Privacy policy
Last updated 14 September 2026. Karigari Heritage ("we", "us") sells goods on this website. This page says what personal data we take, why we keep it, who else sees it, and how you can ask us to change or delete it. We follow the Digital Personal Data Protection Act, 2023 as it applies to a small Indian seller. We also keep records because tax law tells us to.
Who we are
Rekha Crafts (OPC) Private Limited, GSTIN 08AAQCR1399L1ZI, is the seller and decides why data is used. The shop name is Karigari Heritage. Rekha Chandel, director, is the person in charge. Registered address: Ward no 08, Rekha w/o Mahesh Kumar, Ramdev Colony, Pokaran, Jaisalmer, Rajasthan 345021. For privacy questions write to orders@karigariheritage.com. That inbox is also the contact for a complaint. If you are not happy with our reply you can approach the Data Protection Board of India once that process is open to you, and you can still go to a consumer commission for a shop dispute.
What we collect when you order
Name, email, 10 digit phone, shipping address, city, state, PIN code. What you bought, quantity, price, tax as shown, payment status, order number, and later the courier name and AWB if we have them. If you type a GST name or GSTIN in a mail so we can bill a firm, we store that too.
We do not create a customer login. There is no password for shoppers. The bag you are filling uses a session on this browser only.
What we collect if you write to us
The contact form takes your name, email, and the message. If you later send photos of a broken idol, we keep those until the claim is closed. Do not send copies of Aadhaar, PAN, or a cancelled cheque unless we asked for them for a refund that cannot go back to the original method.
What we do not collect
We do not store your full card number, CVV, UPI PIN, or net banking password. Those stay on the Cashfree payment page. We never ask for an OTP by email or WhatsApp. If a mail asking for an OTP has our name on it, it is not from us.
We do not take date of birth, caste, religion, or health data. An idol on your dashboard is not a record of your faith in our files. We only know you bought a product.
Cookies and logs
The site sets a session cookie so your bag does not empty when you open another page. That cookie is not an advertising cookie. We do not run Facebook pixels or Google ads tags on this shop today. If that ever changes we will say so here first.
The server may keep ordinary web logs: IP address, browser type, time, and the page requested. We use that to see if the site is down or under a silly amount of junk traffic. We do not sell logs.
Why we collect it
To take payment, pack, and send the order. To email the order number and the tracking number. To answer a question you asked. To keep accounts, GST, and other tax records. To look into a failed or double payment. To defend a chargeback if someone says they did not buy a Durga that arrived at their house.
We do not use your phone number for promotional SMS. We do not run a newsletter. If we ever start one, it will be a separate yes, not a silent tick at checkout.
Who else sees it
Our payment partner sees the name, email, phone, and amount needed to take payment. The courier sees the name, phone, and address needed to deliver. The company that hosts the website and database can, in theory, see the same records we see. We pick hosts in the ordinary way. We do not sell lists to marketers. We do not sell lists to other handicraft shops.
We may share data if Indian law requires it, if a court or a consumer commission asks, or if we need to prove an order in a dispute with you or with the courier.
How long we keep it
Order and invoice records stay at least 8 years because Indian tax practice expects that. Contact form notes we keep for 2 years unless you ask us to delete them earlier and the law lets us. Photos of a damaged parcel go when the claim is closed, or after 2 years, whichever is later if a dispute is still open. Session cookies die when you close the browser or after a stretch of inactivity.
Your choices
You can ask for a copy of the data we hold on you. You can ask us to correct a name or address. You can ask us to delete a contact message. You can ask us to close a pending unpaid order you no longer want.
We cannot delete an invoice or an order row that tax law says we must keep. We cannot unsend a parcel that already has an AWB. Write to orders@karigariheritage.com and say what you want. We will answer within a reasonable time, usually within 15 working days, faster if the mail is about a live shipment.
Security
The admin password is stored as a hash. Product pages are public. Order pages on the public site use a long order number, not a guessable sequence in the address bar for other people's orders. Still, no website is perfectly safe. Use a normal email you check. Do not send OTPs or card CVVs to anyone claiming to be Karigari Heritage.
Children
This shop is for people 18 and older. We do not knowingly take orders from children. If a parent thinks we have a child's data, write to us. We will remove what we can and cancel unpaid carts. A paid order already packed is harder. We will still help.
Changes
If we change this policy we put a new date at the top. For a change that actually alters how we use data, we will also say so in a short note on the site. Keep reading this page if you order often. The version that matters for a given order is the one live when you paid, plus whatever the law later forces us to do.