Privacy Policy

This policy explains what personal data we collect when you use this site, why we collect it, who else sees it, where it is kept and what you can require us to do with it. It is written to be read, not to be survived.

1. Who is responsible for your data

Khan Enterprises , trading as RoyalDuft Perfumes, of 403, Doodh Naka, Lane No. 7/58, Kalyan, Dist. Thane, Maharashtra 421301, India (GSTIN 27EJJPK4572D1Z2) is the data fiduciary for personal data collected through this site. In the language of India’s Digital Personal Data Protection Act, 2023, you are the data principal — the person the data is about.

2. What we collect

• Account details: your name, email address and a password stored only as a salted cryptographic hash. We cannot read your password, and neither can anyone who obtains the database.
• Order and delivery details: shipping address, phone number, order contents, order history and the invoice we are required to issue.
• Payment references: a Razorpay order and payment identifier, the amount and the status. We do not receive or store card numbers, CVVs, UPI PINs, net-banking credentials or any other payment secret — those are collected by Razorpay on their own systems and never reach ours.
• Technical data: IP address, user agent and request paths, as they appear in ordinary server logs kept for security and debugging.

We do not collect any special category of sensitive data, we do not build behavioural profiles, and we do not buy data about you from anyone.

3. Why we collect it, and on what basis

• To take payment and fulfil your order — necessary to perform the contract you enter when you buy something.
• To issue a GST tax invoice and keep accounting records — a legal obligation we cannot waive, even at your request.
• To provide support and to answer questions about an order.
• To detect and prevent fraud and abuse, including rate-limiting sign-in attempts.
• To send marketing email — only where you have separately and explicitly opted in, and only until you withdraw that consent.

We never sell your personal data. We never share it for third-party advertising. We do not use it to train machine-learning models.

4. Consent, and withdrawing it

Where we rely on your consent — currently only for marketing email — you may withdraw it at any time, with the same ease you gave it, by using the unsubscribe link in any marketing message or by emailing us. Withdrawing marketing consent does not affect order confirmations, delivery updates or invoices: those are not marketing, and we must send them to complete your order.

Withdrawal does not undo processing that already happened lawfully, and it cannot remove records we are legally required to keep — see section 7.

5. Who else sees your data

Only the processors needed to run a shop, and only the minimum each one needs:

• Razorpay — payment processing. They collect your payment credentials directly and share back only the outcome.
• Shiprocket and the courier assigned to your parcel — your name, delivery address and phone number, so the parcel can be delivered and so the courier can call you if they cannot find the address.
• Resend — to send transactional email such as order confirmations.
• Neon (database) and Vercel (application hosting) — to store the database and run the site.

We may also disclose data where a law, a court or a lawful government request requires it. We do not volunteer it otherwise.

6. Where your data is stored

Your data is currently stored and processed in the United States. This is a temporary pre-launch environment used for testing. Production will run on infrastructure located in India, and this policy will be updated when that move happens.

The DPDP Act, 2023 permits transferring personal data outside India except to territories the Government has restricted by notification, and we disclose the transfer here because disclosure is required. The data is protected by the same measures described in section 9 regardless of where it sits, and our processors are bound by contract to process it only on our instructions.

7. How long we keep it

• Orders, invoices and tax records: retained for at least eight financial years, because Indian tax law requires it. These survive account deletion.
• Account data: kept while your account is open. If you close it, we delete your profile and keep only what the line above obliges us to keep.
• Server logs: a short rolling window, retained for security investigation and then discarded.
• Marketing consent records: kept as evidence of consent until you withdraw it, and for a period afterwards as evidence of the withdrawal.

8. Cookies and local storage

We use no advertising cookies, no analytics cookies and no third-party trackers. There is nothing to consent to, because we are not doing it. Specifically, the site sets:

• A session cookie — issued when you sign in, so that you stay signed in. It is HttpOnly, so page scripts cannot read it, and marked Secure in production.
• Browser local storage under the key royalduft.cart.v1 — remembers your bag between visits. It never leaves your device except when you check out, and you can clear it from your browser at any time.

If we ever add analytics, this page will be updated before it goes live, and consent will be obtained where the law requires it.

9. How we protect it

• All traffic is encrypted in transit with TLS.
• Passwords are stored only as salted hashes, never in readable form.
• Payment secrets never touch our servers.
• Administrative functions are restricted to named accounts holding an explicit admin role, and every administrative change is written to an append-only audit log.
• Sign-in attempts are rate-limited to frustrate credential stuffing.
• Database access requires credentials that are not shared and not in source code.

These are our reasonable security practices for the purposes of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. No system is perfectly secure. If a breach affects your personal data we will notify you and the Data Protection Board of India as the DPDP Act requires, and we will tell you what happened rather than issue a form of words.

10. Your rights

Under the DPDP Act, 2023 you may:

• Access a summary of the personal data we hold about you and how we process it.
• Correct data that is inaccurate, and complete data that is incomplete.
• Erase data where we no longer have a lawful reason to keep it. We will tell you plainly if a tax obligation prevents erasure of a specific record.
• Withdraw consent for anything based on consent.
• Nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
• Complain to us, and escalate if we handle it badly — see section 12.

Email support@royalduftperfumes.in from the address on your account and we will respond within 30 days. We may ask you to confirm your identity first; that is to stop somebody else exercising your rights, not to obstruct you. Exercising these rights is free.

Please make requests in good faith. The Act obliges you not to file false or frivolous complaints and not to impersonate anyone.

11. Children

This site sells alcohol-based perfumery and is intended for adults. We do not knowingly collect the personal data of anyone under 18, we do not direct any advertising at children, and we do not track or profile them. If you believe a child has created an account, tell us and we will delete it.

12. Grievances and escalation

If something about how we handle your data feels wrong, reach out to:

Rahil Shaikh
support@royalduftperfumes.in
403, Doodh Naka, Lane No. 7/58, Kalyan, Dist. Thane, Maharashtra 421301, India

We acknowledge concerns within 48 hours and aim to resolve them within 30 days. If you are still not satisfied, you may complain to the Data Protection Board of India. You must give us the chance to respond first.

13. Changes to this policy

We may update this policy. The date at the top of this page always reflects the current version, and the version that applies to an order is the one published when you placed it. If a change materially affects how we handle your data, we will say so rather than quietly reissue the page.

14. Related policies

See also our Terms of Service, Shipping Policy and Refunds & Cancellation Policy. Note that we take prepaid orders only and do not offer cash on delivery, so we never hold payment data on delivery.