Legal & Privacy
Privacy Policy
We take your privacy seriously. This policy explains exactly what data we collect, why we collect it, how it's protected, and your rights over it — written in plain language.
Last updated: 1 May 2026
1. Who we are
CuratedStore (operating as The Curated Store) is an online marketplace that connects independent artisans and curated brands with customers across India. Our website is curatedstore.in and you can reach us at support@curatedstore.in.
When this policy says "we", "us", or "CuratedStore" it means The Curated Store. This Privacy Policy applies to all visitors, customers, and vendors who use our platform, and governs data collected through our website, transactional emails, and related services. By using CuratedStore you agree to the practices described here.
2. Information we collect
We collect only what is necessary to provide and improve our marketplace services.
Account & identity data
Your name, display name, email address, and phone number — provided when you register or sign in via OTP.
Order & transaction data
Shipping addresses, order history, product details, amounts paid, and payment method type (e.g. UPI, card, net banking). We do not store raw card numbers, CVV codes, or UPI credentials — these are handled entirely by Razorpay on their PCI-DSS-compliant infrastructure.
Payment reference data from Razorpay
After a successful payment we receive and store Razorpay's payment ID, order ID, and status to confirm and reconcile the transaction. No raw financial credentials are ever transmitted to or stored on CuratedStore servers.
Vendor business data
For registered sellers: brand name, business address, GSTIN, PAN, bank account details for payouts, and KYC documents as required by applicable Indian regulations.
Device & usage data
IP address, browser type, device type, pages visited, session duration, and referring URLs — collected automatically to fix bugs and improve site performance. This data is processed in aggregate and is not used to identify individuals.
Support & communications data
Messages you send us through support channels, and your email preferences (e.g. whether you've opted in to promotional emails). You can unsubscribe from non-essential emails at any time.
3. How we use your data
- Order fulfillment: Processing your purchase, coordinating with vendors, arranging delivery, and issuing GST invoices.
- Payment processing: Initiating and confirming payments via Razorpay; reconciling transactions; processing refunds to your original payment method.
- Account management: OTP-based authentication, session management, saved addresses, and account preferences.
- Customer support: Responding to queries, handling return and refund requests, and resolving disputes.
- Fraud prevention & legal compliance: Detecting suspicious activity and complying with the Information Technology Act 2000, the Digital Personal Data Protection Act 2023 (DPDPA), Consumer Protection Act 2019, GST laws, and RBI guidelines applicable to online merchants.
- Platform improvement: Analysing usage patterns in aggregate to improve product discovery, checkout flows, and site performance.
- Marketing communications (with consent only): Order updates and shipping notifications are mandatory. Promotional emails about new products or offers are sent only if you opt in. You can withdraw consent at any time via the unsubscribe link.
4. Payment processing via Razorpay
All payment transactions on CuratedStore are processed by Razorpay Software Private Limited, a licensed payment aggregator authorised by the Reserve Bank of India (RBI). When you proceed to checkout, your payment details are entered directly into Razorpay's secure payment interface.
- Razorpay is PCI-DSS Level 1 certified. Card numbers, CVV, and UPI credentials are entered and encrypted within Razorpay's interface — CuratedStore servers never receive or store them.
- We receive only a payment confirmation token (Razorpay Payment ID and Order ID) and a payment status code to record and verify the transaction on our end.
- Refunds are initiated by CuratedStore through Razorpay's API and are credited to your original payment method within the timelines described in our Refund Policy.
- Razorpay's own privacy policy governs how they handle your financial data: razorpay.com/privacy
5. Sharing with third parties
We share your data only with partners necessary to operate the marketplace, under strict contractual safeguards. We do not sell, rent, or trade your personal data.
| Partner type | Examples | Data shared |
|---|---|---|
| Payment gateway | Razorpay | Order amount, billing name, email, phone for payment initiation and reconciliation |
| Logistics & delivery | Shiprocket, Delhivery, and similar couriers | Recipient name, shipping address, phone number, and order details required for delivery |
| Cloud infrastructure | Hostinger, Google Cloud | Encrypted database and file storage; processed within India where possible |
| Transactional email | Mailgun, AWS SES | Email address and order details for order confirmations, OTPs, and shipping updates |
| Marketplace vendors | Sellers on CuratedStore | Shipping name, address, and order details needed to pack and despatch your purchase |
| Legal & regulatory bodies | Courts, GST authorities, law enforcement | Only when required by applicable Indian law or a valid legal order |
6. How long we keep your data
- Account data: Retained for the lifetime of your account and for 3 years after your last transaction, in line with consumer protection obligations.
- Order & transaction records: Retained for 7 years as required under Indian GST law and accounting regulations.
- Session logs and device data: Retained for up to 90 days for security monitoring, then automatically purged.
- Deleted accounts: Upon account deletion, personal identifiers are anonymised within 30 days. Transaction records required by law are retained in anonymised form only.
7. Cookies
We use essential cookies to keep you logged in and maintain your cart. Optional analytics cookies are used only with your explicit consent to understand how visitors use our site. All session cookies are secured with HTTPS, HttpOnly, and SameSite=Lax flags. We do not use third-party advertising or tracking cookies.
See our full Cookie Policy for a breakdown of every cookie we use and how to disable them.
8. How we protect your data
- All data is transmitted over TLS 1.2+ (HTTPS). HTTP connections are automatically redirected to HTTPS.
- We use OTP-based login only — no passwords are stored, so there is no password database to leak.
- Database access is restricted by firewall rules. All credentials and API keys are stored as environment variables — never in source code or version control.
- Raw payment credentials are never processed or stored on our servers — handled exclusively by Razorpay's PCI-DSS Level 1 infrastructure.
- Access to production systems and customer data is limited to authorised personnel on a need-to-know basis.
Despite these safeguards, no system is 100% secure. If you believe your account has been compromised, contact us immediately at support@curatedstore.in.
9. Your rights under DPDPA 2023 & IT Act 2000
Under the Digital Personal Data Protection Act 2023 and the Information Technology (Amendment) Act 2008, you have the following rights as a data principal:
Right of access
Request a copy of the personal data we hold about you and a summary of how it has been used.
Right to correction
Ask us to correct or update inaccurate or incomplete personal data.
Right to erasure
Request deletion of your personal data, subject to our legal retention obligations (e.g. GST records).
Right to withdraw consent
Opt out of non-essential communications or analytics cookies at any time, without affecting past lawful processing.
Right to grievance redressal
Lodge a complaint with our Grievance Officer (see below) if your rights are not honoured within 30 days.
Right to nominate
Nominate another individual to exercise your data rights in the event of your death or incapacity.
To exercise any of these rights, email privacy@curatedstore.in. We will acknowledge your request within 7 days and respond fully within 30 days.
10. Children's privacy
CuratedStore is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has registered on our platform, please contact us immediately at support@curatedstore.in and we will delete the account and all associated data promptly.
11. Changes to this policy
We may update this Privacy Policy when our practices change or when required by law. Material changes will be communicated via a prominent notice on the site and, where feasible, by email to registered users. The "Last updated" date at the top of this page always reflects the current version. Continued use of CuratedStore after the effective date of any revision constitutes your acceptance of the updated policy.
12. Grievance Officer & contact
In accordance with the Information Technology Act 2000 and Rule 5(9) of the IT (Reasonable Security Practices) Rules 2011, CuratedStore has designated a Grievance Officer to address privacy-related complaints. If you have a concern about how your personal data is handled, you may contact:
Grievance Officer — The Curated Store
Email: grievance@curatedstore.in
General support: support@curatedstore.in
Response time: within 30 days of receipt