Privacy Policy
1. Information we collect
When you visit, register, or place an order on RUHISEN, we collect only what is needed to deliver your products and improve your experience. This includes:
- Account data: name, email address, phone number, and a hashed password (we never store the raw password).
- Order data: billing/shipping address, items purchased, payment method, and order history.
- Device data: IP address, browser type, device type, referring page, and pages viewed — collected through standard server logs and our analytics tool.
- Optional data: reviews you post, wishlist items you save, coupon codes you redeem, and any messages you send through our contact form.
2. How we use your information
We use your information strictly to operate the store and serve you better:
- Process, fulfil, and ship your orders.
- Send order updates, delivery notifications, and (only if you opt in) marketing emails.
- Provide customer support and resolve disputes or refunds.
- Prevent fraud, payment chargebacks, and abuse of our systems.
- Improve site performance, fix bugs, and design better products.
3. Google Sign-In
If you choose to sign in with Google, we receive only your name, email address, and Google account ID via Google's OAuth API. We do not receive your Google password and we do not access your Gmail, Drive, or any other Google service. You can revoke this access at any time from your Google Account → Security → Third-party apps page.
4. Payments & Razorpay
Online payments (UPI, cards, net-banking, wallets) are processed by Razorpay Software Pvt. Ltd., a PCI-DSS Level 1 certified payment gateway. Your full card number, CVV, and UPI PIN are entered directly on Razorpay's secure interface and are never stored on RUHISEN's servers. We retain only a transaction reference (payment ID and order ID) needed for accounting, refunds, and support.
For Cash on Delivery orders, no online payment data is collected — only your shipping address and phone number.
5. Analytics & cookies
We use cookies and similar technologies to keep your cart working, remember your session, and understand how the site is used. Specifically:
- Strictly necessary cookies for the shopping cart, login session, and CSRF protection. These cannot be disabled while using the site.
- Google Analytics 4 (GA4) to measure visits, popular products, and checkout drop-off — fully anonymized at the IP level.
- Google Tag Manager to load tracking scripts in a single managed container.
You can clear or disable cookies any time through your browser settings. Disabling strictly necessary cookies may break the cart and checkout.
6. Email, SMS & WhatsApp
We send transactional messages (order confirmation, dispatch, delivery, return updates) to the email address and phone number on your order. These are not optional — they are required to fulfil your order. Promotional emails (drops, sales, new arrivals) are sent only if you subscribe to our newsletter or check the marketing opt-in at checkout. You can unsubscribe any time from the link at the bottom of every promotional email.
8. Security
Our website runs over HTTPS with up-to-date TLS encryption. Passwords are stored as bcrypt hashes. Admin panels are protected by IP rate-limiting and CSRF tokens. Database backups are stored encrypted. While no system is 100% secure, we take reasonable steps consistent with the Digital Personal Data Protection Act, 2023 (DPDP Act), and — to the extent still applicable — the Information Technology Act, 2000 and the SPDI Rules, 2011, to safeguard your data as a Data Fiduciary under Indian law.
9. Your rights
You have the right to:
- Access the personal data we hold about you.
- Correct inaccurate information from your account page or by writing to us.
- Delete your account and associated data (we will retain only what is legally required for tax and accounting — typically 7 years for invoices).
- Opt out of marketing communications at any time.
- Lodge a complaint with the Grievance Officer (details below) if you believe your data has been misused.
10. Your rights under the DPDP Act, 2023
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's primary law governing how we, as a Data Fiduciary, process your personal data. In addition to the rights listed in Section 9 above, the DPDP Act specifically gives you the following:
- Lawful basis for processing: We process your personal data either with your consent (for example, marketing communications and optional data such as reviews or wishlists), or under the "certain legitimate uses" permitted by Section 7 of the DPDP Act — such as processing needed to fulfil an order you have voluntarily placed, to comply with applicable law, or for other purposes recognised under the Act.
- Right to access: A summary of the personal data we hold about you and the processing activities we carry out on it.
- Right to correction and erasure: You may ask us to correct inaccurate or incomplete data, or to erase personal data that is no longer necessary for the purpose it was collected, subject to any legal retention obligations described below.
- Right to grievance redressal: You may raise a grievance with our Grievance Officer (Section 11) and receive a response within the timeline required by the DPDP Act.
- Right to nominate: You may nominate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity.
- Data retention: We retain personal data only for as long as necessary to fulfil the purpose it was collected for, or as required by other law (for example, financial records are retained for the period mandated under tax and accounting regulations — currently 7 years for invoices).
- Breach notification: In the event of a personal data breach, we will notify the Data Protection Board of India and affected users as required under the DPDP Act and its rules.
If you wish to exercise any of the above rights, write to our Grievance Officer using the contact details in Section 11.
11. Grievance Officer
In accordance with the DPDP Act, 2023 and the Information Technology Act, 2000 (and rules made thereunder), the following Grievance Officer has been appointed for RUHISEN:
- Name: [NEEDS INPUT]
- Designation: [NEEDS INPUT]
- Address: [NEEDS INPUT]
- Email: [NEEDS INPUT]
- Phone: [NEEDS INPUT]
The Grievance Officer will acknowledge your complaint and work to resolve it within the timeline prescribed under applicable Indian data-protection law.
12. Contact us
For any privacy-related question, data request, or grievance, write to us at noreply@ruhisen.in. We will respond within 30 days as required by Indian data-protection rules.
Use the subject line "Privacy Request" so our team routes it correctly.