Privacy Policy

Potliya (“we”, “us”, “our”) respects your privacy. This Privacy Policy explains what personal data we collect, why, how it’s used, and your rights. It applies to our website and all related services.

By using Potliya, you agree to the practices described here. This policy is part of our Terms & Conditions and is intended to comply with applicable Indian law, including the Digital Personal Data Protection Act, 2023 (DPDPA).

1. What We Collect

When you use our website or place an order, we collect:

• Account information: your email address (used for login via one‑time code).
• Order & contact information: your name, phone number, and delivery address, collected at checkout.
• Order history: the items and packs you purchase, order status, and related transaction details.
• Payment information: we do not store your card, UPI, or bank details. All payment processing is handled directly by Razorpay, our payment partner, under their own security and privacy standards.

We do not collect sensitive personal data (such as government ID numbers) beyond what is strictly needed to fulfill your order and comply with law.

2. How We Use Your Information

We use the information above to:

• Process, confirm, and fulfill your orders
• Pack and ship your order to the correct address
• Send you order confirmations, shipping updates, and support messages
• Show your past orders under “My Orders” when you log in
• Respond to support, refund, and cancellation requests
• Improve our packs, website, and operations using aggregated, non‑identifying analytics
• Comply with applicable legal and tax obligations

We do not sell your personal information to third parties.

3. Who We Share It With

We share your personal data only with trusted service providers who help us run Potliya:

• Razorpay — to process your payment securely.
• Supabase (or our chosen backend provider) — to store your account and order data securely on our behalf.
• Delivery / logistics partners — only your name, phone number, and address, solely to deliver your order.

These partners are contractually required to handle your data securely and only for the purposes we specify. We do not share your data with anyone else, and we do not use it for third‑party advertising or marketing.

4. Data Security & Retention

• Your data is stored with access controls that restrict who can view or use it, both on our end and via our backend provider.
• Payment details are handled entirely by Razorpay and are never stored on our servers.
• We retain your personal data only as long as necessary to:
  • Fulfill your orders and provide support
  • Comply with legal, tax, and accounting requirements
  • Resolve disputes and enforce our agreements

After that, we delete or anonymize your data, except where retention is required by law.

5. Your Rights

Under applicable law (including DPDPA), you have the right to:

• Ask what personal data we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal data, subject to legal and contractual obligations (e.g., transaction records we must keep)
• Withdraw consent for certain types of processing, where applicable
• Lodge a complaint with the relevant data protection authority if you believe your rights have been violated

To exercise any of these rights, email us at hello@potliya.com. We will respond within a reasonable time and guide you through the process.

6. Cookies & Local Storage

Our website may use basic cookies and/or local storage to:

• Remember items in your cart between visits
• Keep you logged in during a session

We do not use tracking cookies for third‑party advertising or profiling.

7. Children’s Privacy

Our services are not directed at children under 18. We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a child, we will take steps to delete it as soon as possible.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “Last updated” date. Continued use of our website after changes are posted means you accept the revised policy.