Privacy Policy

Last updated: September 2026

Dharsan Dresses ("we", "us", "our") operates dharsangroups.com and the physical store at Yadava Street, Varadaraja Nagar, Tirupati, Andhra Pradesh. This policy explains what personal data we collect, why we collect it, how we protect it, and the rights you have over it. We comply with India's Digital Personal Data Protection Act 2023 (DPDP).

1. Information we collect

• Identity & contact: name, username, email address, phone number, shipping & billing addresses.
• Order data: items purchased, order history, returns, cancellations, and any reviews you write.
• Saved items: the contents of your cart and wishlist, stored against your account so they follow you between devices.
• Payment data: processed by Razorpay (PCI DSS Level 1). We never store full card numbers, CVV, or UPI PINs. We keep the Razorpay transaction reference against your order.
• Account security: your password as a one-way hash; if you enable two-factor authentication, its secret and your backup codes; and a record of sign-in attempts (successful and failed) including IP address and browser user-agent, kept to detect account takeover.
• Loyalty: your points balance and the transactions that changed it, if you take part.
• Profile picture: only if you choose to sign in with Google, in which case we store the image URL Google provides.
• Stitching & alterations: the garment details and any notes you give us for a custom stitching or alteration job.
• Recently viewed products are stored only in your own browser. They are never sent to us.

We do not currently run website analytics, so we do not collect pages visited, referrer URLs, or behavioural data. If that changes we will update this page first.

2. Why we use it

• To fulfil your orders, ship items, and process returns/refunds.
• To respond to customer support enquiries.
• To send transactional messages (order confirmation, shipping updates, invoices) by email, SMS, or WhatsApp.
• To send marketing offers — only if you opted in. You can opt out anytime.
• To improve the website, detect fraud, and meet legal/tax obligations (GST, income tax).

3. Who we share it with

We share the minimum data necessary with:

• Razorpay — for payment processing.
• Delhivery / shipping partners — for delivery; they receive name, phone, address.
• Google — only if you choose Sign in with Google, in which case Google confirms your identity to us and we receive your name, email address and profile image.
• Tax authorities — when required by Indian law (GST returns, income tax).
• We do not sell your data to advertisers or third-party data brokers. Ever.

4. How we protect it

• All traffic over HTTPS with TLS 1.3.
• Passwords hashed with industry-standard one-way functions; we cannot view your password.
• Database access restricted to authorised personnel; admin access requires two-factor authentication.
• Application hosted on Vercel (US East) and database on Neon Postgres (US East); uploaded images on Vercel Blob.
• Encrypted backups with limited retention.
• All admin actions are audit-logged.

Where your data is stored: our hosting and database providers (Vercel and Neon) operate from data centres in the United States, so your account and order data is stored and processed outside India. Payment data stays with Razorpay in India. We transfer only what is needed to run the site, and only to countries not restricted by the Central Government under the DPDP Act.

5. How long we keep it

Order, invoice, and tax records are retained for 7 years (Indian tax law requirement). Account information is kept while your account is active. Inactive accounts and their data are deleted after 5 years of no activity unless you specifically ask us to retain them.

6. Your rights under the DPDP Act

• Access — request a copy of the personal data we hold about you.
• Correction — update inaccurate or incomplete information.
• Erasure — request deletion of your account and data (subject to legal retention obligations).
• Withdraw consent — for marketing communications, anytime.
• Grievance redressal — raise a complaint with our Grievance Officer (below).

7. Cookies

We use only strictly necessary cookies — the ones that keep you signed in and remember your cart. These are required for the site to work, so there is nothing to opt out of and we do not show a cookie banner.

We do not use analytics cookies, advertising cookies, or any third-party tracking. If we ever introduce analytics, we will update this page and ask for your consent before switching it on.

8. Children

The website is not directed at children under 18. We do not knowingly collect data from minors. If you believe we have, please contact us immediately and we will delete it.

9. Changes to this policy

We may update this policy as the business or law evolves. The "Last updated" date at the top reflects the most recent change. For material changes we'll notify registered customers by email.

10. Grievance Officer (mandatory under DPDP Act)

For any privacy-related question, write to grievance@dharsangroups.com or call us on the number above.