Privacy Policy — Chaitikaa

Chaitikaa (“Chaitikaa”, “we”, “us”) operates this website and is the Data Fiduciary for the personal data described below, under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”). This policy explains what we collect, why, how it is used and shared, how long we keep it, and how you can exercise your rights over it.

1. Personal data we collect

Account & contact details — name, email address, mobile number, and your password (stored only as an irreversible cryptographic hash, never in plain text).
Profile details you choose to add — date of birth, gender, preferred language, and a short bio, all optional.
Delivery details — the billing and shipping addresses you save or enter at checkout.
Order & transaction data — items purchased, order value, payment status, and a reference to your payment transaction. We do not store your card number, CVV, UPI PIN, or payment OTP on our servers — these are handled entirely by our payment gateway.
Cart & wishlist data — items you add to your cart or save to your wishlist.
Marketing preferences & consent records — whether you've opted in to email, SMS, or WhatsApp marketing, and a timestamped record of each time you granted or withdrew that consent.
Customer support communications — messages you send us through the contact form or support channels.
Technical & security data — IP address, browser/device information, and login activity, collected automatically to secure your account and prevent abuse (e.g. rate limiting repeated login or OTP attempts).
Cookies & analytics — see Section 5 below.

2. Why we collect it, and on what basis

We only collect personal data for a specific purpose:

To perform your order (contract necessity) — your name, address, and mobile number are shared with our courier partner solely to deliver your order; your order details are shared with our payment gateway solely to process payment.
To operate your account — authentication, order history, saved addresses, cart, and wishlist.
To communicate with you — transactional messages (order confirmation, shipping and delivery updates, refund status) are sent regardless of your marketing preferences, since they are necessary to fulfil your order, not marketing.
For marketing, (new collection announcements, offers, festive promotions) — only with your explicit, separate opt-in consent, and only through the channel(s) you've opted in to. Marketing consent is never a condition of placing an order.
To keep our platform secure — detecting and rate-limiting suspicious login/OTP activity, and maintaining an audit trail of security-relevant actions.

3. Who we share it with

We do not sell your personal data. We share it only with the service providers necessary to run our business, and only the data each one needs to do its job:

Our payment gateway, to process your payment.
Our courier/logistics partner, to deliver your order.
Our transactional email provider, to send order and account emails.
Enquiries submitted through our Contact page may trigger an internal team notification through a third-party messaging tool, so our team can respond promptly.
Analytics tooling (Google Tag Manager) may be used to understand how visitors use our site — see Section 5.

We may also disclose personal data where required by law or a valid legal process.

4. How long we keep it

We keep your account and order data for as long as your account is active, and for as long afterwards as required for tax, accounting, and dispute-resolution purposes. If you delete your account (Section 7), we anonymize your identifying information (name, email, mobile) immediately and delete your saved addresses, cart, and wishlist — but we retain your order records (with your identity anonymized) as required by applicable tax and accounting law.

5. Cookies & analytics

We use essential cookies/local storage to keep you logged in and to remember your guest cart — these are never gated by the cookie banner, since the site can't function without them.

For everything else, we ask first. Analytics tooling (Google Tag Manager, and Google Analytics 4 once it's added as a tag inside the same container) only runs if you click “Accept” on the cookie banner shown on your first visit; clicking “Reject” is remembered and analytics never loads. You can change your mind at any time by clearing your browser's site data for this domain, which brings the banner back. We do not knowingly send analytics tools your name, email, or mobile number.

6. Your rights

Under the DPDP Act, you have the right to:

Access a copy of the personal data we hold about you.
Correct inaccurate or incomplete personal data.
Withdraw any marketing consent you previously gave, at any time.
Request erasure of your account and personal data, subject to Section 4 above.
Raise a grievance about how we've handled your personal data.

If you have an account, you can download a full export of your data and manage your marketing preferences from My Account → Privacy & Data, and request account deletion from the same page. For an access, correction, or any other request, or if you don't have an account, write to us at the contact details in Section 8 — we will verify your identity before acting on the request.

7. Account deletion

Deleting your account is immediate and self-service. We anonymize your name, email, and mobile number, permanently delete your saved addresses, cart, and wishlist, withdraw every marketing consent on file, and sign you out everywhere. As noted in Section 4, order records are retained (anonymized) where the law requires it.

8. Grievance & contact

For any question about this policy, or to submit a privacy request or complaint, write to hello@chaitikaa.com or call +91 99113 36970. You can also write to our registered office:

Chaitikaa
G/F IV-2708-B, OLDM-15, Gali No. 4, Bihari Colony, Bholanath Nagar, Shahdara
Delhi, Delhi 110032, India

9. Changes to this policy

We may update this policy from time to time. Every consent we record is stamped with the policy version in effect when you gave it, so a later change never silently reinterprets a consent you already gave.