RoastonicPrivacy policy
Last updated [date]
Items in [brackets] are filled in from admin Settings before launch. A lawyer or CA should review this text once.
This notice explains what personal data Roastonic ([legal name], "we") collects, why, and what you can do about it, as the Digital Personal Data Protection Act 2023 requires. It applies to our shop and to Roastonic for Business. We collect only what we need to sell and deliver coffee.
What we collect and why
| What | When | Why |
|---|---|---|
| Name, mobile number, email, delivery address | When you place an order | To deliver it, send order updates and contact you about it |
| Gift recipient's name, mobile and address | If you send a gift | To deliver the gift. We use it for nothing else |
| Payment status and reference | When you pay | To confirm payment. Razorpay handles your card or UPI details; we never see or store them |
| Order history | After you order | To let you track and reorder, and for tax records |
| Business name, GSTIN, contact person, work email, volumes | When a business applies or signs in | To review the application, quote, supply and invoice |
| A cookie or device setting | If you tick "remember me" or sign in | To keep you signed in or your details filled in. See the Cookie notice |
| Messages you send us | When you contact us | To answer you |
We don't use advertising trackers, sell your data or share it for anyone else's marketing.
Your consent
We use your details to fulfil an order you place, which you agree to when you check out. We send "running low?" reminders and offers only if you tick the box asking for them, and every one has an unsubscribe link. You can withdraw consent at any time by writing to privacy@roastonic.com. Withdrawing doesn't affect orders already placed.
Who we share it with
Only the services we need to run the shop, each bound to use your data only for us:
- Razorpay, for payments
- Our courier partners, for delivery
- Resend, for order emails
- Cloudflare, which hosts the website and its database
Some of these services may store data outside India. We also share data when the law requires it, for example with tax authorities.
How long we keep it
Order and invoice records are kept for as long as tax and accounting law requires, currently at least 8 years. Other data, like a lapsed business application or marketing preferences, is deleted within 12 months of your last order or contact, or sooner if you ask.
Your rights
You can ask us to:
- tell you what data we hold about you
- correct or update it
- delete it, except what we must keep by law
- stop sending you reminders and offers
- name someone to exercise these rights for you if you die or can't
Write to privacy@roastonic.com from the email or mobile you ordered with. We reply within 30 days. If you're unhappy with our reply, contact our grievance officer (see Contact). After that, you can complain to the Data Protection Board of India.
Children
Our shop is for adults. We don't knowingly collect data from anyone under 18.
Security
The sites use HTTPS. Admin access is limited to named staff and protected by sign-in checks. Payments are processed by Razorpay, which is PCI-DSS certified.
Changes
If we change this policy, we'll update the date at the top. Big changes will be emailed to business account holders.