سياسة الخصوصية

Last updated: July 13, 2026

At IndyAlley, we are committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy explains how we collect, use, store, share, and safeguard your personal information when you visit our website, create an account, place an order, interact with our services, or otherwise engage with our Platform.

By accessing or using our Platform, you acknowledge that you have read and understood this Privacy Policy and agree to the collection, use, and disclosure of your information in accordance with this Policy.

This Privacy Policy should be read together with our Terms of Service, Shipping & Delivery Policy, and Returns & Refunds Policy.

Scope of this Privacy Policy

This Privacy Policy applies to all personal information collected by IndyAlley through:

• Our website.
• Your IndyAlley account.
• Orders placed through our Platform.
• Customer support interactions.
• Marketing communications.
• Surveys, promotions, contests, or campaigns.
• Social media interactions where applicable.
• Any other services offered by IndyAlley.

This Privacy Policy does not apply to third-party websites, applications, or services that may be linked from our Platform. We encourage you to review the privacy policies of such third parties before sharing your personal information.

Information We Collect 

We collect personal information that you provide directly to us, information that is collected automatically when you use our Platform, and information received from trusted third parties. The information we collect depends on how you interact with our Platform and the services you use. 

Account & Profile Information 

When you create an account or interact with our Platform, we may collect information such as:

• Full name
• Email address
• Mobile or telephone number
• Date of birth (where applicable)
• Username and password
• Account preferences and profile information

Shipping, Billing & Payment Information 

To process your orders and payments, we may collect:

• Shipping and billing addresses
• Recipient details for gift orders
• Payment method and transaction details
• UPI ID, digital wallet information, or other payment information required to complete your purchase
• Payment confirmation and transaction reference numbers

IndyAlley does not store your complete credit or debit card details, CVV, or other sensitive payment credentials. Payments are securely processed by our authorised payment gateways and service providers in accordance with applicable security standards.

Order & Transaction Information

When you browse or shop on our Platform, we may collect information relating to:

• Products viewed, searched, or added to your cart or wishlist
• Orders placed and purchase history
• Transaction amounts and payment status
• Returns, refunds, exchanges, and cancellations
• Order preferences and shopping activity

Communication & User Content 

When you communicate or interact with us, we may collect:

• Customer support enquiries
• Emails, messages, and chat communications
• Phone call records, where permitted by law
• Feedback, reviews, ratings, and testimonials
• Survey responses
• Product reviews, comments, questions, images, videos, and other content you choose to share on our Platform

Automatically Collected Information

When you access or use our Platform, we may automatically collect certain technical and usage information through cookies and similar technologies, including:

• IP address
• Browser type and version
• Device type and operating system
• Approximate location based on your IP address
• Pages visited, search queries, browsing behaviour, and interactions with our Platform
• Session information
• Cookies, web beacons, pixels, log files, cookie identifiers, and similar technologies
• Analytics, performance, and diagnostic information

This information helps us maintain the security of our Platform, improve its functionality and performance, analyse user behaviour, and enhance your overall experience.

Where required by applicable law, we will provide appropriate notice and obtain your consent before using non-essential cookies or similar technologies.

Information from Third Parties 

We may receive personal information from trusted third parties, including:

• Payment gateways and payment service providers
• Shipping and logistics partners
• Vendor Partners involved in fulfilling your orders
• Marketing and analytics service providers
• Fraud detection and identity verification providers
• Social media platforms, where you choose to connect your account
• Publicly available sources, where permitted by applicable law

Any personal information received from trusted third parties is used only for the purposes described in this Privacy Policy and in accordance with applicable laws.

How We Collect Your Information

We collect personal information through the following methods:

• Directly from you, when you create an account, place an order, contact Customer Support, subscribe to our communications, participate in surveys or promotions, submit reviews, or otherwise provide information to us.
• Automatically, when you visit or interact with our Platform through cookies, web beacons, log files, pixels, and similar technologies that collect technical and usage information.
• From our service providers, including payment gateways, logistics partners, technology providers, analytics providers, and other service providers that process information on our behalf to support our business operations.
• From trusted third parties, including social media platforms (where you choose to connect your account), fraud prevention services, publicly available sources, and other partners where permitted by applicable law.

