Privacy policy

Decoritu (“Decoritu”, “we”, “us”) is a home décor and furnishings store based in Vijayapura, Karnataka, India. This policy applies to personal data collected through this website, our customer care channels and any related services.

We handle personal data in line with applicable Indian law, including the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000. Where you interact with us from outside India, local consumer and privacy laws may also apply.

This site may currently show a preview catalogue. The practices below apply to data collected through the site even while the catalogue remains illustrative.

Depending on how you use the site, we may collect:

• Account details: name, email address, phone number and a hashed password. We never store passwords in plain text.
• Order details: delivery address, contact details, items purchased, order notes and delivery preferences.
• Payment references: the payment method, amount and provider reference. Card, UPI and net-banking credentials are handled by our payment provider and are not stored by us.
• Correspondence: messages you send through contact forms, order notes, reviews or email.
• Marketing preferences: your newsletter consent and the email address you subscribe with.
• Technical data: device and browser type, approximate location derived from IP, pages viewed, referring URL, and security or error logs.
• Local storage: your cart and saved items are stored in your browser so the site remembers them between visits.

We do not intentionally collect sensitive personal data such as health, biometric or financial account credentials. Please do not send these to us.

We use personal data to:

• create and secure your account, and authenticate your sessions;
• process orders, calculate totals, collect payment and arrange delivery;
• communicate about orders, returns, cancellations and customer care requests;
• publish reviews you choose to submit, after moderation;
• send the newsletter where you have opted in, with an unsubscribe option in every email;
• prevent fraud, rate-limit abuse, secure the site and debug errors;
• understand aggregate usage so we can improve products, navigation and content;
• meet accounting, tax and legal obligations.

We rely on your consent for marketing, on the performance of our contract with you for orders and accounts, on our legitimate interests for security and service improvement, and on legal obligation where records must be kept.

We do not sell personal data. We share what is necessary with service providers who help us operate the store, including:

• Payment processors (such as Razorpay) to collect and verify payments;
• Courier and logistics partners to deliver orders and provide tracking;
• Hosting, database, email and analytics providers that support the site;
• Professional advisers and authorities where required by law or to establish or defend legal claims.

Providers are expected to process data only for the service they provide and to apply appropriate safeguards. Some providers may process data outside India; where that happens, we take reasonable steps consistent with applicable law.

We use strictly necessary cookies for authentication and security. These keep you signed in and protect forms from abuse. We also use browser local storage for your cart and saved items.

We do not currently run advertising cookies or third-party behavioural tracking. If that changes, we will update this policy and, where required, ask for consent before setting non-essential cookies.

You can clear cookies and local storage through your browser settings. Clearing them will sign you out and empty your saved cart on that device.

We keep account data while your account is active. Order and payment records are kept for as long as needed to service the order and then for the period required by tax, accounting and consumer-protection law.

Contact messages are kept for up to 24 months so we can resolve follow-ups. Newsletter data is kept until you unsubscribe or ask us to delete it. Security logs are kept for a shorter period unless needed to investigate an incident.

When data is no longer needed, we delete or anonymise it. Some backup copies may persist for a limited period before being overwritten.

We use industry-standard measures appropriate to the risk, including encrypted transport, hashed passwords, hashed session and order-access tokens, access controls, rate limiting and least-privilege access to production systems.

No system is completely secure. If you believe your account has been compromised, or you notice suspicious activity, contact us immediately and change your password.

Subject to applicable law, you may ask us to:

• confirm what personal data we hold about you and provide a copy;
• correct inaccurate or incomplete data;
• delete data that is no longer needed for the purpose it was collected;
• withdraw consent for marketing or other consent-based processing;
• nominate a person to exercise your rights in the event of death or incapacity;
• raise a grievance about how we handle your data.

You can update your name, phone and addresses from your account settings. For other requests, write to us from the email address associated with your account. We may need to verify your identity before acting. We will respond within the time required by applicable law.

If you are not satisfied with our response, you may contact the Data Protection Board of India or another competent authority.

The store is intended for adults. We do not knowingly collect personal data from children under 18. If you believe a child has provided data to us, contact us and we will delete it.

We may update this policy as the store evolves. The “last updated” date above will change, and material changes will be communicated where appropriate. Please review the policy periodically.

For privacy questions, requests or grievances, contact our care team at hello@decoritu.in with the subject “Privacy request”. You can also read our Terms of use or contact page.