Privacy Policy

1. Information We Collect

• Account details: name, email address, mobile number, gender (optional), date of birth (optional) and your password (stored as a salted hash — never in plain text).
• Order & shipping information: billing and delivery addresses, products purchased, order value, payment method (we do not store full card numbers — payments are processed by our PCI-DSS compliant payment partners).
• Communication data: WhatsApp number, OTP codes (short-lived), support chat history, reviews and product feedback you submit.
• Device & usage data: IP address, browser type, pages viewed, referring URL, and basic analytics events used to improve the store experience.
• Cookies & local storage: a session token to keep you signed in, and your cart contents. We do not use third-party advertising cookies.

2. How We Use Your Information

• Process orders, payments, returns, exchanges and refunds.
• Send transactional notifications about your order (confirmation, shipping, delivery, return updates) over WhatsApp, SMS and email.
• Authenticate you via OTP and keep your account secure (rate limiting, fraud checks, session expiry).
• With your consent, share occasional product launches, restocks and offers. You can opt out at any time (see Section 6).
• Improve our products, catalog and website performance through aggregate analytics.
• Comply with applicable legal, tax and accounting obligations.

3. How We Share Your Information

We do not sell your personal data. We share the minimum data required with trusted processors so the store can function:

• Payment gateways (e.g. Razorpay) — to capture and verify payments securely.
• Logistics & courier partners — to deliver your orders and process returns.
• Communication providers (Twilio for WhatsApp/SMS, Resend for email) — to deliver OTPs and order updates.
• Cloud hosting & storage — to securely host our application, database and product images.
• Government authorities — only when legally required, such as in response to a valid legal request.

4. Data Security

We protect your information using industry-standard safeguards: HTTPS/TLS encryption in transit, bcrypt-hashed passwords, short-lived session tokens with automatic expiry, rate-limited OTP delivery, and strict role-based access on our admin dashboard. While no system can be guaranteed 100% secure, we continuously review our practices to keep your data safe.

5. Data Retention

We retain your account and order information for as long as your account is active and for a reasonable period afterwards to comply with tax, accounting and legal obligations. OTP codes and login sessions are short-lived and automatically purged. You can request deletion of your account at any time (see Section 7).

6. Your Choices & Marketing Opt-out

• Access & update: review or edit your profile, saved addresses and order history from the Profile page.
• Marketing opt-out: reply STOP to any WhatsApp/SMS broadcast, click "Unsubscribe" in any marketing email, or contact us at support@bhalebaala.com. Transactional messages (order, delivery, returns) will continue, as they are required for the service.
• Cookies: you can clear or block cookies in your browser; some features (cart, login) may stop working as a result.

7. Account Deletion

To delete your account and personal data, email us at support@bhalebaala.com from the email address registered with us. We will action verified deletion requests within 30 days, except where data must be retained for legal, fraud-prevention or accounting reasons.

8. Children's Privacy

Bhale Baala sells babywear and kids' clothing, but our store is intended to be used by parents and guardians (18 years or older). We do not knowingly collect personal information from children. If you believe a child has provided us with information, please contact us so we can remove it.

9. Changes to this Policy

We may update this Privacy Policy occasionally to reflect changes in our practices or legal obligations. The "Last updated" date at the top will always show the latest revision. Material changes will be communicated through the website or email.