Who controls the data
Resham Sparsh is the data fiduciary for order and store-operation data described here. The legal entity name, registered address and data/grievance contact must be added before live sales.
Information we collect
- Name, email, Indian mobile number and shipping address entered at checkout.
- Order ID, selected bundle/items/gifts, price, fulfilment status, tracking ID and support notes.
- Razorpay payment/order/subscription identifiers and status; not raw card or UPI credentials.
- UTM campaign fields, advertising click IDs, landing path and referring host, capped and allowlisted.
- An anonymous visitor/session identifier, current funnel state and last-seen time for the five-minute live-traffic panel. The tracking endpoint does not store a raw IP, name, email, phone or address.
- Short-lived abuse-prevention buckets derived with a secret HMAC from the web server network address; the raw address is not written to the bucket file.
- Browser storage needed for cart, checkout-session form recovery, attribution and duplicate-pixel prevention.
Why we use it
We use data to calculate and collect the correct payment, deliver products, support customers, prevent fraud/tampering, manage subscriptions and fulfilment, reconcile payments, understand campaign performance, maintain security and meet legal/accounting obligations. Separate marketing messages require a clear opt-in; this site does not currently include one.
Razorpay and service providers
Razorpay processes payment and recurring-mandate information under its own terms and privacy practices. Couriers, hosting providers and professional advisers may receive only the information reasonably needed for delivery, infrastructure, compliance or dispute resolution.
Storage and retention
Order data is stored as protected server-side files outside public web access. Anonymous traffic snapshots are operational, not accounting records, and are designed for short retention. Order/payment records are retained only as long as needed for fulfilment, support, fraud prevention, disputes, accounting and applicable law, then deleted or anonymised where practicable.
Your choices and rights
You may ask for access, correction or deletion of eligible personal data, withdraw optional consent, or raise a grievance by emailing care@reshamsparsh.com. Some records may need to remain where law, tax, fraud prevention or an active dispute requires them.
Security
Prices are calculated server-side, payment signatures and webhooks are verified, credentials are excluded from Git, protected paths are denied by the web server, admin access is authenticated and sensitive payment credentials never touch the store server. No system is risk-free; report suspected misuse promptly.
Children
The store is intended for adults purchasing cosmetic products. We do not knowingly solicit orders from children.
Changes
Material changes will be dated on this page. If a change requires fresh consent, we will request a clear affirmative action rather than treating silence as consent.