Privacy policy

What personal data we collect, why, who processes it for us, how long we keep it and the rights you have.

This policy explains what personal data Kraftr collects on kraftrjewelry.com, why, who we share it with, how long we keep it and the rights you have.

Who is responsible for your data

[Company legal name], [Registered address]. GSTIN [GSTIN].

For any question about your data, or to use your rights, contact our Grievance Officer, who also answers privacy questions:

Name and designation: [Grievance Officer's name], [Designation]
Email: care@kraftrjewelry.com (please put "Privacy" in the subject)

What we collect and why

We only ask for what we need for the purpose shown. Fields marked optional on our forms can be left blank.

What	Why we need it	What it lets us do
Name, email and password (stored only as a one-way hash)	To create and secure your shop account	Sign you in, and keep your wishlist and orders
Phone number	Delivery OTP and courier contact	Hand your parcel to you and no one else
Delivery and billing addresses	To deliver your order and issue a GST invoice	Ship your piece and send you a correct invoice
Order details: pieces, sizes, prices, engraving text, gift message	To make, engrave and send your order	Make the piece you asked for and keep a record of the sale
Payment status and the payment reference from Razorpay	To confirm you have paid and to issue refunds	Take payment and refund you. We never see or keep card numbers, UPI PINs or bank passwords
Wishlist	Because you asked us to save it	Show your saved pieces on any device
PAN, only for an order above ₹2,00,000	Indian tax rules ask us to record it for large purchases	Meet our tax duties; used for nothing else
Your choice about marketing emails, and when you made it	So we only email offers if you asked for them	Send new pieces and offers only to people who opted in
Messages you send us	To answer you	Reply to questions, complaints and returns
Device and browser signals checked by Cloudflare Turnstile	To stop bots and fake sign-ups	Keep your account and our forms safe
Server logs: IP address, browser, pages requested, time	Security, and to meet Indian law	Find and fix faults and attacks
Analytics, if you allow Google Analytics cookies: pages viewed, device type, approximate location	To understand which pages are useful	Improve the site

We don't sell your personal data, and we don't use it to target ads to you elsewhere. We only send marketing emails, about new pieces and offers, if you tick the box for them when you sign up or turn them on in your account. The box is never ticked for you. You can turn them off at any time in your account or with the link in every marketing email. Order, delivery and account emails are part of the service and aren't marketing.

The legal basis

Your consent. We ask for it when you create an account, and you can withdraw it at any time; see "Your rights" below. Withdrawing it doesn't affect anything we did before.
Things you give us to buy something. Indian law lets us use the details you give us to complete a purchase, deliver it and support it.
Legal duties. For example, GST invoices, tax records and the logs that CERT-In requires.

Who processes your data for us

We use these companies to run the site and the shop. Each one handles your data only on our instructions and only for the purpose shown.

Company	What for	Where
Razorpay Software Pvt Ltd	Payments and refunds	India
Google (Firebase App Hosting)	Running the website	Singapore
ClickHouse (managed Postgres on AWS)	Our database: accounts, orders, enquiries	Singapore
Cloudflare	Images and files, website security, Turnstile	Global network
Resend	Sending order, account and enquiry emails	United States
Google Analytics	Site analytics	United States
Our courier and insurer, Sequel Logistics	Delivering and insuring your parcel	India (Sequel Logistics)

We also share data when the law requires it, for example with tax authorities, or with the police or a court under a valid legal order.

Storage outside India. Our website and database are hosted in Singapore, and some of the services above process data in the United States or worldwide. Indian law allows this. We choose providers that protect data to recognised standards, and our contracts with them require it.

How long we keep it

Data	How long
Shop account and wishlist	Until you delete your account. If an account is unused for 3 years, we will email you and delete it 48 hours later unless you sign in
Orders, invoices and payment references	8 years from the end of the financial year, as Indian tax law requires
Server logs	At least 180 days and up to one year, as Indian law requires
Analytics	14 months (our Google Analytics setting)
PAN, on orders above ₹2,00,000	8 years, with the order's tax records
Your marketing choice	Until you change it, with the date you made it

How we protect it

All traffic to the site is encrypted (HTTPS), and our database connection uses verified TLS. Passwords are stored only as a salted hash. Sign-in attempts are limited, and accounts lock after repeated failures. Staff access is limited to the people who need it, and each person has their own account. Card details never reach our systems.

If a breach of your personal data happens, we will tell you without delay, with what happened, what it means for you and what we are doing about it. We will also report it to the Data Protection Board of India and to CERT-In as the law requires.

Cookies

We use a small number of cookies and a little of your browser's own storage:

Essential: a cookie keeps you signed in (payload-token), another remembers which country shop you used (shop-country), and your browser's storage keeps your cart and, when you're signed out, your wishlist on this device. The site doesn't work properly without them.
Security: Cloudflare Turnstile checks that a visitor is human when you sign up or send a form.
Analytics, only if you allow them: Google Analytics cookies (_ga, _ga_*) measure which pages are visited. They are off until you choose "Allow analytics" in the cookie banner. Until then, Google Analytics only receives cookieless signals, such as a page being viewed, that aren't tied to you or your device. You can change your choice at any time with "Cookie settings" at the foot of every page. Your choice is remembered in your browser's storage.

Do Not Track. Our site doesn't change its behaviour in response to browser Do Not Track signals. We don't allow other companies to track you across other sites through ours, apart from the Google Analytics described above.

Your rights

You can:

see what personal data we hold about you and how we use it;
correct or update anything that is wrong or out of date (you can change most details yourself in your account);
delete your account and personal data, except what the law requires us to keep, such as invoices;
withdraw your consent at any time, as easily as you gave it;
nominate someone to use these rights for you if you die or can no longer act yourself;
complain to us, and then to the regulator.

To use any of these rights, email our Grievance Officer at the address above. We may ask you to confirm your identity first. We reply as soon as we can and within 90 days at the latest; most requests are done within a week. Complaints are resolved within one month.

If you're not satisfied with our answer, you can complain to the Data Protection Board of India through its online portal, once its complaint process is in force.

Children

Kraftr is for people aged 18 and over. We don't knowingly collect personal data from anyone under 18. If you think a child has given us their data, contact us and we will delete it.

If you live outside India

UAE: you have the rights in the UAE Personal Data Protection Law: access, correction, erasure, restriction, objection and portability. Contact our Grievance Officer to use them.
United States: we don't sell or share personal data for targeted advertising. The site isn't directed at children under 13. California residents can review and correct their data as described above, and we will tell you about material changes to this policy on this page.
Canada: our Grievance Officer is the person accountable for your personal information. Your data is stored and processed outside Canada (in Singapore, India and the United States), where the law may let the authorities there access it. You can complain to the Office of the Privacy Commissioner of Canada, or in Quebec to the Commission d'accès à l'information.

Changes to this policy

We will update this policy when our practices or the law change, and show the date of the update at the top. If we change it in a way that matters, we will tell account holders by email before the change takes effect.