Privacy Policy

Last updated: 28 October 2026

Rijuvenation ("Rijuvenation", "we", "us" or "our") runs the online store at rijuvenation.store. This Privacy Policy explains how we collect, use, share, store and protect your personal data when you browse the store, create an account, place an order or contact us. It applies to the store and to any subdomain we use for shopping.

For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), Rijuvenation is the Data Fiduciary for the personal data described in this policy.

1. Who we are and how to contact us

Privacy requests are handled by our Grievance Officer, whose details are in section 13.

2. Personal data we collect

We collect only the data we need to run the store. Depending on how you use it, this may include:

• Account data: your name, email address, mobile number, password (stored only as a secure hash), saved addresses and order history when you create an account.
• Order and delivery data: the items you buy, size and quantity, order value, delivery and billing addresses, phone number, email address, delivery instructions and order status.
• Payment data: the payment method, amount, Razorpay order and payment identifiers, and payment status. Card numbers, CVV values, UPI PINs and bank credentials are entered on Razorpay's secure interface and are not stored by us.
• Communications: emails and messages you send to our support address, including any attachments and the contact details you use.
• Cart and checkout data: the contents of your bag and a checkout identifier that lets us keep your bag and order in progress.
• Device and usage data: IP address, browser and operating system, referring page, pages viewed, search terms and timestamps. We may derive an approximate location, at city level, from your IP address.
• Session replay data: a recording of how you interact with the store, described in section 4.

3. Cookies and local storage

We use a small number of first-party cookies and local storage entries. We do not use advertising or cross-site tracking cookies.

• checkoutId-in (cookie, session): remembers your bag and checkout while you shop. Strictly necessary.
• token (cookie, 1 hour) and refreshToken (cookie, 30 days): keep you signed in after you log in. Strictly necessary and HTTP-only.
• Saleor authentication cookies (cookie, 15 minutes for access and 7 days for refresh): used by our authentication library to keep your session active. Strictly necessary.
• rrweb_session_id (local storage, persistent): a random identifier used to group session recordings. Functional and analytics.

You can clear or block cookies in your browser settings. Blocking the strictly necessary cookies will stop the bag, checkout and login from working. Clearing rrweb_session_id does not stop recordings, but it breaks the link between new recordings and your earlier sessions.

4. Session replay

We use an open-source session replay tool called rrweb to record how visitors use the store. A recording may include the pages you view, clicks, scrolling, mouse movements, the content of form fields you fill in (such as your name, email address, phone number and address), your browser and device details, and the times of your visits. We use recordings to diagnose errors, improve the checkout experience and detect fraud or abuse.

We do not intentionally record payment card details, CVV values or UPI PINs, because those are entered on Razorpay's interface. Recordings are stored on infrastructure we control and are kept for up to 30 days. You can ask us to delete recordings linked to you by emailing orders@rijuvenation.store.

5. How we use your personal data

We use personal data to:

• process and deliver your orders, including sharing your address and phone number with our courier partners;
• take payments and issue refunds through Razorpay;
• create and manage your account, including login and password reset;
• respond to your questions, requests and complaints;
• send service messages about your order, such as confirmation, dispatch and delivery updates;
• send marketing emails if you have opted in, which you can stop at any time;
• prevent fraud, abuse and misuse of the store, and protect our legal rights;
• understand how the store is used so that we can improve it; and
• comply with tax, accounting, consumer protection and other legal obligations.

6. Legal basis for processing

We process personal data on the basis of your consent, to perform our contract with you (for example, to fulfil an order), to comply with legal obligations, and for legitimate uses permitted under the DPDP Act. Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that has already happened, or processing that we must continue for legal reasons.

7. Who we share personal data with

We do not sell or rent your personal data. We share it only with service providers who help us run the store, and only as much as they need:

• Razorpay, our payment gateway, to process payments and refunds;
• our courier partners, currently Blue Dart and Delhivery, to deliver your order;
• our email delivery provider, to send order and account emails;
• our e-commerce platform and hosting providers, which store the store's database, media and backups;
• our session replay tooling, described in section 4;
• professional advisers, auditors and insurers, where necessary; and
• government authorities, courts or law enforcement, where we are legally required to disclose data or need to establish, exercise or defend legal claims.

These providers must protect your data and may use it only for the services they provide to us. Some providers may process data outside India. Where that happens, we take the steps required by applicable law to protect the data.

8. How long we keep personal data

• Account data: while your account is open, and for 30 days after you ask us to delete it, so that we can deal with any related request or dispute.
• Order, invoice and payment records: for 8 years from the end of the financial year in which the order was placed, as required by Indian tax and accounting law.
• Support conversations: for 2 years after the conversation ends.
• Session recordings: for up to 30 days.
• Server and security logs: for up to 90 days.
• Marketing preferences and consent records: until you withdraw consent, plus a short period to record the withdrawal.

When data is no longer needed, we delete it or make it anonymous.

9. How we protect personal data

We use HTTPS across the store, hash passwords, limit access to personal data to people who need it, and rely on Razorpay for card and UPI processing so that sensitive payment credentials do not pass through our servers. No method of transmission or storage is completely secure, so we cannot promise absolute security. If a personal data breach affects you, we will notify you and the Data Protection Board of India as required by the DPDP Act.

10. Your rights

Under the DPDP Act, you have the right to:

• access a summary of the personal data we hold about you and how we process it;
• ask us to correct, complete or update inaccurate or incomplete data;
• ask us to erase your data, subject to legal retention requirements;
• withdraw consent, where we rely on it;
• nominate another person to exercise your rights in the event of your death or incapacity; and
• complain to us, and if the complaint is not resolved, to the Data Protection Board of India.

To exercise these rights, email orders@rijuvenation.store from the address linked to your account, or write to us at the address in section 1. We may ask for information to verify your identity. We aim to respond within 30 days.

11. Children

The store is intended for people aged 18 or over. We do not knowingly collect personal data from children. If you are under 18, please use the store only with the involvement of a parent or guardian. If you believe that a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy to reflect changes in the law or in our practices. We will post the new version here and change the "Last updated" date. If a change materially affects how we use your data, we will tell you by email or with a notice on the store before the change takes effect.

13. Grievance officer and contact

For questions, requests or complaints about privacy, email us. Email: orders@rijuvenation.store.

We aim to acknowledge your complaint within 3 business days and resolve it within 30 days, or explain why we need more time.