Privacy Policy

We collect only what a stated purpose actually needs:

• Account details (name, email, phone) — to create and secure your account.
• Order details (delivery address, items, payment reference) — to price, fulfil, deliver and invoice your order.
• Payment data — card and UPI credentials are entered directly with our PCI-DSS certified payment gateway. We never receive or store your card number.
• Business details (GSTIN, company name) — only if you register as a B2B buyer.
• Usage data — only where you have consented to analytics.

We ask separately for each purpose. Essential processing (running your cart, completing your order, security) is necessary to provide the service. Marketing messages and behavioural analytics are off by default and only happen if you switch them on. You may withdraw any consent at any time from your account's Privacy settings — withdrawing is as easy as giving it.

Every consent decision is recorded in an immutable ledger with a timestamp and the version of this notice you were shown, so there is always a clear record of what you agreed to.

• Access — download a machine-readable copy of your data at any time.
• Correction — update your details from your account.
• Erasure — delete your account and have your personal data removed.
• Grievance redressal — raise a concern with the officer named below.

Access and erasure are self-service from your account.

When you delete your account we remove your personal identifiers and scrub your name, phone and street address from historic orders. We retain the financial record of your invoices (amounts, tax, invoice number, and the state for place-of-supply) because Indian tax law requires us to keep them. Marketing data is purged when you withdraw consent.

Payment and identity data are stored in India. De-identified error and performance telemetry may be processed outside India by our infrastructure providers, with personal data stripped before it leaves.

Accounts are for adults (18+). We sell toys to grown-ups who buy them for children. We do not knowingly collect data from children, we never ask a child for a date of birth, and we do not profile or target advertising at minors.

We use encryption in transit, hashed passwords, optional two-factor authentication, strict access controls for staff, and audit logging of privileged actions. If a personal-data breach occurs we will notify affected users without undue delay and report it to the Data Protection Board within 72 hours.