Privacy policy

Who we are

Lyrafox decides why and how your personal data is processed, so we are the “Data Fiduciary” for it under the DPDP Act. Contact details for privacy questions are at the end of this page.

Personal data we collect

We do not ask for or store card numbers, CVVs, UPI PINs or bank passwords. If online payment is offered, those details go directly to an RBI-authorised payment aggregator and we only receive the payment status. We don't collect sensitive data such as health, biometric or financial account information.

Why we use it

We process personal data on the basis of your consent, given when you create an account or place an order, and for the legitimate uses the DPDP Act allows (for example, complying with law). We use it to:

• create and secure your account, and let you sign in;
• check whether we deliver to your pincode, and take, pack, deliver and support your orders;
• process payments, refunds, wallet credits and referral rewards;
• send service messages about your orders and account (these are not marketing);
• handle questions, complaints and grievances;
• prevent fraud and abuse (for example, misuse of referral codes) and keep the site secure;
• improve the site, such as fixing searches that return no results;
• meet legal obligations, including tax, accounting and lawful requests from authorities.

We will ask for separate consent before sending you marketing messages, and you can withdraw it at any time. We do not sell your personal data.

Who we share it with

We share only what each party needs to do its job, and require them to protect it:

• Delivery staff and partners: your name, delivery address, phone number and order contents.
• Payment aggregators and banks: the order amount and reference, for online payments and refunds.
• Service providers that host or maintain our systems, send messages for us, or provide customer support tools.
• Government and law enforcement: when the law requires it, for example under the IT Act or tax laws, or to protect rights and safety.
• A buyer or successor: if our business is merged or sold, under the same protections as this policy.

The people you refer, and people who refer you, see only a masked version of your name in the referral activity.

Cookies and similar storage

We use a small number of cookies and browser storage entries that the site needs to work. We don't use advertising or cross-site tracking cookies.

You can delete these in your browser settings at any time. Blocking them may stop the cart, checkout or sign-in from working.

How long we keep it

We keep personal data only as long as we need it for the purposes above. Account data stays while your account is active. Order, invoice and payment records are kept for as long as tax and accounting laws require (generally at least eight years). When you ask us to erase your data, we delete or anonymise what we're no longer required to keep. Server logs are kept for a short period for security, unless needed to investigate an incident.

How we protect it

We use reasonable security practices as required by Indian law, including encrypted connections (HTTPS), salted one-way hashing of passwords, protection against cross-site request forgery, restricted access to personal data, and keeping payment card data out of our systems. No system is completely secure. If a personal data breach happens, we will inform affected users and the Data Protection Board of India as the law requires.

Your rights

Under the DPDP Act you can:

• Access: get a summary of the personal data we hold about you and how we use it.
• Correct and update it. You can edit your profile and addresses yourself in My account.
• Erase it, except where the law requires us to keep it.
• Withdraw consent at any time. This doesn't affect anything done before, and we may then be unable to serve orders.
• Nominate someone to exercise these rights if you die or become incapacitated.
• Raise a grievance with us, and if you're not satisfied, complain to the Data Protection Board of India.

To use any of these rights, contact our Grievance Officer (below) from the email or mobile number on your account. We may need to verify your identity first. We will respond within the time the law sets.

Children

Accounts are for people aged 18 or over. We don't knowingly collect personal data from children without verifiable consent from a parent or lawful guardian. If you believe a child has created an account, contact us and we'll remove it.

Changes to this policy

We'll update this page when our practices or the law change, and change the “Last updated” date above. For significant changes we will also tell you on the site or by message before they take effect.

Questions and complaints

For privacy questions, requests or complaints, contact our Grievance Officer. They are also the person who answers questions about how we process personal data.