Privacy Policy

This policy explains what personal data Herbix ("we", "us") collects when you browse our store, place an order or join our newsletter, why we collect it, who we share it with, and the choices and rights you have. We follow India's Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, and we apply the principles of the EU and UK GDPR for customers in those regions.

1. Who is responsible for your data

The business that decides how your data is used (the "data fiduciary" in India, the "controller" under GDPR) is:

• Herbix

For privacy questions or complaints, contact our grievance officer:

2. What we collect

• Order details: your name, email address, phone number, delivery address and country, what you ordered, and any discount code you used. You must give us these to buy from us. We do not have customer accounts, so there is no password to store.
• Payment details: payments are taken by our payment partner Razorpay. We never see or store your card number, UPI PIN or net-banking credentials. We receive a confirmation, a payment reference and the type of payment method used.
• Newsletter: your email address, and when and where you signed up, so we can show that you agreed. We only email you after you confirm through a link we send you (double opt-in).
• Reviews: if you write a product review, your name, rating and review text (shown publicly once we approve it) and your email address (never shown; used to mark verified buyers and to allow one review per product).
• Messages: anything you send us when you contact us.
• Technical data: your IP address and basic request logs, which our hosting uses to keep the site secure, prevent abuse and fix faults. If you allow analytics cookies, we also receive anonymous visit statistics.
• On your device: your shopping bag is saved in your browser's local storage so it is still there when you come back. See "Cookies and similar technologies" below.

3. Why we use it, and our legal basis

• To deliver your order (contract): take payment, pack and ship it, send order updates, and handle returns and refunds.
• To meet legal duties: keep tax, GST and accounting records, and respond to lawful requests from authorities.
• With your consent: send the newsletter, publish a review you chose to write, and use optional analytics or third-party media. You can withdraw consent at any time; this does not affect what we did before.
• For our legitimate interests: keep the store secure, prevent fraud and abuse, and understand and improve how the store works. Where GDPR applies you may object to this (see your rights).

We do not sell your personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.

4. Who we share it with

We share data only with the service providers we need to run the store, and only as much as they need:

• Razorpay: payment processing.
• Resend: sending order emails and newsletters.
• Supabase: secure database hosting for orders and subscribers.
• Vercel: website hosting and, if you allow it, anonymous analytics.
• Cloudinary: hosting and delivery of product and customer-story images and videos.
• Couriers and delivery partners: your name, address and phone number so they can deliver your parcel.
• Accountants, advisers and authorities: where the law requires, or to protect our legal rights.
• YouTube or Instagram: only if you choose to allow third-party media and then play a customer story hosted there. They then receive your IP address and may set their own cookies.

5. Transfers outside your country

Our providers may process data in India, the European Economic Area, the United States and other countries. Where the law requires it we rely on safeguards such as standard contractual clauses or the provider's certified data protection commitments, so your data stays protected wherever it is handled.

6. How long we keep it

• Order and payment records: for as long as Indian tax, GST and accounting law requires, which is several years.
• Newsletter email address: until you unsubscribe. After that we keep only a minimal record so we do not email you again.
• Reviews: until you ask us to remove yours.
• Messages: as long as needed to help you, and for a reasonable period afterwards.
• Server logs: a short period, then deleted or anonymised.

7. Keeping it safe

Data travels over encrypted connections, access to our admin system is limited to named staff with their own sign-in and two-step verification, and we keep our providers to the same standard. No system is perfectly secure; if a breach affects you we will tell you and the authorities as the law requires.

8. Your rights

You can ask us at any time to:

• see the personal data we hold about you and how it is used;
• correct data that is wrong or incomplete;
• delete your data (we may have to keep some records, such as invoices, for legal reasons);
• withdraw consent you gave us, for example by using the unsubscribe link in any newsletter.

If you are in India, you also have the right to grievance redressal and to nominate someone to exercise your rights if you die or become unable to. If we do not resolve your complaint you may approach the Data Protection Board of India.

If you are in the EEA or the UK, you also have the right to restrict or object to our use of your data, to receive your data in a portable format, and to complain to your local data protection authority.

If you are in California, you have the right to know what we collect, and to ask for correction or deletion. We do not sell or share personal information for advertising.

To use any of these rights, email our grievance officer (section 1) from the address you used with us. We will reply within 30 days.

9. Cookies and similar technologies

We use three kinds:

• Strictly necessary: keep your bag, remember your cookie choice, and keep checkout and payment secure. These cannot be switched off.
• Analytics (optional): anonymous statistics about which pages are visited, so we can improve the store. Off unless you allow it.
• Third-party media (optional): lets customer-story videos hosted on YouTube or Instagram play on our pages. Off unless you allow it, and nothing is loaded from those sites before you do.

You can change your choice at any time with Cookie settings. Your browser also lets you block or delete cookies, but parts of the store may then not work.

10. Children

Our store is meant for adults. We do not knowingly collect personal data from anyone under 18. If you think a child has given us data, tell us and we will delete it.

11. Changes to this policy

We will post any changes on this page and update the date at the top. If a change is significant we will tell you in another suitable way, such as by email.