Privacy Policy

Who is responsible

Aniyo Private Limited, with its registered office at 6, Jai Jhulelal Park, Hansol, Ahmedabad, Gujarat 382475, India, is the data fiduciary for personal data collected on aniyo.in. This policy is written for the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, including the rules that apply to personal data. It describes the data the Aniyo software actually collects and the companies that process it.

Data we collect

• Account: name, email, a hashed password if you register with a password, optional phone number, and whether your email is verified.
• Google sign-in: if you choose it, Google shares your name, email, Google account id, profile picture, and whether the email is verified. We do not receive your Google password.
• One-time codes sent by email so you can verify a new account.
• Addresses you save, and the name, email, phone, and shipping address on each order.
• Orders, quantities, prices, promo codes, delivery charges, and order status. Stock is reduced only after payment is verified.
• Payment references from Razorpay: the Razorpay order id and payment id. We do not store your full card number, UPI PIN, or the Razorpay signature.
• Shipping updates from Shiprocket, including courier name, airway bill, tracking link, and delivery time.
• Return requests: the order, the reason (wrong item, damaged, or size), and whether you asked for a refund or a replacement.
• Wishlist items, artists and organizations you follow, and reviews you post.
• A device token if you allow push notifications. Firebase Cloud Messaging uses that token to deliver the notification.
• Technical logs needed to run the site, such as a request id. We do not use these logs to build an advertising profile.

Why we use it

We use this data to create your account, take and ship orders, prevent fraud, send order and verification email, show notifications you opted into, calculate seller payouts, and answer complaints. We do not sell your personal data.

Who processes it

• MongoDB Atlas stores the account, catalogue, order, and return records.
• Product images are stored in object storage. The software supports Cloudflare R2 and Amazon S3. The operator selects one of those in server configuration.
• Razorpay collects the payment and, when payouts are enabled, RazorpayX pays sellers.
• Shiprocket receives the delivery address and shipment details so a courier can deliver the order, and sends tracking updates back.
• Resend sends transactional email, such as verification codes and order messages.
• Google handles Google sign-in.
• Firebase Cloud Messaging delivers push notifications.

These providers process data only so Aniyo can perform the purpose above. Some of them may store data outside India. Where the law requires it, we will rely on a lawful transfer and tell you before we start a new kind of transfer.

How long we keep it

We keep account and order records while the account is active. After you ask us to delete the account, we delete that data within 90 days, except records we must keep by law, such as tax and invoice records, which we may keep for up to 8 years. One-time codes are kept only until they expire. The website does not yet have a self-serve delete button, so use the Contact page.

Your rights

Under the Digital Personal Data Protection Act, 2023 you can ask for a summary of the personal data we process, ask us to correct or erase it, and raise a grievance. Write to the grievance officer on the Contact page. We will acknowledge the grievance within 48 hours and try to resolve it within 30 days, in line with the Consumer Protection (E-Commerce) Rules, 2020. If you are not satisfied, you may approach the Data Protection Board of India once that route is available to you.

Children

Aniyo is not meant for children. Do not create an account if you are under 18.

Security

Passwords are stored as hashes. Admin sign-in uses an HttpOnly cookie. Payment card data stays with Razorpay. No method of storage is perfect. Tell us if you believe your account was accessed without permission.