Privacy Policy

1. Who We Are

Melvio is an Indian e-commerce brand that manufactures and sells premium melamine tableware, including dinner sets, gifting sets and serving ware. Our registered office is in Jaipur, Rajasthan, India. For all privacy-related matters, you may contact our Chief Financial Officer:

2. What Information We Collect

We collect only the information necessary to process your orders and improve your experience. This includes:

• Identity data: your name as provided at checkout
• Contact data: email address, phone number and delivery address
• Transaction data: order details, payment method used, amounts paid and order history
• Technical data: IP address, browser type, device information, pages visited and time spent on site (collected via cookies and analytics tools including Google Analytics and Microsoft Clarity)
• Marketing data: your preferences regarding receiving communications from us
• Communication data: any messages or enquiries you send us via email or our contact form

We do not collect or store sensitive financial information such as full card numbers, CVV or bank account details. All payment processing is handled by Razorpay, a PCI-DSS compliant payment gateway regulated under RBI guidelines.

3. How We Use Your Information

We use your personal data for the following purposes:

• To process and fulfil your orders, including dispatch, delivery and order confirmations
• To send transactional communications such as order confirmations, shipping updates and return notifications
• To respond to your enquiries, complaints or support requests
• To send you marketing communications, where you have opted in or where permitted under applicable law
• To improve our website, products and services based on usage analytics
• To comply with our legal obligations under Indian law, including the Consumer Protection Act 2019 and applicable tax legislation
• To detect and prevent fraud, chargebacks and misuse of our platform

We will never sell, rent or otherwise transfer your personal data to any third party for their own marketing purposes.

4. Legal Basis for Processing

Under the Digital Personal Data Protection Act, 2023 (DPDPA) and applicable Indian law, we process your personal data on the following lawful bases:

• Contract performance: processing is necessary to fulfil your order and deliver products
• Consent: for marketing communications and non-essential cookies, where you have given explicit consent
• Legitimate interests: for fraud prevention, security, site improvement and analytics — where our interests are not overridden by your rights
• Legal obligation: where we are required to retain or share data under applicable Indian law

5. Sharing of Your Information

We share your personal data only with the following categories of third parties, strictly for the purposes described:

• Razorpay: payment processing (RBI-regulated, PCI-DSS compliant)
• Courier and logistics partners: for order fulfilment and delivery (your name, address and phone number are shared with our shipping partner)
• Supabase: cloud database provider where your order data is stored (data stored on secure, encrypted servers)
• Resend: transactional email service used to send you order confirmations
• Google Analytics & Microsoft Clarity: anonymised usage analytics to help us understand how our website is used
• Legal authorities: where we are required to disclose information by court order, government authority or applicable law

All third-party service providers are required to maintain the security and confidentiality of your data and may only use it for the specific purpose for which it was shared.

6. Cookies and Tracking Technologies

We use the following types of cookies on our website:

• Essential cookies: required for the site to function, including shopping cart and checkout sessions. These cannot be disabled.
• Analytics cookies: Google Analytics collects anonymised data about how visitors use our site. You can opt out at tools.google.com/dlpage/gaoptout
• Behaviour analytics: Microsoft Clarity records anonymised session data and heatmaps to help us improve usability. No personally identifiable information is captured.

You can control non-essential cookies through your browser settings at any time. Disabling analytics cookies will not affect your ability to place orders.

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, and in accordance with our legal obligations:

• Order and transaction data: retained for a minimum of 7 years as required under Indian tax and accounting law (GST Act, Income Tax Act)
• Customer account and contact data: retained for the duration of your relationship with us and for 3 years thereafter
• Marketing preferences: retained until you withdraw consent
• Analytics data: retained in anonymised form per the applicable third-party provider's policies

8. Your Rights

Under the Digital Personal Data Protection Act, 2023 and applicable Indian consumer law, you have the following rights in relation to your personal data:

• Right of access: you may request a copy of the personal data we hold about you
• Right to correction: you may request that inaccurate or incomplete data be corrected
• Right to erasure: you may request deletion of your personal data where we no longer have a lawful basis to retain it
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting prior processing
• Right to grievance redressal: if your request is not handled to your satisfaction, you have the right to escalate to the Data Protection Board of India once constituted under the DPDPA

To exercise any of these rights, please contact us at devendrachoudhary55@gmail.com. We will respond within 30 days.

9. Data Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration or disclosure. These include SSL/TLS encryption for all data transmitted via our website, access controls on our database, and use of reputable, security-audited third-party service providers.

No method of transmission over the internet or electronic storage is 100% secure. While we take all reasonable precautions, we cannot guarantee absolute security. In the event of a data breach that is likely to affect your rights, we will notify you as required under applicable law.

10. Children's Privacy

Our website and services are not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. We will post the updated policy on this page with a revised "Last updated" date. Where changes are material, we will notify you by email or via a prominent notice on our website. Your continued use of our website after such notice constitutes acceptance of the updated policy.

12. Governing Law

This Privacy Policy is governed by the laws of India, including the Information Technology Act 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, and the Digital Personal Data Protection Act 2023. Any disputes arising in connection with this policy shall be subject to the exclusive jurisdiction of the courts in Jaipur, Rajasthan, India.