Privacy policy

NY Label (“we”, “us”) operates this website and is the data fiduciary for the personal data described here, as defined by India’s Digital Personal Data Protection Act 2023 (the DPDP Act).

You can reach us about anything on this page at hello@nylabel.in.

We collect only what we need to sell you a saree and get it to you.

• Account details — your name, email address and, if you provide it, your mobile number.
• Order details — what you bought, the delivery address, and the status of the order.
• Payment references — a transaction ID from our payment processor. We never see or store your card number, CVV or UPI PIN. Those are collected by PhonePe on their own systems.
• Technical data — IP address, browser and pages visited, used to keep the site secure and to fix problems.

• To take payment for, fulfil and deliver your order — this is contractual necessity.
• To send transactional email: confirmations and delivery updates.
• To prevent fraud and abuse, and to keep the site available and secure.
• To send occasional marketing email — only if you have ticked the box, and you can withdraw that at any time from your account.
• To meet tax and accounting obligations, which require us to keep order records.

We do not sell your personal data. We never have and we will not.

Only the processors we need to run the shop:

• PhonePe — payment processing. Governed by their own privacy policy and PCI DSS obligations.
• Google Cloud / Firebase — hosting, database and authentication.
• Delivery partners — your name, address and phone number, so your parcel can be delivered.

Account data is kept while your account is open. Order records are kept for eight years after the transaction, which Indian tax law requires. Technical logs are kept for 30 days.

Under the DPDP Act you have the right to:

• Access a copy of your data — available instantly from your account.
• Correct anything inaccurate, also from your account.
• Erase your data. Also available from your account. Past orders are anonymised rather than deleted, because we are legally required to retain the transaction record.
• Withdraw consent for marketing at any time.
• Nominate another person to exercise these rights on your behalf in the event of death or incapacity — email us to arrange this.
• Complain to the Data Protection Board of India if you are not satisfied with how we have handled a request.

We set two strictly necessary cookies: one that keeps you signed in and one that protects forms against cross-site request forgery. Neither is used for tracking and neither can be declined without breaking the site.

Anything beyond that — analytics — is set only if you accept it in the banner, and you can change your mind by clearing your site data.

Traffic is encrypted with TLS. Sessions are held in cookies that JavaScript cannot read. Payment credentials never reach our servers. Access to production data is restricted to administrators with mandatory two-factor authentication, and every administrative action is written to an audit log.

If we change this policy materially we will say so on this page and, where the change affects how we use data you have already given us, email you about it.