Privacy Policy

2.1 Who we are

This website (https://onlineboutiqueshop.com) is owned and operated by Online Boutique Shop, a company incorporated in India with its registered office at [Hyderabad, India].

This Privacy Policy is a legally binding electronic contract under the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDP Act) of India. It also addresses obligations we owe to residents of the United States, the European Economic Area, and the United Kingdom when they use this site.

By using this website or placing an order, you consent to the practices described here.

2.2 Information we collect

Information you give us directly:

  • Full name.
  • Shipping and billing address.
  • Email address and phone number.
  • Payment method details (processed by our payment gateways; we do not store full card numbers on our servers).
  • Order history and product preferences.
  • Communications you send us (emails, WhatsApp messages, chat transcripts).
  • If you create a customer account: username, password (stored as a salted hash), and any profile details you add.

Information we collect automatically:

  • IP address and approximate location.
  • Browser type and version, operating system, device type.
  • Pages viewed, time spent, referring website.
  • Cookies and similar tracking technologies (see section 2.4).

We do not collect medical records, biometric data, sexual orientation, political opinion, or religious belief. If you send us any of that information voluntarily (for example, in a customer message), we don’t act on it and we delete it on request.

2.3 How we use your information

We use your information to:

  • Process and ship your orders.
  • Send order confirmations, dispatch alerts, and delivery updates.
  • Answer your questions and handle returns or exchanges.
  • Detect and prevent fraud and payment abuse.
  • Improve the website (which pages are slow, which product photos aren’t loading, which sizes get returned most).
  • Send marketing emails and SMS (only if you opted in, and you can unsubscribe from any of them).
  • Comply with our tax, accounting, and legal obligations in India and abroad.

We do not sell your personal information to third parties. We do not share it with advertisers for the purpose of building an ad profile of you.

2.4 Cookies and tracking

We use cookies and similar technologies to keep you logged in, remember your cart, understand site usage, and run marketing to people who have shown interest in our products (US and India customers only).

Categories of cookies:

  • Strictly necessary cookies: required for the site to work (login, cart, checkout). These cannot be turned off.
  • Analytics cookies: Google Analytics 4 and Microsoft Clarity, for understanding how visitors use the site. Session recordings from Clarity mask form inputs and payment fields by default.
  • Marketing cookies: Meta Pixel and Google Ads, for showing our ads to people who visited the site.

You can decline analytics and marketing cookies via the cookie banner on your first visit, or through your browser’s cookie settings at any time. Declining these cookies does not stop you from placing an order.

2.5 Third-party services we share data with

To run this business, we share limited data with the following categories of third-party service providers:

  • Payment gateways: Razorpay, Stripe, and PayPal. They see the payment amount and the card or account details you enter directly on their secure pages.
  • Shipping couriers: DHL, FedEx, Aramex, Delhivery, Blue Dart, and the US Postal Service. They see your name, shipping address, phone number, and order weight.
  • Cloud hosting: [Your host, e.g., AWS Mumbai region] for website and database hosting.
  • Email and SMS platforms: Klaviyo (email) and MSG91 (India SMS) or Twilio (US SMS).
  • Customer service tools: [e.g., Gorgias or Zendesk] for handling emails and WhatsApp messages.
  • Analytics: Google Analytics 4, Microsoft Clarity (behavioral analytics, session recordings with sensitive-field masking).
  • Advertising platforms: Meta (Facebook and Instagram Ads) and Google Ads.

Each of these providers has its own privacy policy. We use providers that offer standard contractual clauses and data-processing agreements consistent with Indian, US, and EU standards.

We share data with law enforcement, courts, or government agencies only when we’re legally required to (a valid court order, subpoena, or lawful government request under Indian law).

2.6 International data transfers

Because we’re based in India and serve US customers, your personal data will be transferred to and stored in India. Some of our sub-processors (Stripe, PayPal, Google, Meta, AWS) may also process your data in the United States or the European Union.

Where required, we rely on standard contractual clauses and other lawful transfer mechanisms for cross-border data transfers.

2.7 Data retention

We hold your information for as long as we need it to run the business and meet legal obligations:

  • Order and invoice records: 8 years from the transaction date (Indian tax law requirement).
  • Customer account data: until you request deletion.
  • Marketing preferences: until you unsubscribe.
  • Website analytics data: 14 months (default for Google Analytics 4).
  • Support conversations: 3 years from the last message.

2.8 Your rights

Depending on where you live, you have some or all of the following rights over your personal data:

  • Access: ask for a copy of the personal data we hold about you.
  • Correction: ask us to fix incorrect information.
  • Deletion: ask us to delete your data (subject to our tax and legal retention obligations).
  • Withdrawal of consent: withdraw your consent for marketing at any time via the unsubscribe link in any marketing email or by writing to us.
  • Portability: ask us for your data in a common machine-readable format.
  • Objection: object to processing based on our legitimate interests.

California residents: you have the additional rights granted under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to opt out of sale or sharing (we don’t sell your data), and the right to non-discrimination for exercising these rights.

EU and UK residents: you have the rights granted under the GDPR and UK GDPR, including the right to lodge a complaint with your local data protection authority.

To exercise any right, email us at [info@onlineboutiqueshop.com] from the email address on your account. We respond within 30 days.

2.9 Children’s privacy

This website is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us with personal information, please email [info@onlineboutiqueshop.com] and we’ll delete it.

2.10 Data security

We use industry-standard security measures: HTTPS across the whole site, encrypted databases, salted password storage, restricted employee access on a need-to-know basis, and quarterly security reviews. We do not store full payment card numbers on our servers.

No system on the internet is fully secure. If a data breach affects your personal information, we’ll notify you and the relevant authorities within the timeframes required by law.

2.11 Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we’ll notify you by email (if you have an account) or through a prominent banner on the website. The updated policy takes effect on the “Effective date” listed at the top.

2.12 Contact for privacy questions

For any general privacy question, write to [info@onlineboutiqueshop.com].

Scroll to Top