Privacy policy

Effective Date: 1st August 2025  |  Applies to: palmandplush.in and all associated applications

1. Our Commitment

Palm & Plush ("we", "us", "our") respects your right to privacy. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights over it — in plain language, without legalese designed to obscure.

This policy is consistent with the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and we will update it to comply with India's Digital Personal Data Protection Act (DPDPA) as it comes into effect.

2. What We Collect

Information you give us

  • Name, email address, phone number, and delivery address when you place an order or create an account.
  • Payment information — processed directly by our payment gateway; we do not store card or UPI credentials.
  • Messages or reviews you submit to us directly.

Information we collect automatically

  • Browser type, device type, and IP address.
  • Pages visited, time spent, and interactions via cookies and analytics tools (e.g. Shopify Analytics, Google Analytics).
  • Referring URLs and search terms that brought you to our site.

3. How We Use Your Data

  • To fulfil your orders — processing payment, arranging shipping, sending tracking updates.
  • To communicate with you — order confirmations, customer support, and policy updates.
  • To improve our products and site — understanding which pages perform, which products resonate.
  • To send marketing communications — only if you have opted in. You can unsubscribe at any time.
  • To comply with legal obligations — GST filings, audit requirements, and law enforcement requests where legally required.

4. Sharing Your Data

We do not sell your personal data. We share data only with:

  • Logistics partners (e.g. Shiprocket, courier services) — to deliver your order.
  • Payment gateways — to process transactions securely.
  • Platform providers — Shopify (our storefront), Google Analytics, Meta Ads (if you have opted into personalised advertising).
  • Legal authorities — when required by law or court order.

All third-party partners are contractually required to handle your data in accordance with applicable Indian data protection law.

5. Cookies

We use cookies to keep your cart intact, remember your preferences, and understand site performance. You can manage cookie preferences through your browser settings. Disabling certain cookies may affect site functionality.

We use functional cookies (necessary), analytics cookies (to improve the site), and — only if you have consented — advertising cookies (to show you relevant Palm & Plush content on other platforms).

6. Data Retention

We retain your order information for 7 years as required under Indian GST law. Account information is retained for as long as your account is active, or up to 3 years after your last interaction, after which it is deleted or anonymised.

You may request deletion of your account and associated data at any time — subject to our legal retention obligations — by writing to info@palmandplush.com.

7. Your Rights

You have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate information.
  • Request deletion of your data (subject to legal retention requirements).
  • Withdraw consent for marketing communications at any time.
  • Lodge a complaint with the relevant data protection authority.

To exercise any of these rights, contact us at info@palmandplush.com. We will respond within 30 days.

8. Security

We implement industry-standard security measures including SSL/TLS encryption across the site, secure payment processing via PCI-DSS compliant gateways, and access controls limiting data access to authorised personnel only. No system is entirely immune to breach; in the event of a significant breach affecting your data, we will notify you as required by applicable law.

9. Children's Privacy

Our website is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has submitted personal data to us, please contact us and we will delete it promptly.

10. Policy Updates

We may update this Privacy Policy as our practices evolve or as law requires. Material updates will be communicated by email to registered users and noted on this page with a revised effective date.