Privacy Policy
This Privacy Policy explains how EmberAura ('we', 'our', 'us') collects, uses, stores, and protects your personal data when you use our website. We comply with the Information Technology Act 2000, the IT (Amendment) Act 2008, and the Digital Personal Data Protection Act 2023.
1. Data We Collect
- Identity
- Name, email address, phone number, and profile preferences.
- Order data
- Products ordered, quantities, delivery address, payment status, and order history.
- Payment data
- We do not store card numbers, CVV codes, UPI PINs, or bank credentials. Payments are processed by Razorpay, which has its own privacy policy.
- Device & usage data
- IP address, browser type, pages visited, and session duration — collected via server logs and analytics.
- Communication data
- Messages sent through our contact form or complaint system.
- Marketing consent
- Whether you have opted in to receive marketing emails, with a timestamp and version number of the consent wording.
2. How We Use Your Data
- To process and fulfil your orders.
- To send order confirmations, shipping updates, and invoices.
- To handle complaints and customer service requests.
- To send marketing emails if you have opted in (you can unsubscribe at any time).
- To comply with Indian tax law (GST records, invoices).
- To improve our website and services.
- To detect and prevent fraud.
3. Data Sharing
We share your data only as necessary:
- Razorpay
- Payment processing. See razorpay.com/privacy.
- Courier partners
- Your name, phone number, and delivery address for dispatch.
- Supabase
- Our database and authentication provider (data hosted in AWS ap-south-1, India region).
- Sentry
- Anonymised error monitoring. No personal data is intentionally sent.
- Legal authorities
- If required by law or a valid court order.
We do not sell your personal data to any third party.
4. Data Retention
- Account data
- Retained while your account is active. Deleted within 30 days of an account deletion request.
- Order data
- Retained for 8 years as required by Indian GST law.
- Marketing consent records
- Retained for 5 years to demonstrate compliance.
- Server logs
- Retained for 90 days.
5. Your Rights
Under the Digital Personal Data Protection Act 2023, you have the right to:
- Access a summary of the personal data we hold about you.
- Correct inaccurate personal data.
- Request erasure of your data (subject to legal retention requirements).
- Withdraw your marketing consent at any time.
- Lodge a complaint with the Data Protection Board of India.
To exercise these rights, email us at emberaura09@gmail.com or use the 'Your data' section in your account.
6. Cookies
We use cookies strictly necessary for the site to function (session management, cart). We do not use advertising or cross-site tracking cookies. See our Cookie & Tracking Notice for details.
7. Security
We use industry-standard security measures including HTTPS, password hashing, and row-level security on our database. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security but take every reasonable precaution.
8. Changes to this Policy
We will notify you by email if we make material changes to this policy. Continued use of the site after the effective date constitutes acceptance.
9. Contact
For privacy-related questions: emberaura09@gmail.com, 7355968487.
Registered address: House no 224 X, Sports college road, Krishna puri colony, In front of ganpati hotel, Gorakhpur, Uttar Pradesh – 273013. GSTIN: 09GBLPS2086E1Z6.