Privacy Policy

1. Who is responsible

Personal data collected through rystella.com is controlled by Tushar Reddy, trading as Rystella, based in Pune, India. Under India's Digital Personal Data Protection Act, 2023 that makes us the Data Fiduciary; under the GDPR, the Controller. Our grievance contact is at the bottom of this page.

2. What we collect

When you place an order

The order form asks for your name and email address, plus an optional phone or WhatsApp number, and optionally your brand or store name, niche, location and any notes you add. We need these to build the store and to talk to you about it. We store them in our orders database alongside the package, amount and Razorpay payment reference.

When you pay

Payments are processed by Razorpay. Your card number, bank details, CVV and other payment credentials go directly to Razorpay and are never seen, transmitted or stored by us. We receive only a payment identifier, the amount, the method type, and the contact details you gave at checkout.

When you message us

Our contact form asks for your name, email address, enquiry and an optional store URL. You may also provide an optional phone or WhatsApp number. We store the submission in our access-controlled customer and enquiry database so we can reply, track follow-up and keep a record of what was agreed. When email alerts are enabled, a copy is sent through Resend to our own inbox with your address as the reply-to address. If a US-market visitor chooses live chat, Crisp stores the conversation and the functional session information needed to continue it. Crisp loads only after the visitor opens live chat. WhatsApp and video-call conversations are held in those services; WhatsApp is operated by Meta under its own privacy policy.

When you use the free store audit

You give us a store URL. We fetch that page from our server and analyse it. The URL and the result are not saved to any database.

Automatically, when you browse

• Anonymous usage statistics via Vercel Analytics — which pages are viewed and roughly where visitors come from. It is cookieless, sets nothing on your device and does not identify you, so it runs whether or not you accept cookies.
• Server logs kept by our host, including IP address and browser type, for security and debugging.
• A short-lived security record if you submit a contact form or attempt to log in to the admin area. Contact-form IP addresses are irreversibly hashed before storage; both records are used only to rate-limit repeated attempts.
• Analytics and advertising cookies — Google Analytics and the Meta Pixel — which load only after you press Accept on the cookie banner, and never if you decline.

Stored on your device, not sent to us

We keep your theme choice (light or dark) and your answer to the cookie banner in your browser's local storage. Neither leaves your device. Clearing your browser data removes them.

3. Why we are allowed to use it

• To perform our contract with you — everything needed to build and hand over your store.
• With your consent — analytics and advertising cookies, which you can decline or withdraw at any time.
• Legal obligation — keeping invoices and tax records for the period Indian law requires.
• Legitimate interests — securing the site, preventing abuse and keeping records of what was agreed.

4. Who else sees it

We do not sell personal data, rent it, or share it for anyone else's marketing. We use a small number of processors to run the business:

• Razorpay — processing INR and USD checkout payments, as applicable.
• Vercel — hosting, server logs and cookieless analytics.
• Neon — the managed database holding orders, customer profiles and website enquiries.
• Resend — sending order notifications and, when configured, copies of website enquiries to our team inbox.
• Crisp — providing live chat to visitors using the US version of the site.
• Telegram — an internal order alert to our own team, where enabled.
• Meta — where advertising measurement is enabled, we may send a SHA-256 hashed version of an email address or phone number so a purchase can be matched to an ad click. Hashing is one-way: Meta cannot read the original value, and we never send the plain text.
• Google Analytics — where enabled and you have accepted cookies.

We may also disclose data where the law requires it, or to establish or defend a legal claim.

5. Data leaving India

Some of the services above store data outside India. Where that happens we rely on the provider's contractual data protection commitments, including the European Commission's Standard Contractual Clauses where they apply. Transfers are permitted under the DPDP Act except to countries the Government of India has restricted.

6. How long we keep it

• Order records — 8 years after the project closes, which is the period Indian tax and accounting law requires for financial records.
• Enquiries that never became orders — up to 24 months, then deleted.
• Server logs — as retained by our host, typically 30 days.
• Admin and contact-form rate-limit records — cleared automatically within 24 hours.
• Store audit URLs — not stored at all.

7. Your rights

Whatever country you are in, you can ask us to:

• Show you the personal data we hold about you and who we have shared it with.
• Correct anything wrong, incomplete or out of date.
• Erase it, where we are not required by law to keep it.
• Withdraw consent for cookies, by declining the banner or clearing site data.
• Nominate someone to exercise these rights if you die or become incapacitated, as the DPDP Act provides.

If you are in the UK or EEA, you also have the right to object to processing, to request portability, and to complain to your local supervisory authority.

Use our email form with the subject line “Data request”. We reply within 30 days, and in every case within the 90 days the DPDP Rules allow for grievances. We may ask you to confirm your identity first, so that nobody else can request your data.

8. Cookies

The banner on your first visit offers a genuine choice, and declining is remembered exactly as firmly as accepting so you are not asked repeatedly. Nothing that sets a cookie loads before you answer.

• Strictly necessary and requested features — keeping the site working and preserving a live-chat conversation after you choose to open it.
• Analytics — how pages are used. Only after you accept.
• Advertising — measuring whether an ad led to an enquiry. Only after you accept.

9. Security

The site is served over HTTPS. The database is managed, access-controlled and reachable only by our application. Payment credentials never touch our systems. Admin access is password-protected and rate-limited. No system is perfectly secure, but if a breach ever affected your data we would notify you and the Data Protection Board of India as the law requires.

10. Children

This site is for people running or starting a business and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, tell us and we will delete it.

11. Changes

When this policy changes, the date at the top changes with it. If a change materially affects how we use data you have already given us, we will tell you directly rather than relying on you noticing.

See also our Terms of Service and Refund & Cancellation Policy.