Legal
Privacy Policy
Effective date: 1 July 2026 · Version 2.1
Vanaushadhi ("we", "our") operates vanausadhi.com and the associated iOS and Android applications. This policy explains, in plain language, what personal information we handle, why, and the choices you have. We take this seriously — the trust you place in us is the only thing we cannot re-order.
1. Information we collect
Given by you — name, email, shipping and billing addresses, phone number, date of birth (optional, only for birthday offers), account password (stored one-way hashed), skin and hair concerns you share in the vaidya form, and any messages you send to customer care.
Collected automatically — device type, browser, IP address, approximate city-level location, referring URL, pages viewed, and cart events. We use first-party cookies and privacy-friendly analytics; we do not run third-party ad-network tracking pixels.
From partners — order status from our shipping partners, payment confirmation (never full card numbers) from Razorpay and Stripe, and login tokens if you sign in with Google or Apple.
2. How we use it
- Fulfilling and delivering your orders
- Sending transactional emails and SMS (order updates, tracking, receipts)
- Personalised recommendations from our in-house vaidya team (only if you request a consult)
- Sending occasional newsletters — only after you opt in, and unsubscribe is always a click away
- Fraud prevention, refund processing, tax reporting
- Improving product formulations, site performance and customer experience
3. Legal basis
Under GDPR and the Digital Personal Data Protection Act, 2023 (India), we process your data on the basis of (a) performance of a contract when you place an order, (b) your explicit consent for marketing communication, (c) our legitimate interest in running a safe, working store, and (d) legal obligation (GST, income tax, product safety records).
4. Sharing your data
We share data only with the parties strictly required to run the business:
- Shipping partners — Delhivery, Blue Dart, DHL Express (address + phone)
- Payment processors — Razorpay, Stripe, PayPal (order amount + email; card data never touches our servers)
- Email & SMS providers — for transactional and opted-in marketing
- Cloud hosting — Cloudflare (edge), AWS Mumbai region (databases)
We never sell your personal data, ever, to anyone.
5. Cookies
We use three categories of cookies:
- Strictly necessary — session, cart, checkout. Cannot be disabled.
- Preference — remembers your language and pincode.
- Analytics — anonymised, aggregated. You can opt out from our cookie banner or your browser settings.
6. Data retention
Order and invoice records are retained for 8 years to satisfy Indian tax and consumer-protection law. Marketing preferences are retained until you withdraw consent. Consultation notes are retained for 3 years, then permanently deleted. Analytics data is aggregated after 26 months.
7. Your rights
You have the right to (a) access a copy of your data, (b) correct inaccurate data, (c) request deletion (except where retention is legally required), (d) port your data to another controller, (e) withdraw marketing consent, and (f) lodge a complaint with a supervisory authority. Write to privacy@vanausadhi.com and we respond within 30 days.
8. Children
Our store is not directed at children under 13 (or the equivalent age in your jurisdiction). We do not knowingly collect their data. If you believe a child has provided us information, please contact us for immediate deletion.
9. Security
Transport encryption is TLS 1.3 across all endpoints. Payments are processed through PCI-DSS certified gateways; we never store card CVV, expiry or PAN. Passwords are stored using bcrypt with per-user salts. Access to production systems is logged and requires hardware-key two-factor authentication.
10. International transfers
Our primary infrastructure is in India (AWS Mumbai). Cloudflare edge and select email delivery may involve transfer outside India under standard contractual clauses that maintain equivalent protection.
11. Changes
We may update this policy from time to time. Material changes are announced by email and in-app notice at least 15 days before they take effect. The version and effective date at the top of this page reflect the current policy.
12. Grievance officer
Grievance Officer (India DPDP Act): Vanaushadhi, Rishikesh, Uttarakhand, India. Email: grievance@vanausadhi.com. Response window: 15 working days.
13. Contact
General privacy questions: privacy@vanausadhi.com.