Legal

Privacy Policy

Last updated: [[DATE]]

1. Who we are

This website and the twozip brand are run by [[COMPANY LEGAL NAME]] ("we", "us"), a [[ENTITY TYPE, e.g. private limited company / LLP / proprietorship]] with its registered office at [[REGISTERED ADDRESS]]. Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary for the personal data described here.

2. What we collect

• Waitlist sign-ups: your email address (and name, if you give it).
• Orders and pre-orders: name, email, phone number, shipping and billing address, order details, and your GSTIN if you ask for a business invoice.
• Payments: handled by [[PAYMENT PROVIDER, e.g. Razorpay]]. We receive a payment confirmation and reference ID. We never see or store your full card number, UPI PIN or net-banking details.
• Messages: anything you send us by email, WhatsApp, Instagram DM or our forms.
• Site usage: pages viewed, device and browser type, approximate location and referral source, collected through cookies and similar tools (see section 7).

3. Why we use it

• To take, confirm, ship and support your order or pre-order, including delivery updates.
• To process refunds, returns, cancellations and warranty claims.
• To issue GST invoices and keep the records Indian tax and accounting law requires.
• To send launch, restock and offer emails, only if you opted in. Every email has an unsubscribe link.
• To keep the site secure, prevent fraud and understand what's working so we can improve it.

We use your data either with your consent, or because you gave it to us for a specific purpose (like placing an order), or because the law requires it. You can withdraw consent at any time, and withdrawing is as easy as giving it. Withdrawing doesn't undo anything we lawfully did before.

4. Who we share it with

Only partners who help us run the business, and only what they need:

• Payment gateway: [[PAYMENT PROVIDER]]
• Courier and logistics: [[LOGISTICS PARTNER(S)]]
• Email, waitlist and forms: [[EMAIL / FORM PROVIDER, e.g. Brevo, Formspree, Tally]]
• Website hosting: [[HOSTING PROVIDER, e.g. Vercel]]
• Analytics and ads (if enabled): [[e.g. Google Analytics, Meta Pixel]]

We may also share data when the law requires it, for example with tax authorities or in response to a valid legal order. We do not sell your personal data.

Some of these providers may store or process data outside India. Where they do, we only use providers in countries the Government of India has not restricted, and we follow the safeguards the law requires.

5. How long we keep it

• Order and invoice records: [[RETENTION PERIOD FOR ORDER/TAX RECORDS, confirm with your CA]].
• Waitlist and marketing emails: until you unsubscribe or ask us to delete them.
• Support messages: [[RETENTION PERIOD FOR SUPPORT MESSAGES]].

After that we delete or anonymise it, unless the law requires us to keep it longer.

6. Your rights

Under the DPDP Act you can:

• Ask for a summary of the personal data we hold about you and who we've shared it with.
• Ask us to correct, complete or update it.
• Ask us to erase it (unless the law makes us keep it, for example invoices).
• Withdraw consent for marketing or any other consent-based use.
• Nominate someone to exercise these rights for you if you die or become unable to.
• Raise a grievance with us and, if you're not satisfied with our answer, complain to the Data Protection Board of India.

To use any of these rights, email [[PRIVACY EMAIL]] from the email address linked to your order or sign-up. We'll reply within [[RESPONSE TIME, e.g. 7 working days]].

7. Cookies and analytics

We use a small number of cookies to make the site work and, if enabled, to measure visits and ad performance ([[LIST TOOLS, e.g. Google Analytics 4, Meta Pixel]]). You can block or delete cookies in your browser settings. The site still works without analytics cookies.

8. Under 18?

We don't knowingly collect personal data from anyone under 18 without a parent or guardian's consent. If you're under 18, please ask a parent or guardian to place the order or sign up for you. If we learn we've collected a minor's data without that consent, we'll delete it.

9. Keeping it safe

We use reputable providers, HTTPS across the site, and limit who on our team can access customer data. No system is perfect, but if a breach affects your personal data, we'll tell you and the authorities as the law requires.

10. Changes

If we change this policy, we'll update the date at the top. For significant changes, we'll also email customers and waitlist members.

11. Questions and grievances

Email [[PRIVACY EMAIL]] or contact our Grievance Officer. Their details are on our Contact & Grievances page.