Privacy Policy

THE AARZOO ("we", "the house") operates theaarzoo.com. This policy explains what we collect, why, and how you can ask us to change or delete it. Questions: hello@theaarzoo.com.

What we collect

• Account: name, email, and — if you choose — mobile number for a one-time sign-in code. We do not store a password.
• Orders: shipping address, PIN code, bag contents, payment method (COD or online), and the payment reference returned by our payment processor. Card and UPI details are entered directly on Razorpay's secure interface — we never see or store full card numbers, CVV, or UPI PINs.
• Taste: Desire (wishlist), preferred world (ROJ / NOOR / RAAT), and concierge messages kept in this browser session.
• Device and usage: cookies needed to keep you signed in and remember the bag, plus first-party analytics (page path, referring page, product viewed, add-to-bag events, and a session identifier) so we can see which pieces and pages the house needs to improve.

Payments — Razorpay

Online payments are processed by Razorpay Software Private Limited, a PCI-DSS Level 1 certified payment gateway regulated in India. When you pay online, Razorpay receives your name, email, mobile number, order amount, and the payment instrument you choose; it processes that data under its own privacy policy. We receive back only a payment ID, order ID, and status, which we verify and store against your order. Cash-on-delivery orders do not go through Razorpay.

Sign-in — Google and one-time codes

If you sign in with Google, Google shares your name, email address, and profile picture with us under Google's privacy policy; we do not receive your Google password. If you sign in with a one-time code, we store a hashed copy of the code for a few minutes to verify it, then delete it. Sign-in codes are sent by our email and SMS delivery partners solely to reach you.

Cookies and analytics

We use a small number of first-party cookies: a session cookie that keeps you signed in (httpOnly, secure), a bag cookie so your pieces stay put, and a preference cookie for your chosen world. Our analytics are first-party and run on our own servers — we do not load Google Analytics, Meta Pixel, or other third-party advertising trackers, and we do not build advertising profiles or sell data. Razorpay and Google set their own cookies only on the pages where you use their services (checkout and sign-in). You can clear or block cookies in your browser; signed-in features will stop working until you sign in again.

How we use it

To fulfil orders, verify payments, confirm PIN-code delivery, run returns, send dispatch notes, prevent fraud, keep the Site secure, and — if you join — house updates you can leave at any time. We do not sell her list. We share only what a courier, payment partner, or messaging provider needs to complete the order or deliver a message, and only under contracts that limit their use of the data.

How long we keep it

• Account details (name, email, mobile, Desire): for as long as your account is open, and deleted within 30 days of a verified deletion request.
• Order and payment records: 8 years from the end of the financial year of the order, as required by Indian tax and company law, then deleted or anonymised.
• One-time sign-in codes: 10 minutes, then deleted.
• Analytics events: retained for up to 13 months, then deleted.
• Newsletter / waitlist: until you unsubscribe or ask us to remove you.

Your rights and choices

Under the Digital Personal Data Protection Act, 2023 and applicable Indian law you may, at any time: access a copy of the personal data we hold about you; correct inaccurate details; withdraw consent to marketing; and request deletion of your account and personal data. To exercise any of these, sign in and open her account or email hello@theaarzoo.com from the address on the account. We respond within 30 days. Where the law requires us to keep a record (for example, tax invoices), we tell you what is retained and why. You may also raise a grievance with our Grievance Officer at the same address, and, if unresolved, with the Data Protection Board of India.

Security

All traffic is encrypted (TLS 1.2+/HSTS). Sign-in codes are stored only as salted hashes, sessions use httpOnly secure cookies, payment confirmations are verified by cryptographic signature, and access to order data inside the house is limited to the team members who need it.

Children

THE AARZOO is not directed at children. We do not knowingly collect personal information from anyone under 18.

Also read our Terms of use.