What we know about you

• Your name, email address and mobile number.
• Delivery and billing addresses you save.
• Your orders, and what was in them.
• Your wishlist and basket.
• Reviews you write, and rental enquiries you send.

We do not store your card details. Payments go to Razorpay, which handles the card itself — we keep only their transaction reference so we can match a payment to an order and issue a refund against it.

Stored as a bcrypt hash, which is one-way. We can check whether a password you type matches; we cannot read it, and neither can anyone who obtains the database. Nobody here will ever ask you for it.

• To take, pack and deliver an order, and to talk to you about it.
• To let you sign in, and to recover the account if you cannot.
• To handle a return or a refund.
• To pass a rental enquiry to the shop you sent it to.
• To keep the records a business is required to keep.

We do not sell your details, and we do not pass them to anybody for their own marketing.

Only the services that make the shop work, and only what each one needs:

• Razorpay — to take a payment and issue a refund.
• MSG91 — to send the one-time code that signs you in by mobile.
• Our email provider — to send order confirmations and password codes.
• Cloudinary — image hosting. It holds photographs, not customers.
• The courier delivering your parcel — name, address and phone, so they can hand it over.

This is the one place your details leave us for somebody outside. When you send a rental enquiry, the partner shop is given your name, your mobile number, your email if you supplied one, and the dates you asked for — because they have to ring you, and a shop that cannot ring you cannot rent you anything.

They are independent businesses, not us. What they do with that information afterwards is governed by their own practices, and we ask them to use it only to answer your enquiry.

One that matters: a secure, httpOnly cookie that keeps you signed in. It cannot be read by page scripts, and it is the only reason you are not asked to sign in on every page.

Your basket and wishlist are kept in your own browser’s storage while you are signed out, so they survive a reload. That never reaches us until you sign in.

Orders are kept as long as the law requires us to keep business records. Everything else lives as long as your account does.

You can see and change your name, email, mobile and addresses in your profile at any time.

To have your account deleted, write to us. We will remove your account, addresses, basket, wishlist and reviews. Orders are kept — they are financial records, and every one of them already holds its own copy of the details it needs, so deleting your account does not corrupt them.

The shop is not intended for anyone under 18, and we do not knowingly hold their details.

If this policy changes we will update the date at the top. Anything you want to ask about it goes to lehangabazar@gmail.com.