Privacy Policy

1. What we collect

We collect only what we need to sell and deliver jewellery to you:

• Identity & contact — your name, email, phone number and delivery addresses.
• Order data — what you bought, order status, payment status, and your support conversations with us.
• Payment — card and UPI details go directly to our PCI DSS-compliant payment partner; they never touch our servers. We only receive confirmation that a payment succeeded or failed.
• Technical — basic device and log information (IP address, browser type) used for security and to keep the site working.

2. How we use it

We use your data to process and deliver orders, send order and delivery updates by SMS, email or WhatsApp, provide customer support, prevent fraud, and meet legal obligations such as GST invoicing. If — and only if — you opt in, we send occasional offers; you can opt out at any time from your account or the unsubscribe link in any message.

We never sell your personal data, and we do not use it for cross-site advertising.

3. Who we share it with

We share the minimum necessary with partners who help us fulfil your order: courier partners receive your name, address and phone number for delivery; our payment partner processes your payment; and our infrastructure providers host the site and database. Each is bound to use your data only for that purpose. We disclose data to authorities only where the law requires it.

4. Cookies

We use strictly necessary cookies for login sessions and your cart. We do not use cross-site tracking or advertising cookies.

5. How long we keep it

We keep your account data for as long as your account is active. Order and invoice records are retained for the period required by Indian tax law (currently up to eight years under GST rules) even after account deletion; everything else is deleted or anonymised when no longer needed.

6. Your rights

In line with the Digital Personal Data Protection Act, 2023, you can:

• Access a copy of the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Request deletion of your account and data (except records we must keep by law).
• Withdraw consent for marketing at any time, without affecting your orders.
• Nominate a person to exercise these rights on your behalf if you are unable to.
• Raise a grievance with us and, if unresolved, with the Data Protection Board of India.

7. Security

All traffic is encrypted in transit. Passwords are stored hashed, never in plain text. Access to customer data inside our team is role-restricted and audit-logged.

8. Children

Our site is not directed at children, and we do not knowingly collect data from anyone under 18. If you believe a minor has provided us data, write to us and we will delete it.

9. Contact & grievances

For any privacy request or complaint, write to privacy@moon.example, or reach our Grievance Officer at grievance@moon.example. We acknowledge requests within 48 hours and aim to resolve them within one month.

10. Changes to this policy

If we change how we handle your data, we will update this page and the "Last updated" date above, and notify you of material changes by email.