Effective from 26 September 2026
This policy explains what personal data Tabby Claws collects when you visit https://tabbyclaws.in (or its mirror addresses), shop with us or talk to us. It covers why we collect it, who we share it with, how long we keep it and the rights you have. We have kept it in plain English. If anything is unclear, write to our Grievance Officer, whose details are at the end.
Who we are
Tabby Claws is run by [Seller legal name — set in admin], [Registered address — set in admin] ("we", "us", "our").
Under the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), we are the Data Fiduciary: we decide why and how your personal data is used. You are the Data Principal. Companies that handle data for us, such as our hosting provider, are Data Processors and may use it only on our instructions and under a contract with us.
This policy is also our privacy policy for the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent they still apply, and it follows the Digital Personal Data Protection Rules, 2025.
What we collect
Information you give us
- Contact and account details: name, email address and mobile number.
- Delivery details: shipping and billing address, pincode and delivery instructions.
- Order history: what you bought, prices, coupons used, payment status (for example paid, pending or refunded), invoices, returns and cancellations.
- Custom set details: your nail sizes, shape and length choices, design notes and any reference photos you upload. We remove location and camera data (EXIF and GPS) from uploaded images.
- Reviews and any photos you add to them.
- Messages you send us through the contact form, email or WhatsApp.
- Newsletter sign-up: your email address, if you subscribe.
- Refund details for cash on delivery orders: if a COD order needs a refund, the UPI ID or bank account you give us, used only to send that refund.
Information collected automatically
- Technical logs: IP address, browser and device type, pages requested, date and time, and error reports. Our servers record these to keep the site secure and working.
- Aggregated counters: explained under "Analytics" below. These are not linked to you.
What we do not collect
- Card, UPI and bank details for payments. Online payments are handled by our payment partner, Razorpay. You enter these details in Razorpay's secure payment window. We never see or store your card number, CVV, UPI PIN or net banking login. We only receive a payment reference and whether the payment succeeded.
- Camera video or hand photos from the try-on. See the next section.
- Health information. Please don't include medical details in messages or design notes. If you tell us about a skin reaction so that we can help, we use that only to handle your request.
The virtual try-on stays on your device
Our 3D preview, live camera try-on and photo try-on run entirely in your web browser, on your own device.
- Hand tracking and nail rendering happen locally. No camera frames, video or hand photos are uploaded to us or stored by us.
- The camera turns on only when you start the try-on and your browser asks for your permission. It turns off when you leave. You can withdraw camera permission at any time in your browser settings.
- A photo you choose for the photo try-on is opened in your browser and is not uploaded.
- Images you create with Save look are saved to your device. They leave your device only if you decide to share them.
Sign-in
Sign-in is provided by our authentication provider through the Lehana platform. You can sign in with your mobile number and a one-time password (OTP), or with your Google account. The provider confirms who you are and shares your verified phone number or email, and your name where available, with us. We never receive your Google password. If you use Google sign-in, Google's own privacy policy also applies to that step.
Why we use your data, and our legal basis
We process personal data only with your consent or for a "legitimate use" allowed by Section 7 of the DPDP Act. When we ask for consent, we use a clear, unticked checkbox or button, and we tell you what it is for.
| Purpose | Data used | Basis |
|---|---|---|
| Taking, packing and delivering your order, and sending order updates | Contact, delivery and order details | Data you provide voluntarily for this purpose (Section 7(a)) |
| Making your custom set | Sizes, design notes, reference photos | Your consent |
| Sign-in, account, saved addresses and wishlist | Account details | Your consent |
| Support, returns, refunds and grievances | Contact, order details, messages | Data you provide voluntarily for this purpose (Section 7(a)) |
| WhatsApp order updates | Mobile number, order status | Your consent (opt-in) |
| Newsletter and offers | Email address | Your consent (opt-in, unsubscribe any time) |
| Publishing your review | Display name, review text, photos | Your consent |
| Security, fraud prevention and COD eligibility | Technical logs, order history | Needed to fulfil your orders safely, and required for security by the DPDP Rules |
| Tax records, invoices and lawful requests | Order and invoice records | Compliance with law, including GST law and court or government orders (Section 7) |
We will not use your data for a new purpose without telling you and, where the law requires, asking for fresh consent.
Analytics
We count a few things on our own servers in daily totals, such as page views, product views and add-to-bag clicks (for example, "this set was added to bags 12 times today"). These counters do not contain or link to your name, account, device or IP address.
We do not use third-party advertising or tracking tools, we do not track you across other websites, we do not build advertising profiles, and we never sell or rent your personal data.
Cookies and local storage
We use only essential storage: your sign-in session, bag contents, wishlist, recently viewed items and your consent choice. There are no advertising or analytics cookies. See our cookie policy for the full list.
