Section 01
Data Fiduciary Identity & Scope
This Privacy Policy describes how Mehandi By Sana (operating from Srinagar, J&K and Bengaluru, Karnataka) collects, uses, stores, and protects personal data when you visit mehandibysana.com, place storefront orders, use our PIN code or order tracking utilities, subscribe to fresh batch notifications, or submit bridal/workshop inquiries, in alignment with India’s Digital Personal Data Protection Act, 2023 (DPDPA) and Information Technology Rules.
Section 02
Personal Information We Collect
- Checkout & Order Details: First and last name, email address, phone/WhatsApp number, street shipping address, city, state, 6-digit PIN code, applied coupon code, and optional special delivery instructions.
- Order Tracking Verification: Order reference ID (e.g.,
MBS-...) and matching checkout email when querying our order tracker. - Bridal & Event Booking Inquiries: Full name, email, phone/WhatsApp, selected service tier, preferred ceremony date, event venue/city, and design notes submitted through our Contact form.
- Fresh Batch Dispatch List (Optional): Email address explicitly submitted to receive notifications when fresh henna cone batches open.
- Anti-Spam & Security Protection: Invisible honeypot validation fields and minimal server request logs solely to protect forms against automated abuse.
Section 03
Purpose & Lawful Basis of Processing
We process your information strictly for legitimate operational purposes:
- Preparing fresh batches, generating GST/order records, and dispatching parcels to your PIN code.
- Sending essential transactional communications: order confirmation receipts, Razorpay/offline payment confirmations, AWB shipping notifications, delivery confirmations, and bridal booking responses.
- Responding to return, replacement, refund, or customer care requests.
- Sending seasonal batch availability or release announcements strictly when you opt into the Fresh Batch Dispatch List or are an active client (with instant opt-out).
Section 05
Checkout & Payment Security
Sensitive financial credentials—such as full credit/debit card numbers, CVV codes, UPI PINs, or netbanking passwords—are never collected, viewed, or stored by Mehandi by Sana servers. All online transactions run directly over encrypted TLS inside Razorpay’s PCI-DSS Level 1 certified environment, and our backend verifies every payment using cryptographic HMAC-SHA256 signatures before marking an order paid.
Section 06
Limited Operational Data Sharing
We share only the minimum data needed with verified operational partners bound to confidentiality:
- Courier & Logistics Partners (Delhivery, DTDC, Blue Dart, India Post): Name, delivery address, PIN code, and phone number to complete doorstep delivery and OTP/NDR verification.
- Payment Gateway (Razorpay Software Pvt. Ltd.): Transaction amount, order reference, customer contact email/phone for payment execution, fraud screening, and statutory refunds.
- Transactional Email & Cloud Infrastructure (Resend / Brevo / authenticated SMTP, Vercel, Railway managed PostgreSQL): Encrypted delivery of transactional notifications and order records.
Section 07
Data Retention & Security Measures
Order invoices, shipping records, and tax ledgers are retained for statutory periods required under Indian accounting and GST regulations. Bridal inquiries and newsletter preferences are kept only as long as reasonably useful for client service or until you request removal. Access to administrative databases and secret API tokens is restricted behind authenticated sessions and server-side TLS encryption.
Section 08
Your Rights as a Data Principal (DPDP Act, 2023)
- Right to Access: Request confirmation and a clear summary of personal data held about your orders or inquiries.
- Right to Correction & Updating: Update misspelled emails, shipping addresses, or phone details prior to dispatch.
- Right to Erasure & Consent Withdrawal: Request removal of non-statutory personal details or opt out of all broadcast emails anytime by emailing us or replying “Unsubscribe” to any batch announcement.
Section 09
Children’s Privacy & Policy Updates
Our online store is intended for adults aged 18 and above. If we become aware that personal data of a minor has been submitted without verifiable parent/guardian consent, we will promptly delete those details upon notice. Changes to this policy are reflected by updating the Effective Date at the top of this dossier.
Section 10
Grievance Officer & Privacy Inquiries
To exercise any privacy right, withdraw consent, or report a data concern, contact our designated Grievance Officer directly:
Name: Sana
Service Bases: Mehandi by Sana · Srinagar (J&K) & Bengaluru (Karnataka)
Email: sana@mehandibysana.com
Phone: +91-9149648717