Skip to content
Ixtora

Privacy Policy

What we collect, why we need it, who we share it with, and the choices you have.

Draft for legal review. This privacy policy describes how Ixtora works today. It will be reviewed by counsel before launch; highlighted items are details still to be confirmed.

Effective: 26 September 2026 (draft)

1. Who is responsible

[company legal name — to be provided] ("Ixtora") decides how your personal data is used and is responsible for it (the "data fiduciary" under India's Digital Personal Data Protection Act, 2023). Contact: [email protected].

2. What we collect

  • Account details: name, email, phone, password (stored only as a one-way hash) and marketing preference.
  • Order details: items, delivery and billing addresses, contact details, delivery choice and order history.
  • Payment information: the method you chose, payment status and the payment provider's reference. Card numbers, CVV and bank credentials are entered on the payment provider's page and never reach us.
  • Support and returns: messages you send us, return requests and product requests.
  • Reviews you publish, with the display name you choose.
  • Technical data: essential cookies for sign-in and checkout, your IP address in server logs, and basic device/browser information. See the Cookie Policy.

Ixtora is for adults: you must be 18 or over to create an account or order, and we don't knowingly process children's personal data. If you believe a child has given us their data, contact us and we'll delete it. We don't collect sensitive data such as health or biometric information.

3. Why we use it

  • To create and secure your account (with your consent).
  • To take payment, source, ship and deliver your order, handle returns and provide support (to perform our contract).
  • To send order, shipping, security and account emails — these aren't marketing and can't be switched off while you have active orders or an account.
  • To send offers only if you've opted in; you can opt out any time in your profile.
  • To prevent fraud and abuse, keep records required by tax and consumer law, and resolve disputes (legal obligations and legitimate uses permitted by law).

4. Who we share it with

We share only what each party needs, and never sell your personal data:

  • Payment providers (for example Razorpay or Stripe) to process payments and refunds.
  • Couriers and logistics partners to deliver your parcels — name, address, phone and parcel details.
  • Service providers that host our website and database and send our emails, under contracts that require them to protect your data.
  • Authorities, when required by law or to protect our customers from fraud.

5. Where your data is stored

Our website, database and email providers may store data on servers outside India. Under section 16 of the Digital Personal Data Protection Act, 2023 we only use providers in countries the Government of India hasn't restricted, under contracts that require them to protect your data.

6. How long we keep it

  • Account data: while your account is open. When you delete your account we remove your profile, addresses, wishlist, returns and support messages.
  • Orders and invoices: for the period required by tax and accounting law (typically up to 8 years), even if you delete your account.
  • Server logs and security records: at least 180 days and up to 12 months, as required by CERT-In directions and the DPDP Rules.
  • Marketing consent: until you withdraw it; data used only for a purpose that has ended is deleted.

7. How we protect it

Passwords are hashed with a slow, salted algorithm; sessions use secure, HTTP-only cookies; data is encrypted in transit (HTTPS); staff need two-step verification; access to customer data is limited to staff who need it, and admin actions are logged.

If a personal data breach happens, we'll inform the Data Protection Board of India and the people affected without delay, as the DPDP Act requires, and report cyber-security incidents to CERT-In within 6 hours.

8. Your rights

  • Access and portability: download your data from Profile & security.
  • Correction: update your details in your account, or ask us.
  • Erasure: delete your account from Profile & security (records we must keep by law are retained).
  • Withdraw consent at any time, as easily as you gave it: untick marketing in your profile or use the unsubscribe link in any marketing email, or delete your account to withdraw consent to everything we process on the basis of consent. Withdrawal doesn't affect processing already done, or what we must keep by law.
  • Grievance: raise a complaint with us at [email protected], and if unresolved, with the Data Protection Board of India or your local data protection authority.
  • Nominate someone to exercise your rights in case of death or incapacity, by writing to us.

We reply to rights requests within 30 days (and resolve grievances within 90 days at most, as the DPDP Rules require). Write to [email protected] — the person who answers questions about your data is our Grievance Officer (details on the Grievance Redressal page).

You can ask us for this notice in any language listed in the Eighth Schedule to the Constitution of India.

9. Changes

We'll update this policy when our practices change and show the effective date at the top. Significant changes will be highlighted on the site or emailed to account holders.