This Privacy Policy explains how Noviara ("Noviara", "we", "us") collects, uses and protects your personal data when you visit noviara.in (the "Site"), place an order or contact us. We process personal data in line with India's Digital Personal Data Protection Act, 2023 and other applicable laws.
1. Information we collect
When you place an order
- Your details: your name, mobile number, email address and delivery address.
- Order details: the items, sizes and quantities you order, the amounts, and your order number.
- Custom print photos: if you order a custom print, the photo you upload. We use it only to print your order.
- Payment references: the payment order ID, payment ID and payment method (for example UPI or card) and the payment status. Your card, UPI and bank details are entered on our payment partner's secure checkout and handled by our payment partner, which is PCI-DSS compliant, under its own privacy policy. We never see or store them.
Other information you give us
- Enquiry form: your name, email address and/or phone number, the tapestry you are interested in, and your message. We also record the page you sent it from, the time it was sent, and how long the form was open (used only to filter out spam).
- Messages you send us on WhatsApp, by email or on Instagram, including your name, number or handle, and what you write to us.
Information collected automatically
- Server logs: our hosting provider (Google Firebase) records technical data such as IP address, browser type, the page requested and the time of the request. These logs are used to deliver and secure the Site.
- Visit statistics (no cookies): to see how the Site is used, your browser sends us a random visit number (kept in your browser's session storage and deleted when you close the tab), the type and address of the pages you open, the name of the website that sent you (for example Google or Instagram), whether you use a phone or a computer, which designs you add to your cart and whether a payment was started or completed. This is not linked to your name, contact details, IP address or orders, and we cannot use it to identify you.
- Fraud and abuse prevention: when you use checkout, we store a one-way hash of your IP address (not the address itself) to limit repeated requests. It is deleted automatically within about a day.
- Analytics (only with your consent): if you accept analytics cookies, Google Analytics collects information such as the pages you view, how long you stay, your device and browser type, and your approximate location (city level). We do not use advertising or remarketing features.
2. How we use your information
- To process, confirm, pack, ship and deliver your order, and to keep you updated about it (for example by sending tracking details).
- To take and verify payments, and to issue refunds.
- To handle replacements, returns, cancellations and complaints.
- To reply to your enquiries and tell you about the tapestries you asked about.
- To understand how visitors use the Site and improve it (only if you accept analytics cookies).
- To keep the Site and checkout secure and protect them from fraud, spam and abuse.
- To meet our legal obligations, such as keeping tax and accounting records.
We do not sell your personal data. We will only send you marketing messages if you have asked us to.
3. Consent
We process the details you give us at checkout based on the consent you give when you place your order, and to fulfil that order. We process the details in an enquiry based on the consent you give when you submit the form or message us. We use analytics cookies only after you accept them in the cookie banner. You can withdraw your consent at any time by emailing support@noviara.in or by changing your choice under "Cookie settings" in the footer. Withdrawing consent does not affect processing that took place before you withdrew it. If you withdraw consent before an order is delivered, we may not be able to complete it. We may still keep order records where the law requires us to (see section 6).
4. Cookies and browser storage
- Essential browser storage: we keep your cart contents and the last pincode you checked in your browser's local storage, and a summary of your most recent order in session storage so we can show your order confirmation. After you send an enquiry, we also store the time in local storage to prevent accidental duplicate submissions. We also store your cookie choice there so we don't ask again on every page. We also keep a random visit number in session storage for our visit statistics (see section 1); it is deleted when you close the tab. This stays on your device and is never sent to us, except for that visit number and, when you place an order, the items in your cart and the details you enter.
- Payments: Our payment partner's checkout window may use its own cookies or storage to process your payment securely. These are governed by our payment partner's policies.
- Analytics (optional): Google Analytics cookies (named
_gaand_ga_*) are set only if you click "Accept". They last up to 2 years.
You can change your choice at any time through "Cookie settings" in the footer, or by clearing cookies in your browser.
You can clear browser storage at any time through your browser settings; this empties your cart. We do not use advertising cookies. We set no analytics cookies unless you accept them.
5. Who we share it with
We share personal data only with service providers who help us run the Site and fulfil orders, and only for the purposes above:
- Our payment partner (payment gateway): processes your payment and any refund. Your name, email and mobile number are passed to our payment partner's checkout to pre-fill it.
- Courier and logistics partners: receive your name, phone number and delivery address so they can deliver your order.
- Google (Firebase Hosting, Cloud Functions, Cloud Firestore and Cloud Storage, plus Google Analytics if you consent): hosts the Site, runs our checkout and stores orders, custom print photos and enquiry form submissions, and provides analytics.
- Meta (WhatsApp and Instagram): when you choose to contact us on those services, or we send you order updates on WhatsApp, their own privacy policies apply.
We may also disclose information if the law requires it, or to protect our rights, our customers or the public.
6. Where we store it and for how long
Orders and enquiry form submissions are stored in Google Cloud Firestore in the Mumbai (asia-south1) region. Some of our service providers may process data outside India, with appropriate safeguards and as permitted by law.
- Paid orders: kept for as long as tax and accounting laws require (up to 8 years).
- Unpaid or abandoned checkouts: deleted automatically after 30 days.
- Custom print photos: deleted automatically 45 days after upload, which covers printing, delivery and the 7-day replacement period.
- Visit statistics: deleted automatically after 90 days.
- Hashed IP addresses used for rate limiting: deleted automatically within about a day.
- Enquiry form submissions: deleted automatically 24 months after you send them.
- Messages you send us on WhatsApp, by email or on Instagram: kept for up to 24 months after our last contact with you, unless the law requires us to keep them longer.
- Analytics data: kept for Google Analytics' standard retention period (up to 14 months).
7. Security
We take the security of your data and payments seriously:
- The Site is served only over encrypted HTTPS connections.
- Payments are handled entirely by our payment partner. Your card, UPI and bank details go directly to them and never reach our servers.
- Every payment is verified on our server using our payment partner's cryptographic signature before an order is confirmed, and prices are always calculated on our server, not in your browser.
- Order and enquiry data can't be read back through the Site, and access to it is limited to Noviara.
No method of transmission or storage is completely secure, but we take reasonable steps to protect your data. If a personal data breach affects you, we will inform you and the authorities as required by law.
8. Your rights
Subject to applicable law, you can ask us to:
- tell you what personal data we hold about you and how we use it;
- correct, complete or update your data;
- erase your data (we may need to keep order records that the law requires us to retain);
- withdraw your consent; and
- nominate someone to exercise these rights on your behalf.
To make a request, email support@noviara.in. We will reply within 30 days. If you are not satisfied with our response, you can complain to the Data Protection Board of India.
9. Children
The Site is not directed at children under 18, and we do not knowingly collect their personal data. Anyone under 18 may only order with the involvement of a parent or legal guardian. If you believe a child has sent us personal data, please contact us and we will delete it.
10. Links to other sites
The Site links to third-party services such as WhatsApp and Instagram. Their privacy practices are governed by their own policies.
11. Changes to this policy
We may update this policy from time to time, and the "Last updated" date above will change when we do. We encourage you to review it periodically.
12. Contact and grievances
For any question, request or grievance about your personal data, contact us at support@noviara.in or on WhatsApp at +91 62839 52900, or write to the Grievance Officer, Noviara, 151-L, Ram Lal Chowk, Model Town, Panipat, Haryana 132103, India. See also the grievance redressal section of our Terms & Conditions.