How We Use Your Information

We use your personal information to provide, operate, improve, and protect our Platform, fulfil our contractual obligations, communicate with you, and comply with applicable legal and regulatory requirements.
Depending on how you interact with our Platform, we may use your information for the following purposes:

Account Management 

We use your information to:

• Create, maintain, and manage your IndyAlley account.
• Verify your identity and authenticate your account credentials.
• Enable secure login and access to Platform features.
• Personalise your shopping experience and account preferences.

Order Processing & Fulfilment 

We use your information to:

• Process and confirm your orders.
• Process payments and complete transactions securely.
• Coordinate with Vendor Partners to fulfil your purchases.
• Arrange shipping, delivery, and logistics.
• Provide order tracking and delivery updates.
• Process returns, refunds, exchanges, and cancellations.

Customer Support & Communications 

We use your information to:

• Respond to your enquiries, requests, and complaints.
• Provide customer support and technical assistance.
• Send order confirmations, shipping notifications, delivery updates, and other transactional communications.
• Notify you of important information relating to your account, purchases, or our Platform.

Marketing & Promotional Communications 

Where permitted by applicable law or with your consent, we may use your information to:

• Send promotional emails, newsletters, and special offers.
• Recommend products and services that may be relevant to your interests.
• Display personalised advertisements.
• Conduct surveys, polls, and market research.
• Invite you to participate in contests, promotions, or other marketing campaigns.

You may opt out of receiving marketing communications at any time by updating your Marketing Preferences in your IndyAlley account or by contacting our Customer Support team.

Platform Improvement & Analytics 

We use your information to:

• Understand customer preferences and shopping behaviour.
• Improve the functionality, performance, and user experience of our Platform.
• Develop new products, features, and services.
• Conduct analytics, testing, and performance monitoring.
• Generate aggregated or anonymised insights to improve our business operations.

Security & Fraud Prevention

We use your information to:

• Protect your account and our Platform from fraud, unauthorised access, and other security threats.
• Verify identities and authenticate transactions.
• Detect, investigate, and prevent fraudulent, illegal, or malicious activities.
• Enforce our Terms of Service and other applicable policies.
• Maintain the security and integrity of our Platform.

To help protect your account, we recommend that you keep your login credentials confidential and do not share them with anyone.

Legal & Regulatory Compliance 

We may use your information to:

• Comply with applicable laws, regulations, and legal obligations.
• Respond to lawful requests from government authorities, regulators, or law enforcement agencies.
• Enforce our legal rights, agreements, and policies.
• Resolve disputes and investigate complaints.
• Maintain records for audit, taxation, and regulatory compliance purposes.

Vendor Management (Where Applicable)

If you register as a Vendor Partner, we may use your information to:

• Verify your identity and business information.
• Onboard and manage your vendor account.
• Process payments and settlements.
• Monitor vendor performance and compliance.
• Facilitate communication relating to orders and customer support.
• Enforce our Vendor Agreement and marketplace policies.

Lawful Processing

We process your personal information only where permitted by applicable law, including where necessary to:

• Provide our services and fulfil our contractual obligations.
• Comply with legal and regulatory requirements.
• Protect the security, integrity, and legitimate interests of our Platform.
• Improve our products and services.
• Process your information based on your consent, where required.

You may withdraw your consent at any time where processing is based on consent, subject to applicable legal requirements.

Sharing Your Information

We may share your personal information with trusted third parties where necessary to operate our Platform, fulfil your orders, provide our services, comply with legal obligations, or protect the security and integrity of our business. We only share the information necessary for the relevant purpose and require our service providers and partners to safeguard your information in accordance with applicable laws.

Vendor Partners 

To fulfil your order, we may share certain personal information with the Vendor Partner responsible for supplying the product. This information may include:

• Name
• Shipping address
• Contact details
• Order information

Vendor Partners may use this information solely for the purpose of processing, fulfilling, and supporting your order, and to comply with applicable legal obligations. They are not permitted to use your personal information for unrelated purposes.

Payment Service Providers 

We share necessary payment information with authorised payment gateways, banks, financial institutions, and payment service providers to:

• Process payments securely.
• Verify transactions.
• Prevent fraudulent activities.
• Complete refunds, exchanges, or other payment-related services.

Payment information is processed securely by our authorised payment partners in accordance with applicable industry security standards.

