Privacy Policy

HIMSHAIL (“we”, “us”, “our”) operates the website himshail.com and sells packaged foods - including roasted makhana (fox nuts) and herbal / botanical flower teas - for personal consumption in India. This Privacy Policy explains how we handle personal information when you browse, create an account, check out, contact support, or join our mailing list.

We process personal data in line with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and applicable rules, and food-business obligations under the Food Safety and Standards Act, 2006 (including FSSAI labelling and recall communication). Using the site or placing an order means you have read this policy.

Registered business name, GSTIN, FSSAI licence number and registered office appear on invoices, packaging and checkout where required. For a copy, email info@himshail.com.

1. Who this applies to

This policy covers customers, account holders, gift recipients whose details you provide at checkout, newsletter subscribers, and visitors in India. We do not knowingly collect data from children under 18. Our products are sold for adult purchase; if you are under 18, do not create an account or complete checkout without a parent or guardian.

2. Information we collect

Information you give us

• Identity and contact: name, email, mobile number
• Delivery and billing addresses, and gift-message text if you add one
• Account password (stored in hashed form, never shown to staff)
• Order notes, support emails, and WhatsApp or phone conversations you start with us
• Reviews, ratings and photos you choose to publish
• Marketing preferences (opt-in / opt-out)

Information from orders and payments

• Cart contents, quantities, coupon codes, order value and GST invoice details
• Payment status, Razorpay payment / order identifiers, method type (UPI, card, net banking, wallet) and last-four or UPI handle only if Razorpay or your bank returns them to us for reconciliation
• We do not collect or store full card numbers, CVV, UPI PINs or net-banking passwords. Those are entered on Razorpay’s PCI-DSS compliant checkout

Information collected automatically

• IP address, browser, device type, approximate location derived from IP
• Pages viewed, referring URL, and basic diagnostics to keep the shop working
• Cookies and similar storage as described below

3. Why we use your information

• Take, confirm, pack and deliver food orders, and send dispatch / OTP messages
• Process payments through Razorpay and issue refunds to the original method
• Create GST-compliant invoices and retain records required under tax and company law
• Contact you if a batch is recalled, a pack is mislabelled, or an allergen notice must go out (food-safety duty)
• Customer support, resolutions for damaged or wrong items, and fraud / chargeback review
• Improve the catalogue, stock planning and site performance
• Send offers and product stories only if you opt in; you can unsubscribe from every marketing email
• Comply with lawful requests from courts, tax authorities or FSSAI

We rely on your consent (account, marketing, cookies where required), performance of a contract (your order), and legitimate interests / legal obligation (fraud prevention, tax, food safety) as applicable under Indian law.

4. Payments (Razorpay)

Checkout is processed by Razorpay Software Private Limited (and its acquiring banks). When you pay, you also use Razorpay’s services and should read Razorpay’s Privacy Policy and terms. Razorpay may complete additional checks (including those required by RBI payment aggregator guidelines). We receive confirmation of success or failure, a payment reference, amount and, where provided, limited method metadata - not your full card PAN.

Failed, abandoned or disputed payments may be logged so we can help you complete the order or respond to your bank. Approved refunds are processed back to the original payment method, and your bank’s or UPI app’s settlement cycle decides when the credit appears.

5. Sharing

We do not sell personal information. We share it only with:

• Razorpay and payment networks, to collect and refund money
• Logistics and warehouse partners, to ship packed foods to your pin code
• Email / SMS / WhatsApp service providers for transactional notices
• Cloud hosting, analytics and security vendors who process data on our instructions
• Professional advisers (accountants, lawyers) under confidentiality
• Authorities when Indian law requires it

Some processors may store or access data outside India. Where that happens, we use contractual and organisational safeguards consistent with the DPDP Act.

6. Cookies and similar technologies

We use essential cookies to keep you signed in, remember your cart and complete Razorpay checkout. We may use analytics cookies to understand which flavours and tea pages people open. You can block non-essential cookies in your browser; the shop and checkout may not work fully without essential cookies.

7. Retention

Account data is kept while your account is active and for a reasonable period after closure. Order, invoice and payment references are kept for the period required by tax, GST and company law (typically eight years in India, or longer if a dispute is open). Support tickets and recall records are kept as long as needed for food-safety and legal defence. Marketing lists are kept until you unsubscribe.

8. Security

We use HTTPS, access controls and hashed passwords. No website is perfectly secure. Do not send card numbers or UPI PINs by email or chat. If you believe an account was misused, write to us immediately.

9. Your rights

Subject to the DPDP Act and records we must keep, you may ask us to:

• Provide access to the personal data we hold about you
• Correct inaccurate details (you can also edit profile and addresses in My Account)
• Erase data we no longer need for law or the contract
• Withdraw marketing consent
• Nominate a contact in case of death or incapacity, where the Act allows

Email info@himshail.com with the subject “Privacy request”. We may need to verify it is you. We will respond within the timelines the law requires.

10. Grievance officer

For privacy grievances under Indian IT / DPDP rules, write to the Grievance Officer at info@himshail.com with “Grievance - Privacy” in the subject. We aim to acknowledge within 48 hours on business days and resolve as required by applicable rules.

11. Changes

We may update this policy when checkout, logistics or the law changes. The “Last updated” date at the top will change. Continued use of himshail.com after an update means you accept the revised policy. Material changes that affect how we use payment or account data will be highlighted on the site or by email where we have a lawful way to reach you.

Questions? Email info@himshail.com.