Privacy Policy
Nuts And Crafts ("NutsAndCrafts", "we", "our") is committed to protecting your personal information. This policy explains what we collect, how we use it, and your rights.
1. What Information We Collect
Information you provide directly:
- Name, email address, phone number, and delivery addresses
- Payment information (we do not store full card numbers — processed by Razorpay)
- Order history and preferences
- Communications you send us (email, WhatsApp, contact forms)
- Account credentials (password is stored as a one-way hash — we cannot read it)
Information collected automatically:
- IP address, browser type, device information
- Pages visited, time spent and products viewed, measured by Google Analytics — with cookies only if you accept them; until then Google receives cookieless signals only
- Cookies (see Section 6)
2. How We Use Your Information
We use your information to:
- Process and fulfil your orders, including sharing necessary details with courier partners
- Send order confirmation, dispatch notification, and delivery updates by email
- Respond to your support queries and refund requests
- Improve our website, product selection, and service quality
- Send marketing emails and promotions — only if you have opted in
- Comply with legal obligations under Indian law (GST records, consumer protection regulations)
We do not use your data for profiling or automated decision-making. If you accept analytics cookies, Google and Meta may use your visits to our site to show you our ads elsewhere; if you choose “Only essential”, they do not.
3. Who We Share Your Information With
We share your data with the following categories of third parties — only as necessary to serve you:
Razorpay (Payment Processor)
Your payment information is transmitted directly to Razorpay's PCI-DSS compliant servers. We receive only a transaction confirmation — not your full card details.
DTDC / BlueDart / India Post (Courier Partners)
Your name, phone number, and delivery address are shared with our courier partners to fulfil your order.
Google (Analytics and Ads) and Meta (Facebook / Instagram)
Only if you accept analytics cookies: the pages you visit and, when you order, the order number, value and products are measured so we can see which content and ads bring genuine shoppers. Your name, address and payment details are never sent. Until you accept, Google receives cookieless signals only and Meta receives nothing.
Google (Sign-in)
Only if you choose Continue with Google: Google tells us your name and verified email address, and sees that you are signing in to NutsAndCrafts. We never receive your Google password.
Hosting and delivery of our service
Supabase (our database), Render (our servers), Vercel (our website) and Microsoft Azure (product and uploaded images) store and process your data on our behalf, under contract, and only to run NutsAndCrafts.
Brevo (Email and SMS)
Your email address, phone number and name are passed to Brevo to send order emails, account emails and, if you opt in, our newsletter, and to text the code that confirms your phone number.
Legal Authorities
We will disclose your information if required by a valid court order, government directive, or to prevent fraud or protect our legal rights.
We do not sell, rent, or trade your personal information to any third party for marketing purposes.
4. How We Protect Your Information
- All data travels between your browser and us over encrypted HTTPS connections
- Passwords are stored as a salted one-way hash (PBKDF2) — we cannot read or recover them
- Payment data is processed by Razorpay on their PCI-DSS Level 1 certified infrastructure
- Our database and file storage are encrypted at rest by their providers (see Section 8)
- Access to customer data is restricted to authorised personnel on a need-to-know basis
Despite these measures, no internet transmission is 100% secure. In the event of a data breach affecting your information, we will notify you and the Data Protection Board of India as the DPDP Act 2023 requires.
5. How Long We Keep Your Information
7. Your Rights
Under the Digital Personal Data Protection Act 2023 (India) and applicable law, you have the right to:
- Access: Request a copy of the personal data we hold about you
- Correction: Request correction of inaccurate or incomplete data
- Erasure: Request deletion of your account and personal data (subject to legal retention requirements)
- Portability: Receive your data in a machine-readable format
- Withdraw consent: Unsubscribe from marketing at any time via the unsubscribe link in emails
- Nominate: Nominate an individual to exercise rights on your behalf in the event of incapacity
To exercise any of these rights, write to us through the contact page. We will respond within 30 days.
8. International Transfers
Your data is stored and processed outside India: our database is hosted by Supabase in Tokyo, Japan, and our servers run on Render in Singapore. Our website is served by Vercel, uploaded images are stored with Microsoft Azure, and Google, Meta and Brevo may process data in other countries. Each provider is bound by contract to protect it, and we transfer data only to countries the Government of India has not restricted under the DPDP Act 2023.
9. Children's Privacy
NutsAndCrafts does not knowingly collect personal data from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, write to us through the contact page and we will delete it promptly.
10. Updates to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users at least 14 days before they take effect. Continued use of NutsAndCrafts after the effective date constitutes acceptance of the updated policy.