Privacy Policy

KoshurWaan is a direct-to-consumer store for Kashmiri craft, operated by Legal entity name — to be completed, a Entity type — to be completed with its principal place of business at Registered address — to be completed.

Under India’s Digital Personal Data Protection Act 2023 we are the data fiduciary for the personal data described here — meaning we decide what is collected and why, and we answer for it.

We collect only what an order needs. There is no profiling, no data broker, and nothing gathered speculatively in case it is useful later.

Your account

Name, email address and password. Optionally a phone number, date of birth and gender if you choose to add them to your profile. Your password is stored only as a bcrypt hash, which cannot be reversed to reveal it.

Delivery addresses

The recipient's name and phone number, the address lines, landmark, city, state and pincode. Kept only for addresses you save yourself.

Orders

What you bought, in what size or colour, the quantity and the price, the delivery address as it stood when you ordered, and the status history of the parcel.

Payments

The Razorpay order and payment identifiers, the amount, and whether the payment succeeded. We never receive or store your card number, CVV, UPI PIN or netbanking credentials — those are entered inside Razorpay's own payment window.

Cart and wishlist

The items you have saved or left in your basket, so they follow you between your phone and your laptop once you are signed in.

Reviews

Your rating and what you wrote, published alongside the first name on your account and a note of whether the purchase was verified.

Technical records

Server logs holding your IP address and the pages requested, and short-lived rate-limiting counters. These are what stop password guessing and stolen-card testing.

Notifications

If you allow notifications in the mobile app, the push token your device issues, its platform, and a device identifier — so an order alert reaches the right phone and stops when you sign out.

Worth stating plainly, because a shopping app is not usually able to say it:

• No advertising identifier, and no advertising of any kind.
• No third-party analytics or tracking SDK. We do not use Google Analytics, Facebook Pixel, or any equivalent.
• No location data, precise or approximate. Delivery goes to the address you type.
• No access to your contacts, photos, camera, microphone, calendar or files.
• No purchase or browsing data sold, rented or shared with anyone for their own marketing.

Each of these is a purpose, not a category — we do not repurpose data quietly.

• To take, charge for, pack, ship and support an order, which is the contract you entered into with us.
• To keep your account working — signing you in, showing your order history, and letting you change your details.
• To meet legal obligations, chiefly retaining invoices and tax records.
• To keep the store secure: rate limiting, fraud prevention and abuse investigation.
• To send you marketing, only if you have separately opted in, and only until you opt out.

We use a small number of service providers to run the store. They process data on our instructions and for no other purpose. We do not sell personal data.

Razorpay Software Private Limited

Processes card, UPI and netbanking payments. Name, email, phone and the order amount. Card and UPI credentials are entered inside Razorpay's own payment window and never reach our servers.

MongoDB Atlas

Hosts the database holding accounts, addresses and orders. All account and order data, encrypted at rest.

Cloudinary

Stores and delivers product photography. No customer data. Product images only.

Vercel

Hosts the website and the API. Server access logs, including IP address and request paths.

Upstash

Rate limiting, which is what stops password guessing and card testing. A short-lived counter keyed on an account identifier or IP address.

When a parcel ships, the recipient’s name, address and phone number are given to the courier carrying it — currently Courier partner — to be completed. We may also disclose data where a law, a court or a lawful government request requires it.

KoshurWaan sets no cookies of its own. There is no consent banner on this site because there is nothing to consent to.

Signing in stores two tokens in your browser’s local storage so you stay signed in between visits, and your basket is kept there too so it survives a refresh before you have an account. Both are cleared when you sign out. Razorpay’s payment window is served by Razorpay and may set its own cookies while you are paying, governed by their privacy policy rather than this one.

Your account

Until you delete it. There is no dormancy purge.

Unpaid orders

Cancelled automatically shortly after they are created if payment is never completed, and retained only as a cancelled record.

Completed orders

Retained for as long as tax and accounting law requires us to keep the invoice, even after you delete your account.

Push tokens

Removed when you sign out, when you delete your account, or when the notification service reports the device no longer exists.

Server logs

Held for the short window our hosting provider retains them.

You can delete your account yourself, from the website or from inside the app, at koshurwaan.com/account/delete. It takes effect immediately and support cannot undo it.

Deleting removes your name, email address, phone number, every saved address, your wishlist, your cart and your password, and signs out every device. Orders you have already placed are kept, because we are required to retain the invoice — but they are detached from your profile, and your email address is replaced with a non-identifying placeholder so the account cannot be reconstructed.

An order placed before deletion still shows the delivery name, address and phone number that were on the invoice at the time it shipped. That is a legal record of a transaction and cannot be edited after the fact.

Under the Digital Personal Data Protection Act 2023 you may ask us to:

• Tell you what personal data we hold about you and who we have shared it with.
• Correct anything inaccurate, incomplete or out of date — most of which you can edit yourself from your profile.
• Erase your data, subject to the records we must keep by law.
• Withdraw consent for marketing at any time, which takes effect for everything sent after that point.
• Nominate someone to exercise these rights on your behalf if you die or become incapacitated.

Write to Support email — to be completed and we will respond. If you are not satisfied, the Grievance Officer named below is your next step, and after that you may complain to the Data Protection Board of India.

• Every connection to the site and the API is encrypted with HTTPS.
• Passwords are stored as bcrypt hashes and are never recoverable, by us or by anyone else.
• Sign-in uses short-lived access tokens with rotating refresh tokens; deleting your account or changing your password invalidates every session at once.
• Sign-in, registration, checkout and account deletion are all rate limited.
• Card details never reach our servers, so they cannot be stolen from them.

No system is perfect. If we discover a breach affecting your personal data we will notify you and the Data Protection Board as the law requires.

KoshurWaan is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has created an account, tell us and we will delete it.

When this policy changes materially we will update the date at the top of this page and, where the change affects how we use data you have already given us, tell you directly.

Data fiduciary

Legal entity name — to be completed

Email

Support email — to be completed

Grievance Officer

Grievance Officer name — to be completed

Officer's email

Grievance Officer email — to be completed

Response time

Acknowledged within 48 hours and resolved within 30 days, as required by law.

Postal address

Registered address — to be completed

Full details are on our Contact page. This policy is published at https://koshurwaan.com/privacy.