Privacy notice

We collect only what we need to sell you something and deliver it well. This notice explains what that is, why, and the choices you have under the Digital Personal Data Protection Act, 2023.

Last updated 4 November 2026

Who is responsible

The business below is the Data Fiduciary for personal data collected through shauk.co.in. That means we decide why and how your data is used, and we answer for it.

Legal name: [Legal name — to be added]
Registered address: [Registered address — to be added]
GSTIN: [GSTIN — to be added]

What we collect

Your mobile number, which is how you sign in and how we reach you about an order.
Your name and delivery address, to ship your order and issue a GST invoice.
Your email address, only if you give it to us.
Your orders: what you bought, when, and the payment and delivery status. Payment details such as card numbers stay with Cashfree; we never receive them.
Messages you send us when you contact support.
Basic technical data such as your IP address and browser, needed to keep the site secure and your bag working.

Why we use it

To sign you in with a one-time password.
To take payment, ship your order and keep you updated on its progress.
To handle returns, refunds and support requests.
To issue invoices and keep the records that tax and consumer law require.
To prevent fraud and keep the site secure.
To send you the Shauk letter and offers, only if you have agreed.

We use your data for an order because you asked us to fulfil it, and for legal records because the law requires it. We do not sell your personal data.

Marketing, only with consent

We send marketing only if you choose it. The checkbox at checkout is unticked unless you tick it, and email sign-ups are confirmed with a link before anything is sent. We record when and from where you gave consent.

You can withdraw consent at any time with the unsubscribe link in every email, or by writing to us. Withdrawing is as easy as subscribing, and it does not affect your orders or messages about them.

Who processes it for us

We share personal data only with the service providers we need to run the shop. Each acts on our instructions, under contract, and only for the purpose below.

Cashfree Payments: Processes online payments and refunds.
Shiprocket: Books couriers and tracks your delivery.
MSG91: Sends sign-in and order confirmation codes, and order updates, on WhatsApp and by email.
Resend: Sends transactional email, such as invoices and confirmations.
Klaviyo: Sends the Shauk letter, only if you have subscribed.
Amazon Web Services: Hosts our servers, database and images.

We may also share data with courier partners who deliver your parcel, and with authorities where Indian law requires it.

Where it is stored

Our database, servers and images are hosted with Amazon Web Services in the Mumbai (ap-south-1) region, in India. Some of the providers above may process limited data outside India to deliver their service, always as permitted under the DPDP Act.

How long we keep it

We keep your data while your account is active and for as long as we need it for the purposes above. Invoices and order records are kept for as long as tax and accounting law requires. When data is no longer needed, we erase it.

Your rights

Under the DPDP Act, 2023 you can:

ask for a summary of the personal data we hold about you and how we use it;
ask us to correct, complete or update it;
ask us to erase it, unless we must keep it by law (for example, invoices for tax);
withdraw any consent you have given;
nominate someone to exercise these rights for you in case of death or incapacity;
have a grievance about your data heard and answered.

To use any of these rights, write to [Support email — to be added] or contact us through the contact page. We may ask you to confirm your identity with a one-time password before acting on a request.

Children

The site is meant for adults. We do not knowingly collect personal data from anyone under 18 without verifiable consent from a parent or guardian.

Security

Data is encrypted in transit, access is limited to staff who need it, and phone numbers and email addresses are masked in our system logs. If a breach affecting your data occurs, we will inform you and the Data Protection Board of India as the law requires.

Grievance Officer

Questions or complaints about your personal data go to our Grievance Officer. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

Grievance Officer: [Grievance Officer name — to be added]
Email: [Grievance Officer email — to be added]
Address: [Registered address — to be added]

Changes to this notice

If we change how we use your data, we will update this notice and the date at the top. Where a change needs your consent, we will ask for it first.