Privacy Policy
Last updated: 21 August 2026
KALIKITURAI PRIVATE LIMITED (“Kalikiturai Cheeralu”, “we”) operates this store and is the data fiduciary for the personal data described below under India’s Digital Personal Data Protection Act, 2023. This notice explains what we collect, why, who processes it on our behalf, how long we keep it, and the rights you can exercise.
What we collect, and why
| Data | Collected when | Used for |
|---|---|---|
| Name, email, phone | Account signup, checkout | Your account, order updates, support |
| Delivery address | Checkout | Shipping your order |
| Order and payment records | Purchase | Fulfilment, invoices, refunds, tax compliance |
| UPI ID | Only when you request a cash-on-delivery refund | That one payout — deleted once it is made |
| Return photos / unboxing videos | When you raise a return | Assessing the claim |
| Messages, disputes, reviews | When you write to us | Answering you; approved reviews appear on products |
We do not collect data we do not need: no bank account numbers, no card numbers (payments are handled entirely by Razorpay), no precise location.
Who processes it for us
We never sell your data. It is shared only with the services that make the store work, each bound to its purpose:
| Processor | What they receive | Purpose |
|---|---|---|
| Razorpay (India) | Payment identity and amount | Processing payments and refunds |
| Shiprocket (India) | Name, phone, address, order value | Courier delivery and returns pickup |
| Supabase (hosted on AWS, Singapore) | Account and order data | Our database and authentication |
| Resend (USA) | Email address, message content | Sending transactional email |
| Vercel (global CDN) | Standard web request data | Hosting the website |
| Upstash (USA) | Hashed rate-limit keys only | Abuse protection |
Some of these providers store data outside India (Singapore, USA), as permitted by the DPDP Act for countries not restricted by the Central Government.
How long we keep it
| Data | Kept for |
|---|---|
| Account, addresses, wishlist | While your account exists |
| Orders, invoices, refund records | As required by tax law (GST / Income Tax — up to 8 years), even after account deletion, in anonymised form |
| COD refund UPI IDs | Deleted when the payout is made, or after 30 days |
| Courier tracking scans | 180 days after delivery |
| Copies of emails we sent you | 12 months |
| Return photos and videos | 6 months after the return closes |
Your rights
- Access: your orders, addresses and messages are visible in your account at any time.
- Correction: edit your profile and addresses yourself, or ask us.
- Erasure: use Delete My Account at the bottom of your profile. Your identity data is erased immediately; order and invoice records are retained in anonymised form as tax law requires. A record of the deletion itself is kept as proof of compliance.
- Grievance: see below. If unsatisfied, you may escalate to the Data Protection Board of India.
Security
Data is encrypted in transit, access is restricted by row-level database policies, payment credentials never touch our servers, and return evidence is stored in a private bucket accessible only to you and our team. No system is perfectly secure; if a breach affecting you ever occurs, we will notify you and the Data Protection Board as the law requires.
Grievance Officer
KALIKITURAI PRIVATE LIMITED
Plot No 73, H No 5-5-151, Vanasthali Hills, Vanasthalipuram, Hyderabad, Rangareddy, Telangana 500070
Email: support@kalikiturai.com · Phone: +91 99966 68788
We acknowledge grievances within 72 hours and resolve them within 30 days.