Privacy policy

Last updated 7 August 2026

This policy explains what Ayyub Ali Fragrances collects about you, why, how long we keep it and what you can ask us to do with it. It is written to meet India’s Digital Personal Data Protection Act, 2023 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

Who is responsible for your data

Ayyub Ali Fragrances is the data fiduciary — the business that decides what is collected and why. We trade from Yakutpura Station Rd, Rangeela Shah Mohalla, Yakhutpura, Hyderabad, Telangana 500023, India.

For any privacy question or request, contact us at [email protected] or +91 88866 67286. We answer privacy requests within 30 days.

Everything we collect, and for how long

This is the complete list. If it is not here, we do not collect it.

What we collect	Why	How long
Name, email address and phone number	To create your account, process your order and let the courier reach you	Until you delete your account
Delivery address	To print the label and deliver the parcel	8 years, with the order
What you ordered and what you paid	To fulfil the order, issue your invoice, and meet tax and accounting law	8 years
A Razorpay payment reference	To match a payment to an order and handle refunds or disputes	8 years, with the order
A session cookie, if you sign in	To keep you signed in. It identifies your account and nothing else	Until you sign out or it expires
Your bag and wishlist	So they survive a page refresh	In your browser only — these never reach us unless you check out

What we never collect

Card numbers, CVVs, UPI PINs or bank credentials. Payment happens entirely on Razorpay's own secured page. We are told an order was paid and given a reference — nothing more.
Your location, beyond the delivery address you type yourself.
Any sensitive personal data such as caste, religion, health or biometric information.
We do not buy personal data from anyone, and we do not build profiles of you across other websites.

Why we are allowed to hold it

Under the DPDP Act we rely on two grounds:

Your consent, given when you create an account or place an order. You can withdraw it at any time.
Legitimate uses — completing a purchase you asked for, and keeping the sales records that tax law requires us to keep.

Who else sees it

Only where they need it to do a job for you. None of them may use your details for their own marketing.

Razorpay — to take your payment. They receive your name, email and phone so they can issue a payment receipt and handle disputes.
Supabase — our database and hosting provider, which stores the data above on our behalf.
Our delivery partner — your name, address and phone number, so the parcel can be delivered.
Google — only if you choose to sign in with Google, and only to confirm your identity. We never receive your Google password.

We do not sell your data. We do not rent it, and we do not share it for anyone else’s advertising. Ever.

Where your data is stored

Our database is hosted by Supabase, and some of our processors operate servers outside India. Where data is transferred abroad it is only to countries not restricted by the Government of India, and only to processors under contract to protect it to the same standard.

How we protect it

All traffic to this site is encrypted over HTTPS.
Access to the dashboard is restricted to the shop's own staff accounts and protected by password.
Our database enforces row-level security, so one customer's session cannot read another customer's orders.
Card data never touches our servers at all, which is the strongest protection available for it.

No system is perfect. If a breach ever affects your data, we will notify the Data Protection Board of India as the law requires.

Your rights

Under the DPDP Act you may ask us to:

Tell you what we hold about you and who we have shared it with.
Correct anything that is wrong or out of date.
Delete your data, where we are not required by tax law to keep it.
Withdraw your consent, which we will act on as easily as it was given.
Nominate someone to exercise these rights on your behalf if you die or become incapacitated.

Email [email protected] and we will respond within 30 days, free of charge.

One honest limit: we cannot delete the record of an order you actually placed. Tax law requires us to keep sales records for eight years. We can delete your account and everything else.

If you are not satisfied

Please come to us first — most issues are a misunderstanding we can fix the same day. If we cannot resolve it, you may complain to the Data Protection Board of India.

Children

This shop is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us their details, contact us and we will delete them.

Cookies

We use one cookie: the session cookie that keeps you signed in. We do not use advertising or tracking cookies.

We use Vercel Analytics and Vercel Speed Insights to count page views and measure how quickly pages load. Neither sets a cookie and neither builds a profile of you: they record the page, the country, and the device type, and nothing that identifies you personally.

Changes to this policy

If we change what we collect or why, we will update this page and the date at the top. Where the change is significant we will tell account holders directly.