Privacy policy

Who is responsible for your data

This shop is operated by KONE DWARAKAMAI, trading as Madhuramay.

We decide why and how your personal data is processed. Under the Digital Personal Data Protection Act 2023 that makes us the data fiduciary and you the data principal.

Address: Flat No. 404, Botcha Square, Birla Junction, Muralinagar, Visakhapatnam, Andhra Pradesh 530007.

Questions about this notice: support@madhuramay.com or +91 7569417778.

What we collect

When you browse

Nothing that identifies you. No cookie is set until you add something to your bag, use Buy now, sign in or place an order.

Visit statistics

Which pages are opened, for how long, the site that sent you (such as Google or Instagram), and whether you are on a phone, tablet or computer — so we can see how the shop is used. No cookie is involved and your IP address is not stored: it is combined with your browser type and a code that changes every day into a one-way scrambled value, used only to count visitors per day, and the code is deleted after two days so the value can never be traced back to you. The tab keeps a random visit number in its own temporary storage, which is cleared when you close it.

When you add to your bag

A random bag identifier in a cookie, and the items you added. No name or address. Buy now uses a separate identifier of the same kind for the one piece you are buying.

When you create an account

Your mobile number and name, your email address if you give one, and whether you asked for our emails about new arrivals.

When you sign in

Your mobile number, to which we send a one-time code by SMS; then a session identifier, the time, your IP address and your browser’s user-agent string.

When you order

Your name, delivery address, telephone number and email, and the contents and total of the order. Addresses you save and pieces you add to your wishlist are kept with your account.

When you pay

Card numbers, UPI identifiers and banking credentials are entered on the payment gateway’s own form — Razorpay’s or Cashfree’s — and never reach this site. We record only whether a payment succeeded or failed, its amount, and the reference the gateway returns.

When you use your wallet

Each top-up, refund and payment in your Madhuramay wallet, with its amount and the order it concerns.

When you ask for a return

Which pieces, what is damaged, and anything you tell us or send us about it, such as photographs.

When you join our mailing list

Your email address, and when and where on the site you signed up.

When you contact support

Whatever you choose to put in the message.

Why we collect it

Each of these is collected to do a specific thing. Nothing is collected because it might be useful later.

To perform the contract

Your address, telephone number and order contents exist so the order can be packed, dispatched, delivered and invoiced. Without them there is no order.

To tell you about your order

Your email address and mobile number are used to send your order confirmation and to tell you when it ships, is delivered, is cancelled or is refunded — by email and by SMS.

To keep your account secure

One-time codes prove the mobile number is yours. Session identifiers, sign-in times, IP addresses and user-agent strings keep you signed in, end your session when you sign out, and help us notice misuse of an account.

To send our newsletter

Only if you asked for it — from the sign-up in the footer, or by ticking the box when you created your account. We email you about new arrivals, collections and offers. To stop them, ask us at support@madhuramay.com or +91 7569417778 and we will take you off the list.

To meet legal obligations

Tax invoices and the records behind them are kept because tax and company law require them to be kept, for as long as those laws require.

How you sign in

There are no passwords on this shop. You sign in with your mobile number: we send a one-time code to it by SMS, and entering that code proves the number is yours.

We store only a hash of each code, never the code itself. A code expires after a short time and stops working after a few wrong attempts, and there is a wait before another can be sent.

We will never ask you to tell us a code. Anyone who does is not us.

Cookies we set

All four are http-only, meaning scripts on the page cannot read them, and all four are necessary for the site to work. We set no advertising or analytics cookies; our own visit statistics, described above, use none. The cookie policy has the detail.

mdh_cart

Identifies your shopping bag. Set when you first add something, and kept for 90 days from the last change to the bag.

mdh_buy_now

Identifies the one-piece checkout that Buy now starts, so it does not disturb your bag. Expires after two hours.

mdh_session

Identifies your sign-in session. Set when you sign in and removed when you sign out; the session also ends after a period without use.

mdh_order_email

Holds the email address a guest order was placed with, so that you can view the order after checkout. Expires after 30 days.

Who else sees it

Payment details go to the payment gateway that takes your payment — Razorpay or Cashfree — which processes it and is responsible for that data under its own policy. We never receive or store them.

Your mobile number and the text of each message go to MSG91, which delivers our sign-in codes and order text messages.

Your email address and the content of each email go to the email service provider that delivers our emails.

Delivery details — your name, address and telephone number — go to Shiprocket and the courier partner it assigns to your parcel, because a parcel cannot be delivered without them.

We do not sell personal data, and we do not share it for anyone else’s advertising.

How long we keep it

An order and its invoice are kept for as long as tax and company law require records of a sale to be kept.

A guest bag that is never checked out expires after 90 days. A session stops working when you sign out of it or it expires.

Anything else we hold about you can be erased on request — see Your rights, below.

Your rights

Under the Digital Personal Data Protection Act 2023 you may ask us for a summary of the personal data we hold about you and what we do with it; ask us to correct or complete anything inaccurate; ask us to erase data we no longer need for the purpose it was collected for; and nominate someone to exercise these rights if you die or become unable to exercise them yourself.

Erasure has one limit worth stating plainly: we cannot delete an invoice, or the order behind it, while the law requires us to keep it. Everything not held for that reason can go.

To make any of these requests, contact us at support@madhuramay.com or +91 7569417778.

Children

This shop is not intended for children, and an account should be opened only by someone aged eighteen or over. We do not knowingly collect data about children, and will delete it if we find that we have.

If something goes wrong

If a request or a complaint is not resolved through support, contact madhuramay3@gmail.com or +91 83747 84337. This is the grievance contact published under India’s Information Technology (Intermediary Guidelines) Rules and the Consumer Protection (E-Commerce) Rules 2020.

A grievance is acknowledged within 48 hours of being received and resolved within one month, which is what those rules require of us.

If you remain dissatisfied, the Digital Personal Data Protection Act gives you a right to complain to the Data Protection Board of India.

Changes to this notice

When this notice changes, the date at the top of the page changes with it. We do not revise it quietly.