Privacy Policy

1. Who is responsible

Personal data collected through rystella.com is controlled by Tushar Reddy, trading as Rystella, based in Pune, India. Under India's Digital Personal Data Protection Act, 2023 that makes us the Data Fiduciary; under the GDPR, the Controller. Our grievance contact is at the bottom of this page.

2. What we collect

When you place an order

The order form asks for your name, WhatsApp number and email address, and optionally your brand or store name, niche, location and any notes you add. We need these to build the store and to talk to you about it. We store them in our orders database alongside the package, amount and Razorpay payment reference.

When you pay

Payments are processed by Razorpay. Your card number, UPI ID, CVV and netbanking credentials go directly to Razorpay and are never seen, transmitted or stored by us. We receive only a payment identifier, the amount, the method type, and the contact details you gave at checkout.

When you message us

WhatsApp and email conversations are held in those accounts and used to answer you and keep a record of what was agreed. WhatsApp is operated by Meta under its own privacy policy.

When you use the free store audit

You give us a store URL. We fetch that page from our server and analyse it. The URL and the result are not saved to any database.

Automatically, when you browse

• Anonymous usage statistics via Vercel Analytics — which pages are viewed and roughly where visitors come from. It is cookieless, sets nothing on your device and does not identify you, so it runs whether or not you accept cookies.
• Server logs kept by our host, including IP address and browser type, for security and debugging.
• A short-lived record of your IP address if you attempt to log in to the admin area, used only to rate-limit repeated attempts.
• Analytics and advertising cookies — Google Analytics and the Meta Pixel — which load only after you press Accept on the cookie banner, and never if you decline.

Stored on your device, not sent to us

We keep your theme choice (light or dark) and your answer to the cookie banner in your browser's local storage. Neither leaves your device. Clearing your browser data removes them.

3. Why we are allowed to use it

• To perform our contract with you — everything needed to build and hand over your store.
• With your consent — analytics and advertising cookies, which you can decline or withdraw at any time.
• Legal obligation — keeping invoices and tax records for the period Indian law requires.
• Legitimate interests — securing the site, preventing abuse and keeping records of what was agreed.

4. Who else sees it

We do not sell personal data, rent it, or share it for anyone else's marketing. We use a small number of processors to run the business:

• Razorpay — payment processing (India).
• Vercel — hosting, server logs and cookieless analytics.
• Neon — the managed database holding order records.
• Resend — sending order notification emails.
• Telegram — an internal order alert to our own team, where enabled.
• Meta — where advertising measurement is enabled, we may send a SHA-256 hashed version of an email address or phone number so a purchase can be matched to an ad click. Hashing is one-way: Meta cannot read the original value, and we never send the plain text.
• Google Analytics — where enabled and you have accepted cookies.

We may also disclose data where the law requires it, or to establish or defend a legal claim.

5. Data leaving India

Some of the services above store data outside India. Where that happens we rely on the provider's contractual data protection commitments, including the European Commission's Standard Contractual Clauses where they apply. Transfers are permitted under the DPDP Act except to countries the Government of India has restricted.

6. How long we keep it

• Order records — 8 years after the project closes, which is the period Indian tax and accounting law requires for financial records.
• Enquiries that never became orders — up to 24 months, then deleted.
• Server logs — as retained by our host, typically 30 days.
• Admin rate-limit IP records — cleared automatically within hours.
• Store audit URLs — not stored at all.

7. Your rights

Whatever country you are in, you can ask us to:

• Show you the personal data we hold about you and who we have shared it with.
• Correct anything wrong, incomplete or out of date.
• Erase it, where we are not required by law to keep it.
• Withdraw consent for cookies, by declining the banner or clearing site data.
• Nominate someone to exercise these rights if you die or become incapacitated, as the DPDP Act provides.

If you are in the UK or EEA, you also have the right to object to processing, to request portability, and to complain to your local supervisory authority.

Email official.rystella@gmail.com with the subject line “Data request”. We reply within 30 days, and in every case within the 90 days the DPDP Rules allow for grievances. We may ask you to confirm your identity first, so that nobody else can request your data.

8. Cookies

The banner on your first visit offers a genuine choice, and declining is remembered exactly as firmly as accepting so you are not asked repeatedly. Nothing that sets a cookie loads before you answer.

• Strictly necessary — keeping the site working and secure. Always on.
• Analytics — how pages are used. Only after you accept.
• Advertising — measuring whether an ad led to an enquiry. Only after you accept.

9. Security

The site is served over HTTPS. The database is managed, access-controlled and reachable only by our application. Payment credentials never touch our systems. Admin access is password-protected and rate-limited. No system is perfectly secure, but if a breach ever affected your data we would notify you and the Data Protection Board of India as the law requires.

10. Children

This site is for people running or starting a business and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, tell us and we will delete it.

11. Changes

When this policy changes, the date at the top changes with it. If a change materially affects how we use data you have already given us, we will tell you directly rather than relying on you noticing.

See also our Terms of Service and Refund & Cancellation Policy.