Home / Policies / Privacy Policy
Privacy Policy
This policy explains what personal data FragTawny Mist Private Limited ("FragTawny Mist", "we", "us") collects when you visit our website or order from us, why we use it, who helps us process it, and how you can control it. We have tried to write it in plain English.
1. Who we are
The website and the brand FragTawny Mist are run by FragTawny Mist Private Limited, a company in India (established 2025). For your personal data we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"): we decide why and how it is processed.
Registered office: Eldeco Centre, SDMC Primary School, Block A, Shivalik Colony, Malviya Nagar, South Delhi, New Delhi, Delhi 110017, India. CIN: U46909DL2025PTC456854.
2. What we collect
| Data | When | Required? |
|---|---|---|
| Checkout details: name, mobile number, delivery address, pincode, and any note you add | When you place an order on the website | Yes, except the note. We cannot deliver without them. |
| Email address | At checkout, only if you type it in | Optional. Used to send an order email. |
| Order details: products, quantities, prices, order ID, date and time, order status, and the fact that you ticked the consent box | When you place an order and as we process it | Created by the order itself |
| WhatsApp messages you send us and our replies, including your WhatsApp number and profile name | When you confirm an order or contact us on WhatsApp | Orders are currently confirmed on WhatsApp |
| Payment status: whether your order was paid, the amount, and the payment references (Razorpay order and payment IDs) | When you pay online on the website, or through a payment link we send you | Yes, to match payment to your order. We never see or store your full card, UPI PIN or bank login details; the payment provider handles those. |
| Device and log data: IP address, browser type, pages requested, date and time | Automatically, when your browser loads the site or sends an order | Technical. Needed to run and protect the site. |
We do not ask for sensitive information such as health data, government ID numbers or passwords. Please do not send them to us.
We do not use advertising trackers, ad pixels or analytics on the website. If we ever add them, we will update this policy and ask for your consent first.
3. Why we use it
- To take and deliver your order: record it, confirm it with you on WhatsApp, take your payment (online through Razorpay, or through a payment link), pack it, hand it to a courier and help with tracking.
- To talk to you about that order: answer questions, send an order email if you gave an email address, and handle cancellations, replacements or refunds.
- To keep records we are required to keep, for example invoices and tax and accounting records.
- To keep the website working and safe: for example, limiting how many orders can be sent from one internet connection in a short time to stop spam and abuse.
We do not sell your personal data. We send marketing messages (offers) only if you separately agree through a dedicated opt-in checkbox that is never pre-ticked. Agreeing to marketing is not required to place an order, and you can opt out at any time.
4. Consent, our lawful basis
We process your checkout details on the basis of your consent, which you give by ticking the box at checkout before placing an order. The order cannot be placed without it. Your consent covers only the purposes in section 3.
You can withdraw consent at any time by writing to us (see Contact). Withdrawing is as easy as giving it. It does not affect processing already done, and if an order is in progress we may not be able to complete it. We may still keep data that the law requires us to keep (for example invoices).
Some processing, such as the technical logs needed to run the site, is done for legitimate uses permitted under the DPDP Act and the Information Technology Act, 2000 and its rules.
5. Who we share it with
We share only what each service needs to do its job for us. These companies act as processors on our behalf.
| Who | What for | What they receive |
|---|---|---|
| Cloudflare (website hosting and the order service) | Serving the website, receiving your order and passing it on, blocking abuse | Everything you submit at checkout while it passes through, plus IP address and technical logs |
| Notion (Notion Labs, Inc.) | Our order book, kept in our own Notion workspace | Order ID, date, name, phone, address, pincode, items, totals, note, email (if given), consent flag |
| Telegram | An instant alert to our team when a new order arrives | Order summary, which can include your name, phone, address and items |
| WhatsApp (Meta) | Confirming orders and customer support | Your messages with us and your WhatsApp number. WhatsApp's own privacy policy also applies. |
| Payment provider: Razorpay (Razorpay Software Private Limited). We may add Cashfree Payments as a second provider later and will update this page if we do. | Collecting your payment securely (UPI, cards, netbanking, wallets) and processing refunds | Order ID, order amount, and your name, mobile number and email (if given) to fill in the payment form. You enter card, UPI or bank details in Razorpay's secure checkout window, not on our website. Razorpay's own privacy policy also applies. |
| Courier partners we use from time to time | Delivering your parcel and tracking | Name, phone, delivery address, pincode, parcel details |
| Email service (Resend), only if order emails are switched on and you gave an email address | Sending your order email | Email address, name, order summary, delivery address |
| Google Fonts (Google) | Showing the website's typefaces | Your IP address and browser details when the fonts load. No order data. |
| Professional advisers and authorities | Accounting, tax, legal advice, or when the law requires it | Only what is needed or legally required |
Links to Amazon.in and Instagram take you to those sites, where their own policies apply. If you buy on Amazon.in, Amazon handles that order and its data.
