Privacy Policy

DRAFT — pending client legal sign-off. This document is a working draft prepared for KareEx and is not legal advice. It must be reviewed and approved by the client and/or their counsel before publication. Every [CONFIRM: …] placeholder must be completed with a verified value before go-live.

Privacy Policy

Last updated: [CONFIRM: effective date] · Applies to the website aygay.in operated under the brand KareEx.

This Privacy Policy explains how [CONFIRM: registered legal entity name and type, e.g. "___ Private Limited" / proprietorship] ("we", "us", "our"), operating the KareEx storefront at aygay.in, collects, uses, shares and protects your personal data. We are committed to handling your data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable rules. For the purposes of the DPDP Act, we act as the Data Fiduciary for the personal data you provide.

1. Who we are (Data Fiduciary)

  • Legal entity: [CONFIRM: registered legal name and entity type]
  • Registered address: 5/219A Purana Kanpur, Kanpur, Uttar Pradesh 208002, India
  • GSTIN: [CONFIRM: GSTIN]
  • Contact email: admin@aygay.in
  • Customer-care phone: [CONFIRM: phone number]

2. What personal data we collect

We collect the following categories of data:

  • Identity & contact data: name, delivery and billing address, email address, phone number.
  • Order & transaction data: products ordered, order value, payment status, and (for prepaid orders) payment confirmation tokens returned by our payment gateway. We do not store your full card, UPI or bank credentials.
  • Communications: messages you send us by email, WhatsApp, contact form or chat, and our replies.
  • Technical & usage data: IP address, device and browser type, pages viewed, and referring links.
  • Cookies, pixels & analytics identifiers: data collected through cookies and similar technologies, including analytics identifiers and the Meta advertising pixel. Non-essential trackers (advertising and analytics) are loaded only after you give affirmative consent (see Section 6).

Purchasing a maternity or postpartum support product does not, by itself, require us to collect any health or medical information, and we ask you not to send us diagnostic or condition information. We do not knowingly build health profiles of our customers.

3. Why we use your data (purposes)

  • To process, fulfil and deliver your orders, and to issue tax invoices.
  • To communicate with you about your order, delivery and returns.
  • To provide customer support and respond to your queries and grievances.
  • To process payments and refunds through our payment partner.
  • To operate, secure and improve our website, and to detect and prevent fraud.
  • With your consent, to send marketing communications and to measure and improve our advertising and website performance through analytics and advertising pixels.
  • To comply with our legal, tax and accounting obligations.

4. Third parties we share data with

We share the minimum data needed with the following categories of Data Processors and service providers. Each processes your data only to provide services to us and under contractual data-protection terms:

  • Payments — Razorpay: to process prepaid payments and refunds. You interact with Razorpay's secure payment interface directly; your payment credentials are handled by Razorpay under its own privacy policy.
  • Shipping & logistics — Shiprocket and its partner courier companies: to ship, track and deliver your order and to enable Cash on Delivery where offered. We share your name, address and phone number for delivery.
  • Advertising — Meta (Facebook/Instagram): where you have consented, the Meta pixel and related tools help us measure and improve advertising. We do not transmit condition-identifying or health data in these events.
  • Messaging — WhatsApp: where you contact us or opt in, to send order and support communications.
  • Analytics — [CONFIRM: analytics provider, e.g. Google Analytics / Shopify analytics]: where you have consented, to understand website usage in aggregate.
  • Platform & hosting — [CONFIRM: e.g. Shopify]: which hosts our storefront and processes order data on our behalf.

We may also disclose data where required by law, court order or a lawful request from a public authority, or to enforce our legal rights.

5. International transfers

Some of our service providers may process data on servers located outside India. Where this happens, we take reasonable steps and contractual safeguards so that your data continues to be protected in line with the DPDP Act. [CONFIRM: list of countries / transfer basis, if required by counsel]

6. Consent for cookies, pixels & tracking

Essential cookies needed to run the website, remember your cart and keep the site secure are always active. Non-essential trackers — advertising pixels (including Meta) and analytics — remain switched off until you give clear, affirmative consent through our consent banner. You can review, change or withdraw your choices at any time using the "Manage cookie preferences" control [CONFIRM: link/location of consent-management control]. Withdrawing consent is as easy as giving it, and does not affect the lawfulness of processing carried out before withdrawal.

7. Your rights under the DPDP Act

Subject to the conditions in the DPDP Act, you have the right to:

  • Access a summary of the personal data we process about you and how we process it.
  • Correct, complete, update or erase your personal data.
  • Withdraw consent where our processing relies on consent.
  • Nominate another person to exercise your rights in the event of death or incapacity.
  • Grievance redressal (see Section 11) and the right to register a complaint with the Data Protection Board of India.

To exercise any right, email us at admin@aygay.in. We may need to verify your identity before acting on a request.

8. How long we keep your data

We retain your personal data for as long as needed to fulfil the purposes above and to meet legal, tax and accounting requirements (for example, invoices are retained for the period required under Indian tax law). When data is no longer required, we delete or anonymise it. [CONFIRM: specific retention periods, if the client wishes to state them]

9. How we protect your data

We apply reasonable technical and organisational security safeguards appropriate to the sensitivity of the data, including access controls and encryption in transit. No method of transmission or storage is completely secure, but we work to protect your data and to notify affected users and the Board of a personal-data breach where required.

10. Children's data

Our products and website are intended for adults. We do not knowingly collect personal data of children under 18 without verifiable parental consent, and we do not direct advertising to children. If you believe a child has provided us data, please contact us at admin@aygay.in.

11. Grievance Officer

If you have any complaint about how your personal data is handled, please contact our Grievance Officer:

  • Name: [CONFIRM: Grievance Officer name]
  • Designation: [CONFIRM: designation]
  • Email: [CONFIRM: grievance officer email]
  • Phone: [CONFIRM: grievance officer phone]
  • Address: 5/219A Purana Kanpur, Kanpur, Uttar Pradesh 208002, India

We will acknowledge your complaint within 48 hours and aim to resolve it within one month of receipt.

12. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date shows the latest version. Material changes will be notified on this page.