Shipping & Logistics Partners 

To deliver your orders, we may share relevant information with courier and logistics partners, including:

• Name
• Shipping address
• Contact details
• Order information
• Shipment details

This information is used solely to facilitate shipping, delivery, order tracking, and related logistics services.

Technology & Platform Service Providers

We work with trusted technology providers to support the operation of our Platform, including website hosting, cloud infrastructure, data storage, IT support, security, customer support tools, analytics, and related technology services.

These service providers process personal information only to the extent necessary to provide services on our behalf and are contractually required to protect your personal information in accordance with applicable laws and our instructions.

Analytics & Marketing Partners 

We may share limited information with trusted analytics and marketing partners to:

• Analyse customer behaviour and website performance.
• Improve our Platform and services.
• Measure the effectiveness of marketing campaigns.
• Deliver relevant advertisements and promotional communications, where permitted by applicable law.

These partners process information only for the purposes authorised by IndyAlley and in accordance with their respective privacy obligations.

Fraud Prevention & Security Providers 

We may share information with fraud detection, identity verification, cybersecurity, and risk management service providers to:

• Detect and prevent fraudulent transactions.
• Protect customer accounts.
• Investigate suspicious activities.
• Maintain the security and integrity of our Platform.

Legal & Regulatory Authorities

We may disclose your personal information where required or permitted by law, including to:

• Government authorities.
• Regulatory bodies.
• Law enforcement agencies.
• Courts or judicial authorities.

We may also disclose information where necessary to:

• Comply with applicable laws or legal processes.
• Enforce our Terms of Service and other policies.
• Protect the rights, property, or safety of IndyAlley, our customers, Vendor Partners, or others.
• Prevent fraud or other unlawful activities.

Business Transfers 

If IndyAlley is involved in a merger, acquisition, restructuring, investment, sale of assets, or other corporate transaction, your personal information may be transferred as part of that transaction.

Where required by applicable law, we will notify you of any material changes relating to the transfer of your personal information.

Third-Party Service Providers 

We may engage trusted third-party service providers to support our business operations, including:

• Payment processing.
• Shipping and logistics.
• Customer support.
• Email and SMS communications.
• Cloud hosting and IT infrastructure.
• Data analytics.
• Marketing and advertising.
• Security and fraud prevention.

These service providers may access your personal information only to the extent necessary to perform services on our behalf and are contractually required to maintain appropriate confidentiality and security measures.

Our Commitment 

We do not sell, rent, lease, or trade your personal information to third parties for their independent marketing purposes.

Where required by applicable law, we will obtain your consent before sharing your personal information for any purpose not described in this Privacy Policy.

Ecommerce Platform

IndyAlley uses Shopify to power and operate its online store. As part of providing our services, Shopify may process certain personal information on our behalf to facilitate website hosting, secure checkout, payment processing, order management, fraud prevention, analytics, and other essential ecommerce services.

Shopify processes personal information in accordance with its own privacy practices and applicable data protection laws. For more information about how Shopify processes personal information, please refer to Shopify's Privacy Policy.

International Data Transfers

As IndyAlley serves customers across multiple countries, your personal information may be transferred to, stored, or processed in countries other than your country of residence, including India and other countries where our trusted service providers operate.

These service providers may include our ecommerce platform provider, payment gateways, logistics partners, cloud hosting providers, analytics providers, and other technology partners that help us operate our Platform and deliver our services.

Whenever personal information is transferred internationally, we take appropriate measures to protect it by:

• Ensuring the transfer complies with applicable data protection and privacy laws.
• Implementing appropriate technical, organisational, and contractual safeguards to protect your personal information.
• Working only with trusted service providers that maintain appropriate security and privacy standards.

By using our Platform and providing your personal information, you acknowledge and, where required by applicable law, consent to the transfer, storage, and processing of your personal information in countries where IndyAlley or its trusted service providers operate.

Where personal information originating from the European Economic Area (EEA), the United Kingdom, or other jurisdictions with specific data transfer requirements is transferred internationally, IndyAlley will implement appropriate safeguards in accordance with applicable data protection laws.

Data Retention

We retain your personal information only for as long as necessary to provide our services, fulfil your orders, maintain your account, comply with applicable legal and regulatory obligations, resolve disputes, enforce our agreements, and protect the security and integrity of our Platform.

