Privacy Policy

1. Commitment to Customer Privacy

SheBakes ("we", "our", "us") operates the direct-to-consumer artisanal bakery at shebakes.in. We act as a responsible Data Fiduciary, committed to safeguarding the personal data and privacy rights of every customer and visitor in accordance with:

• The Digital Personal Data Protection Act, 2023 (DPDP Act).
• The Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").
• The Consumer Protection (E-Commerce) Rules, 2020.

Our Commitment: We collect and process only the minimal personal data required to fulfill your fresh cookie orders, arrange pan-India courier delivery, and provide customer support. We never sell, rent, trade, monetise, or distribute your personal information to third-party advertising networks or marketing brokers.

2. Categories of Personal Data Collected

When you browse our storefront, add items to your shopping bag, or place an order, we collect only the necessary information outlined below:

• Customer Name: To address you during order processing and print accurate courier shipping labels.
• Contact Phone & WhatsApp Number: To send real-time order confirmations, live courier AWB tracking links, dispatch notices, and coordinate doorstep delivery calls.
• Delivery Address, Landmark & Postal PIN Code: To compute express courier rates and physically deliver cookie parcels via our logistics partners.
• Email Address: To send digital invoices, payment receipts, and customer service correspondence.
• Order Details: Cookie box selections, quantities, dietary/allergen notes, or gift messages.

3. Exclusion of Sensitive Financial & Card Data

We do not collect or store your sensitive financial data:

• All digital payments on shebakes.in are processed exclusively through authorized, RBI-licensed payment aggregators (including Razorpay and Shiprocket Fastrr).
• Payment transactions occur through 256-bit SSL encrypted channels under PCI-DSS Level 1 certification.
• SheBakes never collects, stores, accesses, or records your credit/debit card numbers, CVVs, netbanking passwords, or UPI PINs on our servers.

4. Purpose & Legal Basis for Data Processing

Your personal data is collected and processed exclusively for specified, legitimate commercial purposes:

• Fresh baking, packaging, and order preparation.
• Generating authorized courier shipping manifests and booking express pan-India doorstep delivery.
• Transmitting automated order tracking links and operational service notifications via WhatsApp, SMS, or email.
• Addressing customer inquiries, quality escalations, and fulfilling refund/replacement requests under our policies.
• Complying with statutory accounting, GST tax invoicing, and Indian commercial regulatory obligations.

5. Disclosures to Verified Logistics & Service Partners

We share customer data strictly on a need-to-know basis with trusted operational service providers essential to completing your order:

• Express Courier & Logistics Providers (e.g. Shiprocket, Delhivery, Blue Dart): Customer name, shipping address, PIN code, and phone number are shared solely for physical parcel pickup, transit, and doorstep delivery.
• Transactional Communication Gateways: Official WhatsApp Business API and SMS infrastructure providers to transmit live tracking notifications and order confirmations.
• Legal & Regulatory Authorities: Only when strictly mandated by a court order, lawful government directive, or applicable Indian statutory authority.

All service providers are bound by strict non-disclosure obligations and are legally prohibited from using customer information for any independent purpose.

6. Browser Cookies & Local Storage

We use first-party browser storage (including localStorage and first-party cookies) solely to provide functional shopping convenience on our website:

• Shopping Bag Storage: Keeps your selected cookie flavours, quantities, and box sizes saved if you navigate across pages or refresh the browser.
• Delivery PIN Code Memory: Remembers your delivery PIN code to display instant courier rates without requiring manual re-entry on each visit.
• No Third-Party Tracking Cookies: We do not deploy cross-site tracking pixels or invasive behavioural advertising scripts. You can clear local storage or cookies at any time via your browser settings.

7. Data Security Safeguards & Retention

SheBakes implements robust administrative, technical, and physical safeguards to protect your personal information against unauthorized access, alteration, disclosure, or destruction. We retain customer transaction records only for the duration required by Indian commercial tax and legal accounting laws, after which data is securely purged or anonymized.

8. Your Statutory Rights under DPDP Act 2023

As a Data Principal under Indian law, you have the following enforceable rights regarding your personal information:

• Right to Information & Access: Request a summary of the personal data we hold about you and the processing activities undertaken.
• Right to Correction & Updating: Request immediate correction of any inaccurate, incomplete, or outdated contact or address information.
• Right to Erasure: Request the deletion of your personal data from our active customer records (subject to statutory tax retention mandates).
• Right to Grievance Redressal: Avail of an accessible grievance redressal mechanism provided by SheBakes as detailed below.

9. Statutory Grievance Redressal Officer

In accordance with the Information Technology Act, 2000, the SPDI Rules, 2011, and the Digital Personal Data Protection Act, 2023, the designated Grievance Officer for SheBakes is: