Gulmora

Privacy Policy

Last updated: {LAST_UPDATED}

This Privacy Policy explains how {BUSINESS_NAME} (“Gulmora”, “we”, “us”) collects, uses, shares, and protects your personal data when you use our website and services. We are committed to handling your data in accordance with India’s Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Data we collect

  • Contact details: name, mobile number, email address, and delivery address.
  • Order and payment information (payments are processed by Razorpay; we do not store card details).
  • Communications and consent preferences, including WhatsApp opt-in status.
  • Technical data: anonymous session identifier, device/browser information, and usage analytics.
  • If you use photo-upload search, the image you upload — retained no longer than 24 hours and then automatically deleted.

2. How we use your data

  • To process, fulfil, and deliver your orders and issue GST-compliant invoices.
  • To send transactional updates (order confirmation, shipping) over email and WhatsApp.
  • To provide customer support and handle returns or replacements.
  • To improve our catalogue, search, and website experience using aggregated analytics.

3. WhatsApp communications & consent

Transactional messages (order and delivery updates) are sent as part of fulfilling your order. Marketing or promotional messages on WhatsApp are sent only if you have given explicit consent at checkout or elsewhere. Your consent is recorded with a timestamp and source. You may withdraw consent at any time by replying STOP on WhatsApp or by contacting us at {SUPPORT_EMAIL}.

4. Sharing your data

We share data only with service providers necessary to run the store — payment gateway (Razorpay), shipping/logistics partners, SMS/WhatsApp providers, and email delivery — each bound to process data only on our instructions. We do not sell your personal data.

5. Data retention

We retain order and invoice records for as long as required by tax and accounting law. Uploaded search images are deleted within 24 hours. Analytics identifiers expire within one year.

6. Photo-upload search

If you search by photo, the image you upload is used solely to find visually similar products in our catalogue. Uploaded photos are stored for a maximum of 24 hours and are then deleted automatically. We do not use these images for any other purpose.

7. Your rights (DPDP Act)

  • Access and correction of your personal data.
  • Erasure of your data, subject to legal retention requirements.
  • Withdrawal of consent for marketing communications.
  • Grievance redressal through our Data Protection contact.

To exercise any of these rights, including data deletion, contact our Grievance Officer at {GRIEVANCE_OFFICER_NAME}, {SUPPORT_EMAIL}, {SUPPORT_PHONE}. We will respond within the timelines prescribed by law.

8. Security

We use industry-standard safeguards to protect your data. No method of transmission over the internet is fully secure, but we work to protect your information and review our practices regularly.

9. Contact

{BUSINESS_NAME}, {BUSINESS_ADDRESS}. GSTIN: {GSTIN}. Email: {SUPPORT_EMAIL}. Phone: {SUPPORT_PHONE}.