider keeps standard server logs (IP address, browser type, pages requested and time) for security and troubleshooting; we do not use them to identify or profile you. To prevent fraud and abuse, our server also records a salted one-way hash of your IP address rather than the address itself. The hash is stored with each order. It is also used, together with a similar hash of your email address when you use the contact form, in short-lived request counters; counters more than a day old are periodically deleted.

We collect nothing else. There is no account system on this website.

Why we use it

To process and deliver your order, send confirmations and shipping updates, issue invoices and certificates, answer your messages, process refunds, prevent fraud, resolve disputes and meet our tax and accounting obligations under Indian law. We do not send marketing emails [CONFIRM: whether a newsletter is planned] and do not use your information for automated decision-making.

Who we share it with

We share personal information only with the service providers we need to run the shop, and only what each one needs.

Razorpay processes payments; you enter payment details directly with Razorpay under its own privacy policy, and it sends us only the identifiers described above.

Vercel hosts the website and runs the server code that handles orders and contact messages, so that data passes through its systems. The server code runs in Vercel’s Mumbai region; the website’s pages and images are delivered from Vercel’s global network.

Supabase stores our order database in its Mumbai region.

Resend sends our transactional emails and delivers contact form messages to us, and so handles your email address and the contents of those emails [CONFIRM: Resend stores data in the United States].

Our courier partner receives your name, phone number and address to deliver your print [CONFIRM: courier name].

Outside the shop, the map on the Heritage Walk page is built from map images loaded directly from Esri’s ArcGIS servers, so Esri receives your IP address and the usual technical details of those requests, under its own privacy policy.

We may also disclose information where the law requires it, for example to tax authorities, or to establish or defend legal claims. We never sell, rent or trade personal information or share it with advertisers.

Cookies and tracking

This website sets no cookies and uses no analytics, advertising pixels or social media trackers. Two things are stored in your browser, on your own device. Your shopping cart (the prints and quantities you have chosen) is kept in local storage; it is not sent to us until you check out, and you can clear it through your browser settings. After you pay, or when you open the link in your order email, the order page keeps your order reference and its private access key in session storage, so that it can show your order without leaving them in the address bar; your browser deletes them when you close the tab. Razorpay Checkout may set its own cookies while you pay; see Razorpay’s privacy policy.

How long we keep it

Order records, including your name, address and invoice, are kept for 8 years after the end of the financial year of the order, because Indian tax and accounting law requires it [CONFIRM the retention period with our accountant]. For checkouts started but never paid for, your name, email address, phone number, delivery address and the hash of your IP address are deleted after 30 days [CONFIRM]; only an anonymous record of the attempt is kept. Contact form messages are kept for 24 months. Server logs are kept for the short period set by our hosting provider [CONFIRM]. Razorpay keeps payment records for as long as its own regulations require.

How we protect it

Payment is taken on Razorpay’s hosted checkout, so sensitive payment data never touches our systems. All traffic to the website is encrypted in transit. The order database cannot be reached from the public internet; only our server functions can read or write it, using credentials that are never sent to your browser. Access to those credentials and to our provider accounts is limited to the people who run the shop and protected by two-factor authentication. No system is perfectly secure; if a breach affects your information we will tell you as the law requires.

Your rights

You can ask what information we hold about you and who we have shared it with, ask us to correct, complete or update it, or ask us to delete it, except where the law requires us to keep it (for example, tax records of a completed order). You can withdraw consent for anything that depends on it, and you can nominate another person to exercise these rights on your behalf if you die or become unable to do so. Email info@thotavaikuntam.in from the address used on your order; we respond within 30 days [CONFIRM]. [CONFIRM: name of the person responsible for privacy requests.] If you have a complaint about how we handle your information, please raise it with us first, as the law requires; if we do not resolve it, you can complain to the Data Protection Board of India.

Children

This website is not directed at children and we do not knowingly collect information from anyone under 18; if you believe a child has given us personal information, contact us and we will delete it.

Changes

We may update this policy; the date at the top shows when it last changed.

Contact

Thota Vaikuntam Art LLP, [CONFIRM: registered office address], info@thotavaikuntam.in.