Who we share data with
We share only what each partner needs to do its job:
- Razorpay, our payment processor: order amount and reference, and the details you enter in its payment window, to process your payment and prevent fraud.
- Courier partners: your name, phone number and delivery address, to deliver your parcel and collect returns.
- Messaging providers: if you opt in to WhatsApp updates, your number and order messages pass through our messaging provider and WhatsApp.
- Our authentication provider, to sign you in.
- Hosting, email and backup providers who run our systems under contract.
- Government, courts and law enforcement, when the law requires it or to protect our customers and business from fraud.
- A new owner, if our business is ever merged or sold. They must keep to this policy.
Where your data is stored
We store and process your personal data on servers located in India. Some services you choose to use, such as Google sign-in or WhatsApp, may process data outside India under their own terms. This is permitted under Section 16 of the DPDP Act unless the Government restricts transfers to a particular country.
How long we keep it
| Data | How long |
|---|---|
| Orders, invoices and payment records | About 8 years. GST law (Section 36 of the CGST Act) requires us to keep them for at least 72 months from the due date of the annual return for that year |
| Custom reference photos | Deleted within 90 days after your custom set is delivered |
| Custom sizes and design notes | Kept with your order so we can remake or repeat it. Ask us to delete them sooner |
| Account details | While your account is active, or until you ask us to delete it |
| Contact messages | 2 years |
| Newsletter email | Until you unsubscribe |
| Reviews | While published, or until you ask us to remove them |
| Technical and security logs | 1 year, as the DPDP Rules 2025 require, then deleted |
| Try-on camera frames and photos | Never stored by us |
When a period ends, we delete the data or make it anonymous, unless the law requires us to keep it longer.
Your rights
As a Data Principal you have the right to:
- Access: get a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
- Correction, completion and updating: fix anything that is wrong, incomplete or out of date.
- Erasure: ask us to delete your data. We will, except for records the law requires us to keep (such as GST invoices).
- Withdraw consent: as easily as you gave it. Use the unsubscribe link in any email, ask us to turn off WhatsApp updates, or write to us. Withdrawal doesn't affect what we did before it, but some services may stop working.
- Grievance redressal: have your complaint about our handling of your data answered by us.
- Nominate someone to exercise these rights for you if you die or become unable to act.
How to use your rights: email our Grievance Officer at grievance@tabbyclaws.in from the email address or phone number linked to your order or account. To protect you, we may verify your identity, for example with an OTP. There is no charge. We acknowledge requests within 48 hours and aim to resolve them within 30 days, and always within the 90-day limit set by the DPDP Rules 2025.
In return, the DPDP Act asks you to give accurate information, not to impersonate anyone and not to file false or frivolous complaints.
Children
Tabby Claws is meant for adults aged 18 and over. Under the DPDP Act, anyone under 18 is a child, and processing a child's personal data requires verifiable consent from a parent or lawful guardian. Because our store is not meant for children, we do not knowingly collect their data or accept their orders. If we learn that we hold a child's data without that consent, we will delete it. Parents or guardians can contact us at any time. We do not do behavioural tracking or targeted advertising for anyone, children included.
How we protect your data
- HTTPS encryption on every page.
- Access to personal data only for people who need it for their work (least privilege), with individual logins.
- Admin access limited to an approved list, with changes logged.
- Uploaded images checked, re-encoded and stripped of metadata.
- Encrypted backups.
- Payments handled by a PCI DSS compliant payment partner, so card data never reaches our servers.
- Regular software updates and monitoring of our logs.
No system is perfectly secure, but we take reasonable security safeguards as the law requires and review them regularly.
If there is a data breach
If a personal data breach affects you, we will tell you without delay: what happened, what it may mean for you, what we are doing about it, what you can do to protect yourself, and who to contact. We will also report it to the Data Protection Board of India as the DPDP Act and Rules require, and to CERT-In where its rules apply.
Changes to this policy
We may update this policy as our store or the law changes. The new version will be posted here with a new effective date. If the change is significant, we will tell you by email or a notice on the site, and ask for fresh consent where required.
Contact and Grievance Officer
- Data Fiduciary: [Seller legal name — set in admin], [Registered address — set in admin]
- Grievance Officer: [Grievance officer — set in admin]
- Grievance Officer email: grievance@tabbyclaws.in
- Grievance Officer phone:
- Customer care: hello@tabbyclaws.in, (Mon–Sat, 11 am – 7 pm IST)
Complaining to the Data Protection Board of India
If you are not satisfied with our response, or we don't respond in time, you can complain to the Data Protection Board of India through its online platform. The DPDP Act asks you to use our grievance process first, so please write to our Grievance Officer before going to the Board.