Privacy Policy

The Stanch processes your personal data under India's Digital Personal Data Protection Act, 2023. This page says exactly what we hold, why, who touches it, and how you take it back. No trackers, no fine print.

What we collect

Account: the email address and (via Google) display name you give us when you sign in, plus your consent records and wishlist.
Orders: the name, phone number and addresses you enter at checkout, stored by our WooCommerce store (staging.thestanch.com today) along with what you bought.
Marketing consent: one record of whether you opted into drop/sale emails — kept even when the answer is ‘no’, because that is your choice we must honour.

We collect nothing else about you: no browsing profiles, no fingerprinting, no purchased data lists.

Why we collect it, and our lawful basis

We process your data on two lawful bases recognised by the DPDP Act:

Performance of a contract — taking, packing, shipping, invoicing and supporting the order you placed. You cannot receive a parcel we never processed.
Your consent — marketing emails only, and only while you keep the switch on. Withdraw it in Account › Privacy and the records stop.

Who we share it with (our data processors)

We never sell or rent your data. It reaches only these service providers (processors), each for one job:

MongoDB Atlas — your account, sessions and consent ledger.
Cloudinary — banner images we publish. Marketing creatives only; never customer data.
Brevo — transactional order emails and (with consent) marketing emails.
WooCommerce host (staging.thestanch.com) — your orders, billing/shipping details.
Razorpay — payment processing. We never see or store your full card details; they go between you and Razorpay.

Plus, when a courier picks up your parcel they handle the delivery name, address and phone — for that delivery only.

No analytics, no ads, no third-party pixels

There is no Google Analytics, no Meta/TikTok pixel, no ad retargeting, and no third-party advertising cookie on this site. The only cookies are first-party ones this storefront needs to keep you signed in and your cart intact.

How long we keep your data

Your account and consent records are kept until you delete them from the Privacy card in your account. Order invoices and receipts we keep as long as Indian tax law and company law require them to be kept — that obligation applies to us whether or not your account still exists.

Your rights

Under the DPDP Act you can, any time from the Privacy card in your account: download a copy of your personal data (export), ask us to erase your account and personal data, and withdraw or change any consent you have given — especially marketing emails. Doing it yourself takes seconds; if you cannot sign in, write to the grievance officer below.

Grievance officer

Grievance officer: hello@thestanch.com. If something about how we handle your personal data bothers you — a denied request, an email you shouldn't have received — write to that address. We acknowledge grievance messages and resolve them; you also have the right to complain to the Data Protection Board of India.

Data breaches

If your personal data is ever compromised, we notify the Data Protection Board of India and every affected user as the DPDP Act requires — what happened, what we are doing, and who to contact — instead of quietly hoping no one notices.

Children under 18

This store is not aimed at children. If a customer is under 18, the account and any consent must be created or given by a parent or guardian — a child's own sign-up means we will erase it when we learn of it.

Changes to this policy

We update this page when our practices change. When a change needs your confirmation (like the DPDP re-verification), we ask inside your account — you'll see a notice bar there.