Privacy Policy

Last updated: check date before publishing

Draft - for your review. This is a starting draft, not legal advice. Before publishing, fill in the bracketed placeholders (grievance officer name, contact email, retention period) and have someone familiar with India's Digital Personal Data Protection Act, 2023 (DPDP) and the IT Act SPDI Rules confirm the language fits your business. DPDP specifically requires you to name a person who answers data-protection questions and handles grievances.

MriSa Foods ("we", "us") respects your privacy. This policy explains what personal data we collect when you use our website and place an order, why we collect it, who we share it with, and the choices and rights you have. We collect only what we need to take, confirm, and deliver your order.

What we collect

Details you give us at checkout:

Your full name
Your mobile number
Your delivery address and pincode
Your email address (optional)

Information collected automatically:

The contents of your cart and order
An anonymous device tag stored in your browser, used to keep your cart and to link the steps of a single checkout
Limited technical data: your browser type, and a one-way hashed (irreversible) form of your IP address used only to detect abuse. We never store your raw IP address.
Your approximate location (country, state, and city), derived from your IP address by our hosting provider. This is only an estimate used to understand where our visitors come from; we do not store your IP address to obtain it.
If you reach us through a marketing link, the campaign or referral parameters in that link (for example the source and campaign name), so we can understand which of our efforts bring visitors to the site.

Your cart, the device tag, and (only if you tick "save my details for next time") your checkout details are stored in your own browser's local storage. They stay on your device and are sent to us only when you place an order. You can remove them any time by clearing this site's data in your browser.

Why we use it

To process, pack, and deliver your order
To confirm your order and provide support, usually over WhatsApp
To follow up with you if a checkout was left incomplete
To meet our legal, tax, and accounting obligations
To detect and prevent fraud and abuse of the site

By entering your details and placing an order, you consent to us processing your personal data for the purposes above. You can withdraw consent at any time by contacting us, though we may not be able to fulfil an order without the details needed to deliver it.

Who we share it with

We do not sell your personal data, and we do not share it for advertising. We share it only with the service providers needed to run the store and deliver your order:

Our database and hosting providers (Supabase and Vercel) store your order and contact details securely and host the website.
Our courier partner (for example Delhivery) receives your name, address, and phone number to deliver your order.
The pincode lookup service receives only the 6-digit pincode you type, never your name or contact details.
WhatsApp / Meta, when we message you to confirm or support an order.

Our internal staff order alerts contain only an order reference and the items ordered, with no personal details, so your name, phone, and address are never sent to any external messaging tool.

How long we keep it

We keep your order and contact records for as long as needed to fulfil your order and to meet legal and tax obligations [placeholder: state your retention period, for example up to 8 years for tax records], after which they are deleted or anonymised. Incomplete or abandoned checkouts are kept for a short period for follow-up and then cleared.

How we protect it

Your data is stored in a database with row-level access controls and is reachable only through server-side secret keys that are never exposed to your browser. The site is served over HTTPS, and IP addresses are stored only in a one-way hashed form. No method of storage or transmission is completely secure, but we take reasonable measures to protect your data.

Your rights

Under the DPDP Act, 2023 you can ask us to:

Give you a summary of the personal data we hold about you and how we process it
Correct, complete, or update your details
Erase your personal data where we no longer need it
Address a grievance about how we handle your data
Nominate another person to exercise these rights on your behalf if you die or become incapacitated

To exercise any of these, message us with your order reference using the contact details below.

Children

Although our products are enjoyed by families and toddlers, the website and checkout are intended for adult purchasers. We do not knowingly collect personal data directly from children under 18. If you believe a child has provided us their data, please contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. When we do, we will change the "last updated" date above. Please check back occasionally.

Contact and grievances

For any question about this policy or to exercise your rights, reach our grievance officer, [placeholder: name], at [placeholder: contact email], or on WhatsApp. We aim to respond within the timelines required under applicable law.