The length of time we retain your personal information depends on the type of information collected, the purpose for which it was collected, and our legal and business requirements.

Retention Periods

Unless a longer retention period is required or permitted by applicable law, we generally retain your personal information as follows:

• Account & Profile Information: Retained until your account is deleted or after 3 years of account inactivity.
• Order & Transaction Records: Retained for 5 years to comply with accounting, taxation, audit, legal, and regulatory requirements.
• Payment Information: Payment information is retained by our authorised payment service providers in accordance with applicable laws, RBI guidelines, and industry security standards.
• Customer Support & Communication Records: Retained for 2 years to assist with customer support, dispute resolution, and service improvement.
• Marketing Preferences & Communications: Retained until you unsubscribe from marketing communications or withdraw your consent.
• Technical Information, Cookies & Log Data: Retained for 1 year to maintain Platform security, prevent fraud, analyse website performance, and improve our services.

Deletion & Anonymisation

Once your personal information is no longer required for the purposes described in this Privacy Policy or to comply with applicable legal obligations, we will securely delete or anonymise it.

We may retain aggregated, anonymised, or de-identified information for analytics, research, business reporting, and service improvement purposes. Such information cannot reasonably be used to identify you.

Data Security

We are committed to protecting your personal information and implement reasonable technical, administrative, and physical security measures designed to safeguard it against unauthorised access, loss, misuse, alteration, disclosure, or destruction.

While we continuously review and improve our security practices, no method of transmitting information over the internet or storing electronic information is completely secure. Accordingly, we cannot guarantee absolute security of your personal information.

Security Measures

To help protect your personal information, we implement appropriate security measures, including:

• Encryption: SSL/TLS encryption to protect information transmitted through our Platform.
• Secure Storage: Appropriate security controls to protect sensitive personal information.
• Data Minimisation: Collecting and processing only the personal information necessary to provide our services, fulfil your orders, comply with legal obligations, and improve your experience.
• Access Controls: Role-based access controls and authentication mechanisms to ensure that personal information is accessible only to authorised personnel.
• Restricted Access: Limiting physical and logical access to systems, infrastructure, and data containing personal information.
• Network Security: Firewalls, monitoring systems, and other security technologies designed to detect and prevent unauthorised access.
• Security Assessments: Regular monitoring, vulnerability assessments, and security reviews to identify and address potential risks.
• Employee & Vendor Security: Employee training, confidentiality obligations, and appropriate due diligence to ensure our trusted service providers maintain suitable security standards.
• Physical Security: Physical safeguards designed to protect servers, systems, and supporting infrastructure used to operate our Platform.

Payment Security

Payments made through our Platform are securely processed through authorised payment gateways and payment service providers.

Our payment service providers, including Cashfree Payments, comply with the Payment Card Industry Data Security Standard (PCI DSS) and other applicable industry security requirements to help protect your payment information.

IndyAlley does not store your complete credit card or debit card number, CVV, or other sensitive payment credentials on its systems.

Your Responsibility

You are responsible for maintaining the confidentiality of your account credentials.

We recommend that you:

• Choose a strong and unique password.
• Keep your login credentials confidential.
• Notify us immediately if you suspect any unauthorised access to your account.

Data Breach Response

If we become aware of a security incident or personal data breach that affects your personal information, we will:

• Investigate the incident and assess its impact.
• Take appropriate measures to contain and mitigate the breach.
• Notify affected individuals and relevant regulatory authorities where required by applicable law.
• Implement corrective measures to help prevent similar incidents in the future.

Where personal information is subject to the General Data Protection Regulation (GDPR) or other applicable international privacy laws, we will comply with the applicable data breach notification requirements.

Your Privacy Rights & Choices

Depending on your location and applicable law, you may have certain rights regarding your personal information. IndyAlley is committed to helping you exercise these rights in accordance with applicable privacy laws.

Access & Correction

You have the right to:

• Access the personal information we hold about you.
• Request a copy of your personal information in a commonly used electronic format, where applicable.
• Correct, update, or rectify inaccurate or incomplete personal information.

You can review and update certain account information by logging into your IndyAlley account or by contacting our Grievance Officer.

Withdrawal of Consent

Where we rely on your consent to process your personal information, you may withdraw your consent at any time by:

• Updating your privacy or communication preferences through your account settings, where available.
• Contacting our Grievance Officer.

