Privacy Policy

Who we are and what this policy covers

This Privacy Policy explains how Nutroally collects, uses, stores and protects your personal data when you visit https://nutroally.shop, place an order or contact us.

It applies to customers in India and is written with reference to the Digital Personal Data Protection Act, 2023 (DPDP Act). Nutroally operates the store at https://nutroally.shop under [ADD LEGAL ENTITY NAME], registered at Ranchod Nagar Society, Katargam, Surat, Pin- 395004.

Information we collect

We collect only the information needed to sell, deliver and support your order.

• Identity and contact details: name, phone number and email address.
• Delivery details: your shipping address and any delivery instructions you give us.
• Order history: the products you bought, order value, dates and delivery status.
• Communications: messages you send us on WhatsApp, by phone or by email.
• Technical data: IP address, device and browser type, and the pages you visit.

Payment information

We do not ask for and do not store card numbers, UPI IDs, bank credentials or CVV. Payment details are entered directly on our payment partner's systems.

How we use your information

We use your personal data to:

• Accept, pack and deliver your order, including sharing delivery details with our courier partners.
• Send order and delivery updates by email, WhatsApp or SMS.
• Answer questions and provide customer support.
• Process returns, replacements and refunds.
• Keep accounting, tax and other records required by law.
• Detect and prevent fraud, misuse and unauthorised transactions.
• Understand how the site is used and improve it.

Payments handled by PayU

All online payments are processed by PayU, which supports UPI, cards, netbanking and wallets. When you pay, your payment details are entered on PayU's secure systems and are handled under PayU's own privacy policy.

Nutroally does not receive or store your full payment credentials. We receive only a confirmation containing the transaction reference, the amount, the payment status and limited masked details needed to match the payment to your order.

Cookies and analytics

We use cookies and similar technologies to keep the site working, remember your cart and understand how the store is used.

• Essential cookies are needed for checkout and other core functions.
• Google Analytics 4 (GA4) helps us understand traffic and page usage.
• Meta Pixel helps us measure advertising and campaign performance.

Third parties we share data with

We share personal data only where it is needed to run the store. We do not sell your personal data.

You can block or delete cookies in your browser settings. If you block essential cookies, parts of the store, including checkout, may not work.

• PayU — payment processing.
• Supabase — hosting our database and store data.
• Cloudflare — security, content delivery and traffic handling.
• Google — analytics and advertising measurement.
• Courier partners — delivering your order.
• Government or law-enforcement authorities, where required by law.

How long we keep your data

• Order, payment and invoice records are kept for as long as tax, accounting and dispute-resolution rules require.
• Support conversations are kept only as long as needed to resolve your issue.
• Analytics data is retained according to the provider's settings.
• When data is no longer needed, we delete or anonymise it.

Your rights

Under the Digital Personal Data Protection Act, 2023 and other applicable law, you can:

• Ask for a copy of the personal data we hold about you.
• Ask us to correct data that is inaccurate or out of date.
• Ask us to erase data we no longer have a lawful reason to keep.
• Withdraw consent for marketing or analytics, where consent is the basis for processing.
• Raise a complaint about how your data is handled.

Children

The store is intended for adults. If you are under 18, please use the store only with the consent and supervision of a parent or legal guardian.

Security

We use reasonable technical and organisational measures, including encryption in transit and access controls, to protect personal data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Changes to this policy

We may update this policy from time to time. The revised version will be posted on this page with a new last updated date, and significant changes will be highlighted on the site.