Privacy Policy

**1. Who we are**

LuxuryLoops ("we", "us", "our") operates the storefront at luxuryloops.co. For DPDP purposes we are the Data Fiduciary for the personal data we collect from customers (Data Principals).

**2. What we collect**

We collect only what we need to run the storefront:

• **Identification**: name, email, phone number, shipping/billing address.

• **Account**: a password hash if you create an account (we never see the plain password).

• **Order**: the items in your cart, the variants and quantities, your payment status (we do not store card numbers — payments go through Razorpay, who is the processor).

• **Cart abandonment**: when you type your email into checkout we save it on your cart so we can help you finish if you don't.

• **Reward + referral**: customers who join the referral or points programmes have those balances tied to their account.

• **Reviews**: review text, ratings, and any photos you attach.

• **Communication logs**: every email, Telegram alert, and notification we send you, including delivery status.

• **Technical**: aggregate, anonymised access logs (timestamp, page, user-agent, IP truncated to /24) for security and performance. Crawler bot visits are logged separately for SEO analysis and contain no personal data.

**3. How we use it**

• Fulfil your orders, send receipts, ship your pieces, and process refunds when required.

• Operate the rewards programmes (points, store credit, referrals) you opt into.

• Respond to your customer support enquiries.

• Send transactional emails: order receipts, shipping notifications, password resets, security alerts. These are not marketing — they are tied to specific actions you took.

• Send marketing emails (newsletter, abandonment reminders) **only if you opted in** (a checkbox at signup or checkout). You can unsubscribe in any such email.

• Detect fraud and protect customers from abuse (e.g., referral self-fraud checks).

• Comply with tax and accounting law (we are required to retain invoices for 8 years under GST rules).

**4. Who we share it with**

We do not sell your data. We share it only with third parties strictly necessary to deliver the service to you:

• **Razorpay** — payment processing.

• **Resend** — transactional email delivery.

• **Supabase** — database and authentication (hosted in EU; data may transit to Singapore via PostgREST endpoints).

• **Vercel** — application hosting.

• **Telegram** — *admin-side only*. We use Telegram to alert the studio team about orders and operational events. Customer data in these alerts is limited to first name, city, phone, and order details — exactly what would be on a packing slip.

• **Shipping partners** — name, phone, address required to deliver the parcel.

We have data processing agreements with each of these where the law requires them.

**5. Where we store it**

Our primary database is hosted by Supabase in their EU region. Backups are encrypted at rest. We do not transfer your data outside the regions listed above without a contractual basis.

**6. How long we keep it**

• Orders + invoices: 8 years (GST compliance).

• Customer accounts: as long as the account is active. You can delete your account at any time by emailing us — we anonymise it within 30 days but retain anonymised order history for accounting.

• Carts that never converted: 90 days, then deleted.

• Marketing-opt-in records: until you withdraw consent.

• Communication logs: 24 months.

• Crawler bot logs: 30 days.

• Studio Support (chat) transcripts: 90 days for quality + dispute resolution.

**7a. Studio Support (chatbot)**

Our storefront includes a self-serve chat widget called Studio Support that helps with sizing, order status, returns, and product questions. When you use it:

• Your messages are sent to a large-language-model provider (Google Gemini, with Groq Llama as fallback) to generate replies.

• When you are signed in, the chat sees a limited summary of your account — first name, email, last 3 orders, points balance, store credit, and referral code. It does not see card or payment details.

• Providers may retain the request briefly for abuse-monitoring per their own terms; we do not consent to your data being used for model training.

• Replies are advisory. The bot does not transact, modify orders, or promise discounts. Bespoke matters route to the studio team via the contact form.

• You can ignore the widget entirely — no policy on our side depends on you using it.

**7. Your rights (DPDP § 11–14)**

As a Data Principal under DPDP you have the right to:

• Access a summary of the personal data we hold about you.

• Request correction or erasure of inaccurate or unneeded data.

• Withdraw consent for marketing at any time (one-click unsubscribe in every marketing email).

• Nominate another individual to exercise these rights on your behalf in case of death or incapacity.

• Lodge a complaint with the Data Protection Board of India if you believe we've mishandled your data.

To exercise any of these, email **orders@luxuryloops.co** with the subject line "DPDP request". We respond within 15 business days.

**8. Children**

Our service is not directed at users under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us data, write to us and we'll delete it.

**9. Cookies**

We use essential session cookies for cart persistence, login, and abandonment recovery. We do not use third-party advertising cookies, no Google AdSense, no Facebook tracking pixel until you separately consent.

**10. Changes to this policy**

When we change this policy we update the "Last updated" date at the top. Material changes will be emailed to customers with active accounts.

**11. Contact**

For any privacy question or to exercise any of your rights: **orders@luxuryloops.co** · We respond within 15 business days as required by DPDP.