Privacy Policy

1. Introduction

Amrutvan ("we", "our", or "us") operates the website amrutvan.com and related services. We are committed to protecting your personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDPA) of India and the General Data Protection Regulation (GDPR) of the European Union.

This policy explains what data we collect, why we collect it, how we use it, and your rights regarding your data.

2. Data We Collect

2.1 Information You Provide

• Account data: Name, email address, phone number when you register or log in (including via Google)
• Order data: Shipping address, billing address, payment method, order history
• Communication data: Messages via contact form, WhatsApp, email correspondence
• Newsletter: Email address when you subscribe to our newsletter
• Reviews: Product reviews you submit (name, rating, content)

2.2 Information Collected Automatically

• Device data: when you reach checkout we record your IP address, device type (mobile, tablet or computer), operating system, browser and its user-agent string, screen and window size, pixel density, colour depth, touch support, number of processor cores, network connection type (e.g. 4G), language, time zone, your browser’s Do Not Track setting, and whether you are using the site as an installed app. It is saved with your cart and order, used to prevent fraud, and — only as totals, never per person — to understand which devices our customers shop from
• Location (required to place an order): browsing the website never needs your location, and our site asks for it on each visit — you can say no and keep browsing. Placing an order requires it: checkout asks for your device’s position (from GPS or Wi-Fi) and how accurate it is, and can’t be completed without it. If you allow it while browsing and you are logged in to your account, we save your latest position with your account straight away (and update it at most every 10 minutes while you use the site, keeping your last 20 positions), so we can plan delivery. If you are not logged in, the position stays in your browser (for up to 30 minutes) and is not sent to us until you reach checkout. At checkout we use it to fill in your delivery address, to warn you if the pincode you typed looks wrong, to help the courier find you, and to protect against fraud (for example, comparing where an order was placed with where it is delivered). It is saved with your cart and order. If your browser already allows location for our site, checkout uses it automatically. To stop sharing it, block location for amrutvan.com in your browser’s site settings — you can keep browsing, but checkout stays paused until you allow it again. If you can’t share your location, email support@amrutvan.com.
• Security logs: requests to our servers that look like attacks (for example, attempts to reach admin areas, injection attempts or excessive requests) are logged with the IP address and network port, the network provider and country linked to that IP address, browser and device details, and the requests made
• Usage data: Pages and products viewed, time spent, scroll depth, clicks, searches and checkout steps — recorded by our own analytics on our servers in India, only with your consent
• Cookies: Essential cookies for cart/login functionality, and optional analytics cookies (see Section 5)

2.3 Information from Third Parties

• Google OAuth: Email, name, profile picture (only what you authorize during login)
• Payment gateways: Razorpay processes your payment data directly — we do not store card numbers
• Shipping partners: ShipRocket provides delivery tracking updates

3. Why We Collect Your Data

4. Who We Share Your Data With

• Payment processors: Razorpay (for UPI, cards, wallets and net banking) — it processes payments under its own privacy policy
• Shipping partners: ShipRocket and courier partners receive your shipping address to deliver orders
• Address lookup: if you share your location at checkout, the coordinates are sent once to Mappls (MapmyIndia, an Indian mapping provider) to look up your pincode and street. Mappls does not receive your name, phone or order details
• Email service: Resend (for transactional emails) receives your email address
• WhatsApp: Meta Platforms (via WhatsApp Cloud API) for order update messages you opt into
• Analytics: none — usage analytics are collected and stored by Amrutvan itself and are not shared with third-party analytics providers
• Hosting: Our servers are hosted on cloud infrastructure (data stored in India where possible)

We do not sell your personal data to third parties. We do not share data for advertising purposes unless you explicitly consent.

5. Cookies & Tracking

Essential cookies are required for the site to function — they cannot be disabled. Analytics cookies are only set after you give consent via our cookie banner.

6. Your Rights

Under the DPDPA 2023 and GDPR, you have the following rights:

• Right to Access: Request a copy of all personal data we hold about you
• Right to Correction: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data (subject to legal obligations)
• Right to Withdraw Consent: Withdraw consent at any time for analytics, marketing, or WhatsApp notifications
• Right to Grievance Redressal: File a complaint with our Data Protection Officer or the Data Protection Board of India
• Right to Nominate: Nominate a person to exercise your rights in case of death or incapacity (DPDPA Section 14)

To exercise any of these rights, email us at privacy@amrutvan.com or use the contact form on our website. We will respond within 30 days.

7. Data Retention

• Account data: Retained as long as your account is active, deleted within 90 days of account closure
• Order data: Retained for 8 years as required by Indian tax/GST law
• Analytics data: Aggregated data retained indefinitely, individual sessions deleted after 13 months
• Newsletter subscriptions: Until you unsubscribe
• WhatsApp conversations: Retained for 1 year for customer support continuity
• Location and device data saved with an order: Kept with that order (see Order data). On a cart that never becomes an order, it is not used for anything else
• Location saved with your account: Your latest position and last 20 positions, kept while your account is active and deleted with it
• Security logs: Detailed request logs are kept for 30 days. Records of requests flagged as attacks are kept for as long as needed to investigate the incident and to meet legal obligations

8. Data Security

We implement industry-standard security measures including:

• HTTPS/TLS encryption for all data in transit
• Encrypted database connections (SSL in production)
• JWT-based authentication with secure, HttpOnly cookies
• Payment data processed by a PCI-DSS compliant processor (Razorpay)
• No storage of credit card numbers on our servers
• Regular security audits and dependency updates

Where an incident must be reported, or where we report unauthorised access or fraud, we may share the relevant security logs (and, if a flagged attack is linked to an order, that order’s details) with CERT-In, law enforcement agencies or courts, as permitted or required by law. We do not share them with anyone else.

9. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If we learn that we have collected data from a child under 18, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at privacy@amrutvan.com.

10. Changes to This Policy

We may update this privacy policy from time to time. When we make significant changes, we will notify you via email or a prominent notice on our website. The "Last updated" date at the top of this page indicates when the policy was last revised.

11. Contact Us

For any privacy-related questions, data access requests, or complaints:

If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India as established under the DPDPA 2023.