Please note that withdrawing your consent may affect our ability to provide certain services or fulfil your orders where such processing is necessary.

Marketing Preferences

You may opt out of receiving promotional emails, newsletters, and marketing communications at any time by:

• Clicking the "Unsubscribe" link included in our marketing emails.
• Updating your communication preferences in your account settings, where available.
• Contacting our Customer Support team or Grievance Officer.

Please note that even if you opt out of marketing communications, we may continue to send important transactional and service-related communications, including order confirmations, shipping updates, security notifications, and account-related messages.

Data Deletion & Account Closure

You may request the deletion of your personal information and the closure of your account by contacting our Grievance Officer.

Upon receiving your request, we will:

• Verify your identity.
• Delete or anonymise your personal information, unless we are required or permitted to retain certain information to comply with legal obligations, resolve disputes, prevent fraud, enforce our agreements, or protect our legitimate business interests.
• Confirm completion of your request within 30 days, where applicable.

Data Portability

Where permitted by applicable law, you may request a copy of your personal information in a structured, commonly used, and machine-readable format for your own use or for transfer to another service provider.

Objecting to Processing

Where permitted by applicable law, you may object to the processing of your personal information for:

• Direct marketing.
• Profiling.
• Automated decision-making, where applicable.

We will consider your request in accordance with applicable legal requirements.

Nomination of Another Individual

Where permitted by applicable law, you may nominate another individual to exercise your privacy rights on your behalf in the event of your death or incapacity.

Limitations on Your Rights

Your privacy rights may be limited where we are required or permitted to retain or process your personal information, including where necessary to:

• Comply with applicable laws and regulatory requirements.
• Establish, exercise, or defend legal claims.
• Prevent fraud or protect the security of our Platform.
• Fulfil other legitimate legal or business obligations.

Identity Verification

To protect your privacy and security, we may need to verify your identity before processing certain requests relating to your personal information.

Where necessary, we may request additional information to confirm your identity before fulfilling your request.

Contacting Us About Your Rights

If you wish to exercise any of your privacy rights or have questions about how we process your personal information, please contact our Grievance Officer using the details provided in the Contact Us section of this Privacy Policy.

Cookies & Tracking Technologies

IndyAlley uses cookies, web beacons, pixels, and similar tracking technologies to improve your browsing experience, enhance the functionality of our Platform, analyse website performance, and provide a more personalised experience.

How We Use Cookies

We use cookies and similar technologies to:

• Enable essential website functionality and maintain the security of our Platform.
• Remember your preferences, settings, and shopping cart.
• Authenticate your login and maintain your session.
• Analyse website traffic, user behaviour, and Platform performance.
• Improve the functionality, performance, and user experience of our Platform.
• Measure the effectiveness of marketing campaigns.
• Display personalised content and advertisements, where permitted by applicable law and based on your preferences.

Types of Cookies We Use

We use the following categories of cookies:

• Strictly Necessary Cookies: Essential for the operation, security, and core functionality of our Platform, including user authentication, shopping cart functionality, and secure checkout.
• Performance & Analytics Cookies: Help us understand how visitors interact with our Platform by collecting information about website usage, performance, and visitor behaviour. This information helps us improve our Platform and services.
• Functional Cookies: Remember your preferences, language, region, and other settings to provide a more personalised experience.
• Advertising & Targeting Cookies: Help us deliver relevant advertisements, measure the effectiveness of marketing campaigns, and personalise content based on your interests, where permitted by applicable law.

Managing Your Cookie Preferences

You can manage or disable cookies through your browser settings at any time.

Please note that disabling or blocking certain cookies may affect the functionality, performance, and user experience of our Platform. Certain features, including account login, shopping cart functionality, and secure checkout, may not operate correctly without essential cookies.

Where required by applicable law, non-essential cookies, including analytics and advertising cookies, will be used only after you have provided your consent.

Third-Party Cookies

Some cookies may be placed by trusted third-party service providers that support the operation of our Platform, including our ecommerce platform provider, analytics providers, payment service providers, and marketing partners.

These third parties may collect information in accordance with their own privacy policies. IndyAlley does not control the operation of third-party cookies and encourages you to review the privacy policies of those providers for more information.

