PRIVACY POLICY

OVRN HOUSE ("we," "our," or "us") operates the website ovrn.in (the "Platform"). This Privacy Policy governs the collection, processing, storage, and disclosure of personal information pertaining to individuals ("Users," "you," or "your") who access or transact on the Platform. We are committed to handling your personal data with transparency, integrity, and in accordance with applicable law. By accessing or using the Platform, you acknowledge that you have read, understood, and consented to the practices described herein.

We collect only the information necessary to operate the Platform and fulfil your orders. Specifically, we collect the following categories of personal data:

1. 01.Identity Data — your full name and email address, received exclusively via your Google account through Google OAuth 2.0. We do not collect or store passwords.
2. 02.Order Data — your designated shipping address at the time of placing an order.
3. 03.Transaction Reference — the Razorpay-generated payment transaction identifier, retained solely for order reconciliation and dispute resolution. We do not collect, process, or store credit card numbers, debit card details, CVV codes, UPI credentials, or any other sensitive payment instrument data. Such information is processed entirely by Razorpay on its PCI DSS-compliant infrastructure.
4. 04.Non-Personal Analytics Data — aggregated, anonymised usage metrics collected by Google Analytics, including approximate geographic location (country/region), referring websites, pages visited, and visitor counts. This data cannot be used to identify you personally.

For the avoidance of doubt, OVRN HOUSE does not collect, log, or store the following:

1. 01.Internet Protocol (IP) addresses
2. 02.Credit or debit card numbers, CVV codes, or banking credentials
3. 03.Passwords or authentication tokens
4. 04.Device identifiers or precise geolocation data
5. 05.Biometric data of any kind

We use the personal information we collect for the following purposes:

1. 01.Account Management — to create and maintain your account on the Platform using the name and email address provided via your Google account.
2. 02.Order Fulfilment — to process and dispatch your orders, including transmitting your shipping address and name to our authorised logistics and delivery partners.
3. 03.Payment Reconciliation — to match your transaction reference identifier against orders for invoicing, refund processing, and dispute resolution with Razorpay.
4. 04.Platform Analytics — to understand aggregate usage patterns, geographic reach, and site performance through Google Analytics in order to improve the Platform.
5. 05.Service Communications — to contact you via email regarding matters directly related to your account, orders, or changes to our policies. We may also, in the future, send communications about new products, collections, or promotional offers. You may opt out of such communications at any time by following the unsubscribe instructions contained in any such message.

We do not sell, trade, or rent your personal information to any third party for commercial purposes. We disclose your personal data only to the following categories of third parties, strictly to the extent necessary:

1. 01.Razorpay Software Private Limited — your transaction reference identifier and order value are shared with Razorpay to facilitate payment processing. Razorpay's privacy practices are governed by its Privacy Policy at razorpay.com/privacy.
2. 02.Logistics and Delivery Partners — your full name and shipping address are shared with our authorised courier and last-mile delivery partners solely for the purpose of dispatching and delivering your order.
3. 03.Google LLC — aggregated, anonymised analytics data is processed by Google Analytics as described in Section 02. Google's Privacy Policy is available at policies.google.com/privacy.
4. 04.Legal and Regulatory Authorities — we may disclose your personal information where required to do so by law, court order, or in response to a lawful request by competent governmental or regulatory authorities in India.

The Platform uses Google OAuth 2.0 as its sole method of user authentication. By signing in with your Google account, you authorise us to receive your name and email address from Google for the purpose of creating and managing your account. We do not store your Google password or any authentication credentials. You may revoke our access to your Google account at any time through your Google Account security settings at myaccount.google.com/permissions, which will result in the inability to access your OVRN HOUSE account.

The Platform uses cookies and similar client-side tracking technologies for the following purposes:

1. 01.Authentication Cookies — session tokens required to maintain your logged-in state across visits.
2. 02.Analytics Cookies — cookies placed by Google Analytics to collect aggregate site usage data as described in Section 02.

We retain your personal data for as long as your account remains active or as otherwise necessary to fulfil the purposes described in this Policy. The following specific retention periods apply:

1. 01.Name and Email Address — retained for the duration of your active account.
2. 02.Shipping Addresses and Transaction Reference Identifiers — retained for a minimum of seven (7) years from the date of the relevant transaction, for financial record-keeping, taxation compliance, and dispute resolution under applicable Indian law.

At present, we do not offer a self-service account deletion mechanism. If you wish to request the deletion or correction of your personal data, please submit a written request to contact@ovrn.in. We will endeavour to respond within a reasonable period, subject to our overriding legal retention obligations under applicable Indian law.

We implement reasonable and appropriate technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, and destruction. Our Platform is served over HTTPS using Transport Layer Security (TLS) encryption. Payment transactions are processed exclusively through Razorpay's PCI DSS-compliant infrastructure; we do not handle or store payment card data on our systems at any point. While we take commercially reasonable steps to secure your data, no method of transmission over the internet or electronic storage is entirely infallible, and we cannot guarantee absolute security.

The Platform is intended for users who are at least thirteen (13) years of age. Users between the ages of thirteen (13) and seventeen (17) may access and use the Platform only with the verifiable prior consent of a parent or legal guardian. By permitting a minor to use the Platform, the parent or guardian agrees to be bound by this Privacy Policy on the minor's behalf and accepts full responsibility for the minor's activity. If we become aware that we have inadvertently collected personal data from a child under the age of thirteen (13) without verifiable parental consent, we will take prompt steps to delete such information from our records.

Subject to applicable Indian law, including the Digital Personal Data Protection Act, 2023 ("DPDPA") to the extent in force, you have the following rights in respect of your personal data:

1. 01.Right of Access — to obtain confirmation of whether we hold personal data about you and to receive a copy of such data.
2. 02.Right to Correction — to request correction of any inaccurate or incomplete personal data we hold.
3. 03.Right to Erasure — to request deletion of your personal data, subject to our overriding legal retention obligations.
4. 04.Right to Withdraw Consent — to withdraw your consent to processing, where processing is based exclusively on your consent.
5. 05.Right to Nominate — to nominate a person to exercise your data rights on your behalf in the event of your death or incapacity, to the extent permitted by applicable law.

This Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of India, without regard to its conflict of laws principles. Any dispute, claim, or controversy arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of competent jurisdiction located in Guwahati, Assam, India. By using the Platform, you irrevocably submit to the personal jurisdiction of such courts and waive any objection to the laying of venue of any such proceedings in Guwahati.

We reserve the right to amend, update, or modify this Privacy Policy at any time at our sole discretion. Material changes will be reflected by an updated version number and revision date in the header of this document. Your continued use of the Platform following the publication of any revised Privacy Policy constitutes your acceptance of the amended terms. Where changes materially affect your rights or obligations, we may, where reasonably practicable, notify you via the email address associated with your account.

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact our designated privacy team at: OVRN HOUSE, Guwahati, Assam, India. Email: contact@ovrn.in. We aim to acknowledge all written enquiries within forty-eight (48) business hours and to resolve substantive matters within a reasonable period thereafter.