Draft for legal review. Not yet in force. Highlighted items in brackets must be confirmed by AnandBodh Foundation, its CA or its lawyer before launch.

Privacy notice

Last updated: [date of approval]

This notice explains what personal data the heartswill.com store collects, why, and your rights over it. The data fiduciary is AnandBodh Foundation, [registered address], GSTIN [GSTIN]. We follow the Digital Personal Data Protection Act, 2023 and its Rules.

1. What we collect

• When you order: your name, email, phone number and delivery address, the products you bought, the price you chose and the cause you picked.
• Payment: Razorpay processes your payment. We receive a payment reference and the amount. We never receive your card or bank details.
• On the site: a random bag code stored in your browser so your bag is remembered. We do not use advertising or tracking cookies. [Update this line if analytics are added]
• If you write to us: your message and contact details.

2. Why we use it

• To process, deliver and support your order, including emails about its status.
• To record your contribution and show you where your hearts went.
• To issue tax invoices and keep the records the law requires.
• To prevent fraud and keep the store secure.

We do not sell your data. We will only send marketing messages if you separately agree, and you can stop them at any time.

3. Who we share it with

• Supabase: stores order data on servers in Mumbai, India.
• Razorpay: processes payments.
• SocketLabs: sends order emails.
• [courier name]: receives your name, phone number and address to deliver your order.
• The Heartswill platform: receives only a coded form of your order number, the contribution amount and the cause. It receives no name, email, phone number or address.

Each provider may only use your data to provide its service to us.

4. How long we keep it

We keep order and invoice records for [8 years] as tax law requires. Other data is deleted when it is no longer needed for the purposes above.

5. Your rights

You can ask us to give you a summary of your data, correct or update it, or erase it where we are not required by law to keep it. You can withdraw any consent you have given as easily as you gave it. You can also nominate someone to exercise these rights for you. To use any of these rights write to the grievance officer below.

If you are not satisfied with our response you may complain to the Data Protection Board of India.

6. Children

Except with verifiable consent from a parent or guardian, we do not knowingly collect personal data from anyone under 18.

7. Security and breaches

We use encryption in transit, access controls and secure providers. If a personal data breach affects you we will tell you and the Data Protection Board as the law requires.

Grievance officer

[Name], [Designation], AnandBodh Foundation
Email: [grievance email, for example care@heartswill.com] · Phone: [phone]
Address: [registered address]

We acknowledge every complaint within 48 hours and give you a ticket number to follow it. We resolve complaints within one month of receiving them.