Privacy policy

What we collect

• Account: your mobile number, and optionally your name, email address and date of birth (for birthday surprises).
• Addresses: recipient name, phone, postal address and optional delivery notes you save.
• Orders: items bought, prices, coupons used, payment method and status. We never see or store full card numbers or UPI PINs.
• Content you create: wishlist items, product reviews, review photos and videos, return requests.
• Technical: an authentication session, plus basic device and error information used to keep the store secure and working.

Why we use it

• To verify your phone number and keep your account secure.
• To price, pack, ship and support your orders, and to calculate GST invoices correctly.
• To credit loyalty points and prevent coupon abuse.
• To send transactional messages about your order. Marketing email is opt-in and one click to leave.
• To meet Indian tax and accounting obligations, which require us to retain invoice records.

Who can see it

Our staff see what their role needs. An inventory manager cannot read customer addresses; a support agent cannot change payment settings. Every admin action on customer or order data is written to an append-only audit log with the person, time and change.

We use Google Firebase (Authentication, Firestore and Cloud Storage) to run the store, and a payment gateway when online payments are enabled. These providers process data on our instructions. We do not sell personal data, and we do not share it with advertisers.

Cookies and local storage

We keep your sign-in session and your cart in your browser so the store works between visits. We do not run advertising trackers. Analytics, where enabled, is aggregated and does not identify you personally.

How long we keep it

• Account data stays until you delete your account.
• Order and invoice records are retained for eight years as required by tax law, then anonymised.
• Review photos and videos stay until you delete them or ask us to.
• Support messages are deleted 24 months after the conversation closes.

Your controls

• Edit your name, email and addresses in Account → Profile and Account → Addresses.
• Download or correct your data by writing to us — we respond within 30 days.
• Delete your account in Account → Privacy, or by email. Orders in transit must complete first; after deletion we keep only the invoice records the law requires.
• Unsubscribe from marketing in one click from any email, or from Account → Profile.

Children

Our store is intended for adults buying for children. We do not knowingly let a child create an account, and we never ask for a child’s date of birth, photo or contact details.

Security

Access to customer data requires an authenticated, verified session. Administrative writes are validated on trusted servers, and the database itself denies reads and writes that are not explicitly allowed. If a breach ever affects your data, we will tell you and the relevant authority without undue delay.

Contact

Privacy questions and requests: hello@paapanest.in. Postal address: 38, Indiranagar 100ft Road, Bengaluru 560038, Karnataka.