Privacy Policy

What we collect, why we collect it, who else sees it, and how to have it removed.

Last updated 22 September 2026

This policy explains what we do with your personal information when you use this website. We collect what an order actually requires and not more, and we do not sell your data to anybody.

What we collect

When you create an account

Your name, email address, telephone number and password. The password is stored only as a cryptographic hash — we cannot read it, and neither can anyone who obtained our database.

When you place an order

Your delivery address, the contents of the order, and the amount paid. We keep this as the record of the sale.

When you pay

Nothing sensitive. Card and bank details are entered on Razorpay’s own payment page. We receive only a payment identifier and whether it succeeded. We never see or store your card number, CVV, UPI PIN or bank password.

When you sign in with Google

If you use Continue with Google, Google tells us your name, email address and profile picture. We never receive your Google password.

Automatically

A session cookie so the site remembers you are signed in and keeps your basket, and ordinary server logs containing IP address, browser and the pages requested. The session cookie is strictly necessary — without it you could not stay signed in. We do not use advertising or cross-site tracking cookies.

Why we use it

• To take, dispatch and support your order — our contract with you.
• To send order confirmations, dispatch notices and delivery codes. These are service messages, not marketing, and cannot be switched off while an order is live.
• To send offers and new-arrival emails, only if you asked for them.
• To prevent fraud and abuse of promotions — our legitimate interest.
• To keep tax and accounting records — our legal obligation.

Who else sees it

Only those who need to, and only for these purposes:

• Razorpay — to take payment and process refunds.
• Brevo — to deliver transactional email.
• EmailOctopus — to hold the marketing list, if you subscribed.
• Supabase — database hosting.
• Vercel — application hosting.
• Google — only if you choose to sign in with Google.
• Delivery partners — the name, address and phone number needed to deliver your parcel.

We also disclose information where the law requires it. We do not sell or rent your personal data, and we do not share it for anyone else’s advertising.

Marketing, and how to stop it

We only send marketing email if you subscribed, through the footer form or the offer popup. Every such email carries an unsubscribe link that works immediately. You can also change what you receive under Notification preferences in your account, or write to care@velmorris.com.

Unsubscribing from marketing does not stop order confirmations or delivery notices, which are part of fulfilling your order.

How long we keep it

Order records are kept for eight years, as tax law requires. Account details are kept while your account is open. Marketing consent is kept until you withdraw it. Server logs are kept for a short period for security.

Your rights

Under the Digital Personal Data Protection Act, 2023 you may ask us to:

• tell you what personal data we hold about you;
• correct anything inaccurate or incomplete;
• erase your data where we have no continuing need or legal duty to keep it;
• withdraw a consent you previously gave;
• nominate someone to exercise these rights on your behalf.

Write to care@velmorris.com and we will respond within one month. We may need to verify who you are first. Note that we cannot erase the record of a completed sale while we are legally required to keep it.

Security

The site is served only over HTTPS. Passwords are hashed, payment details never reach our servers, and administrative access requires a separate sign-in. No system is perfectly secure, but we do not keep what we do not need — which is the most effective protection available.

Children

This shop is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us personal data, write to us and we will delete it.

Changes

If we change this policy we will update the date above, and tell you by email if the change is significant.

Contact and grievances

For any privacy question, or to complain about how we have handled your data, write to care@velmorris.com, or to our grievance officer named on the Contact Us page. If you are not satisfied with our response you may complain to the Data Protection Board of India.