Children's Privacy

Our Platform is not intended for individuals who are below the minimum age required under applicable law to provide valid consent for the processing of their personal information or to use our Platform, where such restrictions apply.

We do not knowingly collect, use, or otherwise process personal information from children except where permitted under applicable law and, where required, with the verifiable consent of a parent or legal guardian.

If we become aware that we have collected personal information from a child in a manner that does not comply with applicable law, we will take reasonable steps to delete or anonymise such information without undue delay.

If you believe that a child has provided personal information to us in violation of this Privacy Policy, please contact us, and we will promptly investigate and take appropriate action.

Where we process the personal information of children, we will comply with applicable children's privacy and data protection laws, including obtaining verifiable parental or guardian consent where required.

Region-Specific Privacy Rights

Depending on your location, you may have additional privacy rights under applicable data protection laws. The following provisions supplement this Privacy Policy and apply only to users in the specified jurisdictions.

European Union (EU), European Economic Area (EEA) & United Kingdom (UK)

Controller & Contact

• Data Controller: IndyAlley Private Limited.
• EU Representative (Article 27 GDPR): [Name, Address, Email], where required.
• Data Protection Officer (if appointed): [Name, Contact Details].

Supervisory Authority

If you believe your personal data has been processed in violation of applicable law, you may lodge a complaint with your local supervisory authority.

International Data Transfers

Where personal data is transferred outside the EU, EEA, or UK, we rely on appropriate safeguards permitted under applicable law, including adequacy decisions, Standard Contractual Clauses (SCCs), Binding Corporate Rules (where applicable), or other recognised transfer mechanisms.

GDPR Rights

EU, EEA, and UK residents may exercise the rights available under applicable data protection laws. We will respond to valid requests within the timeframes prescribed by law.

California, United States (CPRA/CCPA)

California Privacy Rights

California residents may have the right to:

• Know and access the personal information we collect.
• Correct inaccurate personal information.
• Request deletion of personal information, subject to applicable exceptions.
• Opt out of the sale or sharing of personal information, where applicable.
• Limit the use and disclosure of Sensitive Personal Information, where applicable.
• Be free from discrimination for exercising their privacy rights.

Sensitive Personal Information

Where we collect or process Sensitive Personal Information, we do so only for the purposes permitted under applicable law and provide any rights or choices required by the California Privacy Rights Act (CPRA), where applicable.

Exercising Your Rights

California residents may submit privacy requests using the contact details provided in this Privacy Policy. Where applicable, we also honour legally recognised opt-out preference signals, including the Global Privacy Control (GPC).

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business operations, services, technology, legal or regulatory requirements, or privacy practices.

Any updates will be posted on this page along with the revised "Last Updated" date. We encourage you to review this Privacy Policy periodically to stay informed about how we collect, use, protect, and process your personal information.

Where required by applicable law or where changes materially affect your privacy rights, we may notify you by:

• Posting a notice on our Platform.
• Sending an email to your registered email address.
• Displaying a notification on our Platform or during your next visit.

Your continued use of the Platform after the updated Privacy Policy becomes effective constitutes your acknowledgement of the revised Privacy Policy, to the extent permitted by applicable law.

Grievance Redressal

We are committed to addressing your privacy-related questions, concerns, and grievances promptly and fairly.

Grievance Officer 

If you have any questions, concerns, or complaints regarding this Privacy Policy or the processing of your personal information, you may contact our Grievance Officer using the details below:

• Name: 
• Designation: Grievance Officer
• Email: 
• Phone: 
• Address: 
• Business Hours: Monday to Saturday, 

Grievance Resolution Process

To help us resolve your concern efficiently, please provide:

• Your full name and contact details.
• Your Order Number or Account details (where applicable).
• A detailed description of your concern or request.
• Any supporting documents or screenshots that may assist in resolving the issue.

Upon receiving your grievance, we will:

• Acknowledge receipt of your request within the timeframe required under applicable law.
• Review and investigate your concern.
• Respond and take appropriate action as soon as reasonably practicable.
• Keep you informed of the status of your request where necessary.

If you are not satisfied with our response, you may exercise any rights or remedies available to you under applicable law.

Contact Us

If you have any questions about this Privacy Policy, our privacy practices, or the processing of your personal information, please contact us.