Privacy Policy

1. What Personal Data We Collect

We collect only the data needed to run our store and serve you:

• Account data — name, email address, phone number, and a securely hashed password when you register.
• Order & delivery data — shipping address, order history, and payment status (payments are processed by Razorpay; we never see or store your card details).
• Communications — messages you send through the contact, wholesale, or feedback forms, and photos you choose to upload with feedback.
• Newsletter data — your name and email if you subscribe.
• Technical data — anonymous usage analytics (Google Analytics, Microsoft Clarity) and, only if you accept our cookie banner, the Meta Pixel for ad measurement.

2. How We Use Your Data

• To process and deliver your orders, including sharing your delivery address with our shipping partner (Shiprocket).
• To send order confirmations, delivery updates, and password-reset emails.
• To respond to contact, wholesale, and support enquiries.
• To send the newsletter you subscribed to (you can unsubscribe at any time).
• To keep the site secure — rate limiting, fraud prevention, and abuse detection.

3. Who We Share Data With

We never sell your personal data. We share it only with the service providers required to fulfil your order:

• Razorpay — payment processing.
• Shiprocket — shipping and delivery.
• Amazon Web Services — secure hosting and file storage (India region, ap-south-1).
• Google / Microsoft / Meta — analytics and (only with your consent) advertising measurement.

4. Storage & Security

• All traffic is encrypted with HTTPS.
• Passwords are stored only as bcrypt hashes — we cannot read them.
• Data is stored on servers located in India (AWS ap-south-1, Mumbai).
• Login and sensitive endpoints are rate-limited to prevent abuse.
• We retain order records as required by Indian tax and consumer-protection law, and delete or anonymise data that is no longer needed.

5. Cookies & Tracking

Essential cookies (login session, shopping cart) are always active because the store cannot work without them. The Meta Pixel — a marketing cookie — loads only after you click Accept on our cookie banner, and you can decline it with no impact on your shopping experience.

6. Your Rights (DPDP Act, 2023)

Under India's Digital Personal Data Protection Act, 2023, you have the right to:

• Access a summary of the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request erasure of your data (subject to legal retention requirements).
• Withdraw consent for non-essential processing (e.g. newsletter, marketing cookies) at any time.
• Nominate another individual to exercise these rights on your behalf.
• Raise a grievance with us and, if unresolved, with the Data Protection Board of India.

To exercise any of these rights, email us at info@rootivaorganic.com. We respond within 30 days.

7. Children

Our site is intended for adults. We do not knowingly collect personal data from children under 18. If you believe a child has provided us data, contact us and we will delete it.

8. Changes to This Policy

We may update this policy as our services or the law change. The "last updated" date below always reflects the current version, and material changes will be announced on the site.