Privacy policy

Last updated: 22 October 2026

The short version

We collect what we need to take your order, deliver it, run your subscription and answer you: your name, contact details, delivery address and what you bought. Your card and UPI details go to Razorpay, not to us. We also measure how people use the site and, to show our ads to people likely to want them, we share some of that activity with advertising platforms, including Meta (Facebook and Instagram). We do not sell your personal data. You can ask us to show you, correct or delete what we hold, and you can stop marketing at any time.

This policy is written for the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. Himdhara, Haldwani, Uttarakhand, is the data fiduciary: the business that decides why and how your data is used.

What we collect

  • When you order or subscribe: name, email address, mobile number, billing and delivery address, the products, sizes and quantities, the price paid, and your order and subscription history.
  • When you pay: Razorpay handles the payment and, for a subscription, the UPI AutoPay or card mandate. We receive the payment status and a reference, never your full card number, CVV or UPI PIN.
  • When you write to us: what you send, including any unboxing video, photographs or WhatsApp messages about an order.
  • When you sign up for emails or a “notify me” alert: your email address and what you asked to hear about.
  • When you browse: pages and products you view, what you add to your cart, the device, browser and IP address you use, and how you arrived (for example the link, ad or search you came from).

Why we use it

  • To take payment, pack and ship your order, and send order and delivery updates.
  • To run a subscription: schedule deliveries, charge each one, and let you pause, skip or cancel.
  • To handle a replacement claim under our refund policy.
  • To answer questions and keep a record of what we agreed.
  • To send marketing emails, only if you signed up, with an unsubscribe link in every one.
  • To understand which pages, products and campaigns work, so we can fix what doesn't.
  • To show our ads on other platforms, measure whether they led to a sale, and avoid showing them to people who have already bought.
  • To prevent fraud, keep the site secure, and meet tax, accounting and other legal duties.

Who we share it with

Only with the services that run the store, each for its own part of the job:

  • Shopify hosts the store, the checkout and your order records. Shopify also uses some store data for its own features under the Shopify Consumer Privacy Policy.
  • Razorpay takes payments, runs Magic Checkout and holds subscription mandates.
  • Cloudflare runs our subscription service, which keeps your subscription schedule, delivery address and order history.
  • Courier and logistics partners get your name, phone number and delivery address to deliver the parcel.
  • Klaviyo sends our emails and stores your email preferences.
  • Google Analytics and Microsoft Clarity measure how the site is used. Clarity records how pages are scrolled and clicked so we can find what's confusing; it masks what you type into forms.
  • Meta (Facebook and Instagram), through the Meta Pixel and Meta's Conversions API. See the next section.
  • Partners in our affiliate programme see which orders came through their link and the order value, not your name or contact details.
  • Government, police or courts, when the law requires it.

Some of these services store data outside India. We use them on the terms they offer for that, and we do not send data to any country the Government of India has restricted.

Advertising and Meta

We advertise on Facebook and Instagram. To show ads to people likely to be interested and to know whether an ad led to a sale, our store sends Meta information about what happens on the site: pages and products viewed, items added to a cart, checkouts started and purchases, with their value. It is sent both from your browser (the Meta Pixel) and from Shopify's servers (the Conversions API).

So that Meta can match that activity to a Facebook or Instagram account, we also send contact details such as your email address, phone number, name, city, state, PIN code and country, along with your IP address and browser details. Contact details are scrambled (hashed) before they are sent. Meta uses this to deliver and measure our ads, and also under its own Privacy Policy.

To stop this:

  • Change your ad settings on Facebook or Instagram under Ad preferences, including the setting for activity from other websites and apps.
  • Write to us at the address below and we will stop sending your details to advertising platforms.

Cookies and similar storage

The site uses cookies and browser storage to keep your cart, keep you signed in, remember how you arrived (for 90 days, so a subscription can be credited to the right campaign), and run the analytics and advertising tools named above. You can clear or block them in your browser; the cart and checkout need some of them to work.

How long we keep it

  • Orders, invoices and payment records: for as long as tax and accounting law requires.
  • Subscription details: while the subscription runs, then as an order record above.
  • Unboxing videos and replacement claims: until the claim and any courier claim are settled, then deleted.
  • Email marketing: until you unsubscribe or ask us to delete it.
  • Analytics and advertising data: for the periods those services set, usually up to 14 months for Google Analytics and up to two years for Meta.

Your rights

Under the Digital Personal Data Protection Act, 2023 you can:

  • ask for a summary of the personal data we hold about you and who we have shared it with;
  • ask us to correct, complete or update it;
  • ask us to delete it, except what the law requires us to keep, such as invoices;
  • withdraw consent you gave, such as for marketing or ad sharing, as easily as you gave it;
  • nominate someone to exercise these rights for you if you die or cannot act yourself;
  • complain to us, and if we don't resolve it, to the Data Protection Board of India.

Email contact@himdhara.co.in from the address on your order. We may ask you to confirm who you are before we act. We reply within 30 days. Withdrawing consent does not undo what was done before, and if you withdraw consent we need to deliver an order, we may not be able to complete it.

Children

The store is for adults. We do not knowingly collect data from anyone under 18, and we do not target ads at children. If you think a child has given us their details, write to us and we will delete them.

Security

Payments are handled by Razorpay, and the store and checkout are served over an encrypted connection. Only the people who run Himdhara can see order details. No system is perfectly secure; if a breach affects your data, we will tell you and the Data Protection Board as the law requires.

Grievance officer and contact

Grievance Officer, Himdhara
Haldwani, Uttarakhand 263139, India
Email: contact@himdhara.co.in
Phone: +91 97 6099 7408

We acknowledge complaints within 48 hours and resolve them within 30 days.

Changes

When we change how we use your data, we update this page and the date at the top. If the change is significant, we tell customers by email before it takes effect.