6. Processing outside India
Several of the services above (for example Cloudflare, Notion, Telegram, WhatsApp, Resend and Google) store or process data on servers outside India. The DPDP Act allows this except to countries the Government of India specifically restricts. We will stop or change a service if a destination becomes restricted. By placing an order you understand that your data may be processed outside India for the purposes above.
7. How long we keep it
- Order records and invoices: kept for 8 years, as the law requires for tax and accounting.
- Order details not needed for those records (for example notes and WhatsApp chats): deleted 12 months after delivery.
- Telegram alerts: deleted from the chat after the order has shipped.
- Technical logs and anti-spam counters: kept by Cloudflare for a short time; our anti-spam counter expires after about 10 minutes.
When you withdraw consent, or the purpose is complete, we delete your data unless the law requires us to keep it.
8. Your rights
Under the DPDP Act you can:
- Access: ask for a summary of the personal data we hold about you and how we use it, and who we have shared it with.
- Correct and update: ask us to fix wrong or incomplete details, for example a changed address.
- Erase: ask us to delete your data when it is no longer needed, unless the law requires us to keep it.
- Withdraw consent at any time (see section 4).
- Nominate another person to use these rights for you in case of death or incapacity.
- Raise a grievance with us, and if you are not satisfied, complain to the Data Protection Board of India.
To use any right, message us on WhatsApp or email us (see Contact). We may ask you to confirm it is you, for example by messaging from the phone number on the order. We aim to respond within 7 working days.
9. Cookies and browser storage
The website does not set advertising or tracking cookies.
Your cart (the products and quantities you add) is saved in your own browser's local storage, so it is still there if you reload the page. It stays on your device and is not sent to us until you place an order. You can clear the cart by emptying it, or by clearing site data in your browser settings.
Your checkout details are not saved in browser storage, with one exception: while an online payment is still pending, the order ID, total, and the details shown on the payment step (name, mobile number, email if given, delivery address and items) are kept in this browser tab's session storage, so reloading the page does not lose the "Pay now" step. They are removed when the payment is confirmed, after 24 hours, or when you close the tab.
Online payment: Razorpay's checkout script is loaded from checkout.razorpay.com only at the moment you choose to pay, never before. From then on Razorpay receives your IP address and device details and may use its own strictly necessary cookies or storage for the payment.
Cloudflare may set strictly necessary security cookies to protect the site from attacks. Google Fonts and our animation library (served from Cloudflare's cdnjs) are loaded from their servers, which see your IP address.
10. How we protect it
We take reasonable steps, and we want to be honest about what they are:
- The website and order service use encrypted connections (HTTPS).
- The order service checks every order on the server, accepts orders only from our own website address and limits repeated submissions.
- Access keys for Notion, Telegram, email and the payment provider are stored as secrets in Cloudflare, never in the website's code.
- An order is marked paid only after our order service has checked the payment with Razorpay itself (a signed confirmation and the exact amount), never just because the browser says so.
- Only the owner and named staff who handle orders can see order data. We use two-factor login on Notion, Telegram, Cloudflare and WhatsApp.
- We never receive your card, UPI or bank details; payments are handled by Razorpay.
No system is completely secure. If a personal data breach happens, we will inform affected people and the Data Protection Board of India as the law requires.
11. Children
Our products are for adults, and the website is not meant for children. Orders must be placed by someone aged 18 or over. We do not knowingly collect children's personal data. If you believe a child has given us their data, contact us and we will delete it.
12. Grievance officer
For any concern about your personal data or this policy, contact our Grievance Officer:
- Name: Sourabh Rao, Grievance Officer
- Email: fragtawnymist@gmail.com
- Phone: +91 92112 27069
- Address: FragTawny Mist Private Limited, Eldeco Centre, SDMC Primary School, Block A, Shivalik Colony, Malviya Nagar, South Delhi, New Delhi, Delhi 110017, India
- We acknowledge complaints within 48 hours and resolve them within one month of receipt.
13. Changes to this policy
If we change how we use personal data, we will update this page and the "Last updated" date. If a change needs fresh consent, we will ask for it before applying the change to you.
14. Contact
FragTawny Mist Private Limited
WhatsApp: +91 92112 27069
Email: anything@fragtawnymist.com
More ways to reach us: Contact page.