1. Information We Collect
When you interact with our platform, we may collect the following types of information:
A. Personal Information You Provide
- Account Details: Name, email address, and phone number.
- Security Information: Encrypted (hashed) passwords and OTP tokens. Raw passwords are never stored.
- Shipping & Billing Information: Delivery addresses, postal codes, city, state, and country (India only).
- Order Information: Product name, quantity, and price at time of purchase ("order snapshot").
B. Automatically Collected Information
- Activity Data: Items added to your cart, wishlist contents, and search queries.
- Payment Events: Webhook payloads and payment status updates from Razorpay — including payment IDs, order IDs, and transaction statuses. We do not store raw card numbers, CVV codes, or full bank account details.
- Tracking Information: Order delivery tracking IDs from Shree Mahavir Courier.
C. Device & Usage Information
- Technical Data: IP address, browser type, device type, and general usage patterns for security, rate-limiting, and fraud prevention.
2. How We Use Your Information
- Service Provision: Create and manage your account, process orders, and handle checkout.
- Authentication & Security: Verify identity, secure your account (including lockouts after failed login attempts), enforce rate limiting, and prevent fraud.
- Order Fulfillment: Dispatch products, share shipping details with logistics partners, and provide tracking updates.
- Customer Support: Assist with inquiries, refunds, returns, and order issues.
- Transactional Communications: Order confirmations, shipping notifications, refund confirmations, and security alerts via email.
- Platform Improvement: Analyse usage patterns, track low-stock inventory, and improve product offerings.
5. Data Security
We implement strict security measures to protect your personal data:
- Password Hashing: All passwords are cryptographically hashed using bcrypt. No plaintext password is ever written to disk.
- Payment Verification: All payment callbacks are verified using HMAC-SHA256 signatures in compliance with Razorpay's security standards.
- Encrypted Communication: All communication uses HTTPS/TLS encryption.
- Role-Based Access Controls: Administrative access is gated by role-based authentication and logged in an admin audit trail.
- Content Security Policy (CSP): Our website enforces a strict CSP to prevent XSS and unauthorized resource loading.
- Rate Limiting: Login, registration, and checkout endpoints are protected by distributed rate limiting to prevent brute-force attacks.
- Atomic Transactions: Order creation, payment verification, and stock decrement happen within a single atomic database transaction.
6. Data Retention
We retain your personal information only for as long as necessary to:
- Fulfill the purposes described in this policy.
- Comply with our legal and tax obligations under applicable Indian law.
- Resolve disputes and enforce our agreements.
Order snapshots and payment event logs are retained for a minimum of 7 years as required under Indian financial regulations. You may request deletion of your account and personal data (except where legally required) by contacting us.
7. Your Rights
Access
Request a copy of the personal data we hold about you.
Correction
Request correction of inaccurate personal information.
Deletion
Request deletion of your personal data, subject to legal retention requirements.
Withdrawal of Consent
Withdraw consent for specific processing activities where applicable.
Data Portability
Request a structured, machine-readable copy of your data.
To exercise any of these rights, please contact us at privacy@urbanyx.store.
8. Children's Privacy
Our Service is not directed at persons under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has provided us with personal information, we will delete it promptly.
9. Third-Party Links
Our website may contain links to third-party websites or services (e.g., Razorpay payment pages, Shree Mahavir Courier tracking). We are not responsible for the privacy practices or content of these third-party sites. We encourage you to read their privacy policies before providing any personal information.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The updated version will be indicated by an updated "Last Updated" date. Where changes are material, we will notify you via email or a prominent notice on our website.
11. Grievance Officer
In accordance with the Information Technology Act, 2000, and the rules made thereunder, the name and contact details of our Grievance Officer are:
Name: Urbanyx Support Team
Email: privacy@urbanyx.store
Address: Mumbai, Maharashtra, India
Response Time: Acknowledgement within 48 hours; resolution within 30 days.
12. Contact Us
If you have any questions or concerns about this Privacy Policy or our data handling practices, please contact us:
Email: privacy@urbanyx.store
Website: www.urbanyx.store