Privacy policy

1. Who is responsible

Lafz (a sole proprietorship of Ravnish Kumar, not registered for GST) decides how your personal data is used, and is the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023. Questions go to our grievance officer, Aayush Goyal, at [email protected].

2. What we collect

When you order: your name, email address, phone number, delivery address, any gift note, the prints you buy and what you paid. Razorpay gives us a payment reference and status; we never receive your card, UPI or bank details.

When you browse: the pages you view, the device and browser you use, your approximate location (from your IP address) and the site that sent you. Google Analytics and the Meta Pixel collect this through cookies, along with the prints you view, add to your bag and buy. Microsoft Clarity records how you move, scroll and click on the page so we can find and fix problems; it never records what you type into forms. Your bag is kept in your own browser until you check out.

When you write to us: your message and contact details.

3. Why we use it

To make, pack and deliver your order, and send its confirmation, shipping and refund emails.
To answer your questions and handle complaints, damage claims and refunds.
To prevent fraud and keep the site secure.
To keep the accounting and tax records the law requires.
To understand how the site is used, in aggregate, so we can improve it.
To measure our adverts on Facebook and Instagram, and show them to people likely to be interested.

By placing an order you consent to us using your details to fulfil it as described here. We don’t send marketing emails. You can withdraw consent at any time by writing to us; we’ll stop using your data except where we need it to finish an order already placed or the law requires us to keep it.

Only the services that help us run the shop, each for its own task:

Razorpay, to take your payment and issue refunds.
Our courier partner, who receives your name, address and phone number to deliver the parcel.
Brevo, which sends our order emails.
Google (Analytics and Tag Manager), which measures visits and purchases on the site.
Meta (the Meta Pixel and Conversions API), which measures visits and purchases that come from our Facebook and Instagram adverts. Our server tells Meta which prints were viewed, added to a bag or bought, with your IP address and browser details; for a purchase it also sends your email address, phone number, name, city, state and PIN code in hashed (scrambled) form, which Meta can only match against its own accounts. Meta may combine this with your Meta account under its own privacy policy.
Microsoft (Clarity), which records anonymous sessions and heatmaps of how the site is used, with form entries and your order details hidden, so we can spot broken or confusing pages.
Cloudflare, which protects the site and delivers its pages.

We may also disclose data when the law requires it. We don’t sell, rent or trade your personal data. Some of these providers process data outside India under their own safeguards.

6. How long we keep it

Order records are kept for as long as accounting and tax law requires, up to 8 years. Emails with us are kept for up to 2 years after the matter is closed. Google Analytics keeps visit data for up to 14 months; Clarity keeps recordings for up to 30 days (longer only for any we choose to save); Meta keeps Pixel data under its own policy. When data is no longer needed we delete it.

7. Cookies and browser storage

Your bag is saved in your browser’s local storage so it’s still there when you come back. Google Analytics sets cookies (named _ga and _ga_*) to tell visits apart. The Meta Pixel sets advertising cookies (named _fbp, and _fbc when you arrive from a Facebook or Instagram advert) to measure our adverts. Microsoft Clarity sets cookies (named _clck and _clsk) to join the pages of one visit together.

You can block or delete cookies in your browser settings, install Google’s Analytics opt-out add-on, or turn off ads based on activity from other websites in your Meta ad preferences. The shop works without these cookies.

8. Your rights

The rights under the Digital Personal Data Protection Act, 2023 come into force in stages. We already honour them today: you can ask us to

tell you what personal data we hold about you and who we’ve shared it with;
correct, complete or update it;
erase it, unless we must keep it by law (for example, order records for tax);
stop using it, by withdrawing your consent;
let someone you nominate exercise these rights if you can’t.

Write to [email protected]. We acknowledge requests within 48 hours and respond within one month. If you aren’t satisfied, you can take the matter to the Data Protection Board of India once its complaint process applies.

9. Security

The site runs only over HTTPS. Payments are handled by Razorpay, which is PCI DSS compliant. Access to order data is limited to the people who make and send your order. No system is perfectly secure; if a breach affects your data, we’ll tell you and the authorities as the law requires.

10. Children

The shop is meant for adults. We don’t knowingly collect data from anyone under 18 without a parent’s consent.

11. Changes to this policy

If we change how we use personal data, we’ll update this page and the date at the top.