1. Data We Collect
We collect information you provide directly to us when you make a purchase, create an account, sign up for our newsletter, submit a contact form, or interact with our customer support. This includes:
- Identity data: Name, email address, phone number
- Delivery data: Shipping address, pincode, city, state
- Transaction data: Order history, payment confirmation (we do not store card numbers, UPI PINs, or bank credentials — see Section 3)
- Communication data: Support tickets, contact form messages, review submissions
- Account data: Firebase authentication ID, login method (Google, email)
2. Automatically Collected Data (Cookies & Analytics)
When you visit fatso.co.in, we automatically collect certain technical data through cookies and analytics tools to improve your experience and understand how our site is used. This includes:
- Device information: Browser type, operating system, screen resolution
- Usage data: Pages visited, time spent, click patterns, scroll depth
- Network data: IP address (anonymized where possible), approximate geolocation (city-level)
- Referral data: How you arrived at our site (search engine, social media, direct link)
3. How We Use Your Data
We use your personal data only for legitimate purposes directly related to operating our business and serving you:
- Processing and fulfilling your orders, including payment verification and shipping
- Communicating order updates, dispatch notifications, and delivery tracking
- Responding to support requests, complaints, and contact form submissions
- Sending marketing communications (newsletters, product launches, offers) — only if you have opted in. You can unsubscribe at any time via the link in every email
- Improving our website, product offerings, and customer experience through anonymized analytics
- Preventing fraud, enforcing our terms, and complying with legal obligations
4. Data Storage, Security & Retention
Your data is stored securely on servers provided by Supabase (PostgreSQL database) and Vercel (website hosting), with data centres that comply with international security standards.
We implement robust technical and organizational measures to prevent unauthorized access, data breaches, alteration, or destruction. These include encrypted connections (256-bit SSL/TLS), access controls, and regular security reviews.
Payment processing is handled entirely by Razorpay, a PCI-DSS Level 1 compliant payment gateway. We never receive, store, or have access to your full card numbers, CVV, UPI PIN, or net banking credentials.
We retain your personal data only for as long as necessary to fulfill the purposes described in this policy. Specifically:
- Order and transaction data: Retained for 8 years to comply with Indian tax and accounting requirements
- Account data: Retained until you delete your account or request erasure
- Marketing consent records: Retained for the duration of your subscription plus 1 year
- Support communication: Retained for 3 years from the date of resolution
- Analytics data: Aggregated and anonymized within 26 months (Google Analytics default retention)
5. Third-Party Sharing & Data Processors
We do not sell, rent, or trade your personal data to third parties for their marketing purposes. We share data only with trusted service providers who process it on our behalf to operate our business:
- Payment processing: Razorpay (PCI-DSS compliant)
- Shipping & logistics: BlueDart, Delhivery, Xpressbees (name, address, phone for delivery)
- Authentication: Firebase/Google (login credentials and session management)
- Hosting & infrastructure: Vercel, Supabase
- Analytics: Google Analytics 4, Google Tag Manager, Microsoft Clarity (anonymized usage data)
- Email communications: For order confirmations and marketing (if opted in)
6. Cross-Border Data Transfers
Some of our service providers (e.g., Google, Vercel) may process data outside India. Where this occurs, we ensure that appropriate safeguards are in place, including contractual obligations that meet the standards set by the DPDP Act 2023.
We comply with all applicable data localization requirements under Indian law. Payment and financial data is processed within India by Razorpay.
7. Your Rights Under the DPDP Act 2023
As a Data Principal under the Digital Personal Data Protection Act 2023, you have the following rights:
- Right to Information: Know what personal data we collect and how it is processed
- Right to Correction: Request updates or corrections to inaccurate personal data
- Right to Erasure: Request deletion of your personal data, subject to legal retention requirements
- Right to Withdraw Consent: Withdraw consent for data processing at any time (this does not affect processing done before withdrawal)
- Right to Grievance Redressal: File a complaint with our Data Protection Officer or the Data Protection Board of India
- Right to Nominate: Nominate another person to exercise your rights in case of your death or incapacity
8. Children's Data, Grievance Officer & Contact
Our website and products are not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
In accordance with the DPDP Act 2023 and the Information Technology Act 2000, our Data Protection / Grievance Officer can be reached at: support@fatso.co.in
We will acknowledge your request within 24 hours and aim to resolve it within 15 business days. If you are not satisfied with our response, you may escalate your concern to the Data Protection Board of India.
This Privacy Policy may be updated periodically. Changes will be posted on this page with an updated date. We encourage you to review this page regularly. Continued use of fatso.co.in after changes constitutes acceptance of the updated policy.