Privacy Notice

This Privacy Notice explains how Mahaveer International (brand: Vangelo), E-13, Sector 1, Bawana Industrial Area, New Delhi – 110039 (“we”, “us”), collects and uses your personal data when you use this website. It is written to comply with India’s Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.

1. What we collect and why

• Order on WhatsApp: your name, mobile number, city and pincode (and address and note, only if you add them) — to process your order and contact you on WhatsApp or phone.
• Contact form: your name, mobile number, optional email and your message — to answer your enquiry.
• Security: your IP address, stored only as a one-way salted hash, to prevent fraud and spam.
• Consent record: which notice version you saw, what you agreed to and when — the law requires us to keep proof of consent.

Your cart and (only if you tick “Remember my details”) your checkout details are stored in your own browser, not on our servers. We do not collect payment details, date of birth, Aadhaar/PAN or precise location, and we do not use advertising trackers unless you accept them in the cookie banner.

2. Legal basis and withdrawing consent

We process your data on the basis of your consent, given by ticking the boxes at checkout or on the contact form. Marketing messages are a separate, optional choice. You can withdraw consent at any time from Your data (Privacy Center) or by replying “STOP” on WhatsApp. Withdrawal does not affect processing already carried out.

3. Where your data is stored and who processes it

Your data is stored in India (Mumbai region). Service providers that process data on our behalf under contract: Supabase (database), Netlify (hosting), Cloudflare Turnstile (bot protection), Upstash (rate limiting — hashed data only), Resend (enquiry emails) and Sentry (error logs without personal data). Product images are hosted on Cloudinary, which receives no customer data. When you send your order on WhatsApp, you share it with us through WhatsApp (Meta) under WhatsApp’s own terms.

4. How long we keep it

Order and enquiry details are automatically anonymised 12 months after your last interaction, or earlier if you ask us to delete them. Anonymous sales statistics (product and quantity, without personal data) may be kept. Security logs with hashed IP addresses are kept for one year.

5. Your rights

You can ask for a summary of your data, correct it, delete it, withdraw consent, nominate someone to act for you, or raise a grievance. Use the Privacy Center. We verify your identity before acting and aim to complete requests within 7 days (legal maximum: 90 days).

6. Children

Our website is meant for adults (18+). We do not knowingly process children’s data. If you are under 18, please ask a parent or guardian to place the order.

7. Cookies

We use only essential browser storage (cart, cookie choice) by default. Optional analytics are loaded only if you click “Accept” in the cookie banner. You can change your choice any time from “Cookie settings” in the footer. See our Cookie Policy.

8. Security and breaches

Data is encrypted in transit and at rest, access is limited to authorised staff with strong authentication, and every access to customer data is logged. If a personal data breach occurs, we will inform the Data Protection Board of India and affected customers without delay.

9. Grievances

Contact our Grievance Officer (details below). If you are not satisfied with our response, you may complain to the Data Protection Board of India.

10. Changes

We will update the version date at the top of this notice whenever it changes.