Privacy notice

Bellion (Karmanyu Mehta, proprietor), trading as Baaki.store (“we”), decides how and why your personal data is used, so we are the “Data Fiduciary” under the Digital Personal Data Protection Act, 2023 (DPDP Act). Our address is 2137, Jawahar Colony, Faridabad, Haryana 121001.

This notice explains, in plain language, what we collect, why, who we share it with, how long we keep it and how you can use your rights.

We collect only what we need for these purposes. We don’t sell your data, and we don’t use it for automated decisions about you.

• To sell to you: you give us your contact and delivery details so we can fulfil your order. The DPDP Act allows us to use data you voluntarily provide for that purpose (section 7(a)).
• Legal obligations: keeping tax and accounting records, and responding to lawful requests from authorities.
• Your consent: for anything else, such as marketing emails. You give it by a clear action (you tick or submit something yourself — never a pre-ticked box) and you can withdraw it as easily, by unsubscribing or writing to us. Withdrawing doesn’t affect what we did before.

We use these service providers (“Data Processors”). They may use your data only to provide their service to us, under contract, and must keep it secure:

• Supabase — database, sign-in and file storage
• Vercel — website hosting
• Razorpay — payments (receives the amount, your contact details and your payment details)
• Resend — sending order, sign-in and support emails
• Our SMS provider — sending sign-in codes by text, if you use a mobile number
• Courier partners — delivering your order (name, phone number and address only)

We may also disclose data when the law requires it, for example to tax authorities or under a valid order from a court or government agency.

Some of these providers store data on servers outside India. We transfer data abroad only as the DPDP Act allows, and never to a country the Government of India has restricted.

• Account, cart and wishlist: Until you delete your account.
• Saved addresses: Until you delete them or your account.
• Orders and receipts (including the delivery address used): 8 years, because tax and accounting laws require us to keep these records. They are kept even if you delete your account.
• Support messages and complaints: 3 years after they're resolved.
• Unconfirmed email sign-ups: 7 days.
• Security and access logs: At least 1 year, as the DPDP Rules 2025 require, then deleted.

When a period ends, we delete the data or anonymise it so it can’t identify you.

Under the DPDP Act you can:

• Access a summary of your data and how we use it, and who we’ve shared it with;
• Correct, complete or update it;
• Erase it, unless we must keep it by law (such as order records);
• Withdraw consent you’ve given, for example to marketing;
• Nominate someone to exercise these rights if you die or can’t act yourself;
• Complain to our Grievance Officer, and then to the Data Protection Board of India if you’re not satisfied.

Signed in, you can do most of this yourself under Account → Privacy & data: download your data, edit your details and addresses, or delete your account. For anything else, use our contact form or email the Grievance Officer. We may need to confirm it’s you, and we reply within 30 days.

Our shop is for adults: you must be 18 or older to create an account or buy. We don’t knowingly collect data from children. If you believe a child has given us their data, contact us and we’ll delete it.

We use only what the site needs to work. We don’t use advertising cookies or cross-site trackers.

If we add analytics or anything that isn’t essential, we’ll update this table first and ask for your consent where the law requires it.

All traffic is encrypted (HTTPS). Access to personal data is limited to the people who need it to run the shop, and our database enforces that each shopper can only read their own account, addresses and orders. Payment details are handled by Razorpay and never reach our servers.

If a personal data breach affects you, we’ll tell you and the Data Protection Board of India without delay, explaining what happened, the likely impact and what you can do.

We’ll update the date at the top whenever this notice changes. If a change affects how we use data you’ve already given us, we’ll tell you by email first.

For questions, requests or complaints about your personal data, contact our Grievance Officer:

Karmanyu Mehta, Grievance Officer
Bellion (Karmanyu Mehta, proprietor), 2137, Jawahar Colony, Faridabad, Haryana 121001
Email: bellion.vk@gmail.com
Phone: +91 92177 66696

We acknowledge every request within 48 hours and resolve it within 30 days.