Privacy Policy

What We Collect

We collect only what is needed to sell you a candle and get it to your door:

• Your name, email address, phone number and delivery address, so the order can be placed and delivered.
• Your order history, so you can see past orders, invoices and returns.
• Payment status and the last few digits of the instrument used. Full card numbers, UPI credentials and bank passwords never reach our servers - they are handled by the payment gateway.
• The IP address, device and approximate location of a sign-in and of an order, which is a fraud and account-security control.
• Basic usage data about which pages are visited and what is typed into the search box, so we know what to stock and what to fix.

Why We Collect It

Order and delivery data is processed because it is necessary to perform the contract you enter when you place an order, and because tax and consumer law require us to keep records of a sale.

Marketing email is sent only where you have opted in. That consent is asked for separately from the order and is never bundled into the checkout - agreeing to buy a candle is not agreeing to be emailed about the next one.

Who Else Sees It

We do not sell your personal data, and we do not share it for anyone else's advertising. It is shared only with the parties that make the order work, and only with the part of it they need:

• The courier, which receives your name, address and phone number so it can deliver the parcel.
• The payment gateway, which receives the amount and the order reference and handles the payment instrument itself.
• Our email and messaging providers, which send order confirmations and delivery updates.
• A government authority or a court, where the law requires it.

Cookies

Strictly necessary cookies keep you signed in and keep your cart intact between pages. They cannot be switched off without breaking the site, and they are not used to track you.

Any analytics cookie is set only after you accept it in the consent banner, and you can change or withdraw that choice at any time. Declining costs you nothing on the site.

How Long We Keep It

Order records, invoices and tax documents are kept for 8 years from the end of the financial year of the sale, because Indian tax law requires it. That period cannot be shortened on request. It is also a limit rather than only a minimum: once those 8 years are up, the whole financial year is deleted.

An account that is deleted has its profile, addresses and marketing consent removed. The order records behind it are retained for the statutory period with the personal details reduced to what the law requires us to hold.

Sign-in and device logs are kept for 12 months as a security control, then deleted.

Search terms typed into the site are kept for 6 months, then deleted.

A one-time code or a sign-in link - an OTP, a password reset, an email verification - stops working within minutes or hours. The record of it is deleted 14 days after that, which is long enough for us to look into a code you did not ask for.

The record of an email or message we sent you, and the payment details your bank, card or UPI app sends back to us, are kept for 24 months so that a delivery or payment dispute can be settled. After that the address we sent to and those payment details are removed. The order and its invoice remain for the 8 years above.

An enquiry or a message you send us through a form on this site is kept for 24 months from the last time anyone here worked on it, then deleted. Gifting and wholesale enquiries run to an annual cycle, so we keep two of them in order to answer you properly the following year.

A basket you leave without ordering is deleted after 6 months, and so is a request to be told when something is back in stock. If the item has not returned in that time we will not email you about it - you are welcome to ask again.

Your Rights

Under the Digital Personal Data Protection Act 2023 you may ask us to:

• Tell you what personal data we hold about you and who it has been shared with.
• Correct anything that is wrong or out of date.
• Delete your account and the personal data we are not required by law to keep.
• Remove your name, address and phone number from an order you placed as a guest, without an account. Quote the order number when you write to us. The order itself and its invoice stay for the 8 years the law requires, and the invoice keeps the name and address it was issued with - we will tell you which documents those are.
• Withdraw marketing consent, which you can also do from your account settings or from the unsubscribe link in any marketing email.

How We Protect It

The site runs over HTTPS, passwords are stored hashed and never in a readable form, and access to customer data in the admin panel is restricted by role and logged.

No system is perfect. If a breach ever affects your data we will tell you and the relevant authority, rather than wait to be asked.

Children

This store is not intended for children under 18, and we do not knowingly collect their data. Candles involve an open flame and are not a children's product.