Privacy
What we collect, why we need it, who else sees it, and how to get it changed or removed.
Who we are
Pooja Luthra is a shop operated by Krevia Studios LLP, registered at HNO B77/1, Lakhmi Vihar, Meerut - 250004, Uttar Pradesh, India (GSTIN 09ABEFK8834H1ZY). We run more than one shop, and they are all the same company — so this page describes how that company handles your details, whichever of our shops you are buying from.
Under India’s Digital Personal Data Protection Act, we are the Data Fiduciary and you are the Data Principal. In plainer words: you own your details, and we are answerable for what we do with them.
What we collect, and why
This is the whole list — what we ask you for, what your own browser keeps, and the technical record that any visit to any website leaves behind. There is nothing collected that is not written here.
| What | Why we need it |
|---|---|
| Your mobile number | It is how you sign in — your account is your number, and there is no password to forget. It is also the number the delivery person calls when they are at your gate. |
| Your name | It has to be printed on the GST invoice that goes with your order. Until you give us one, your account simply says “Customer”. |
| Your email address, if you give it | Optional. It is for order updates. Being straight with you: we cannot send email at all yet, so today this sits in your account unused. If that changes, this page changes first. |
| Your delivery addresses | To work out what delivery costs to your PIN code, to print the label, and to give the courier somewhere to take the parcel. |
| Your orders | What you bought, what you paid, where it went, and what you sent back. We need this to actually deliver the thing, to handle returns and refunds, and because tax law requires us to keep the invoice. |
| Reviews you write | Shown on the product page with the name you had when you wrote it. Only write what you are happy for other shoppers to read. |
| Your basket | So it is still there when you come back. A basket you never checked out is deleted automatically — after 7 days if you were not signed in, after 90 days if you were. |
| Things you save | The items you tap the heart on. This one is kept in your own browser and never reaches us at all — we could not tell you what is on it. |
| The device you sign in from | When you sign in we note what your browser says it is, and when that sign-in was last used, so a session can be recognised and ended if it is not yours. |
| The trace your visit leaves on our servers | Like every website, our servers note the internet address your connection is using and which pages were asked for, so the shop keeps running and abuse can be spotted. It is not used to work out who you are or what you like. |
What we do not collect. We do not ask your date of birth, your gender, or any government ID. We never see or store your card details. We do not build a profile of you, and we do not track you around the internet.
Cookies and trackers
There are no trackers on this site. No Google Analytics, no Facebook pixel, no tag manager, no session recording, no advertising cookies. Not “we only use essential ones” — there are none of the other kind at all.
What your browser does keep is the small amount needed to work: a secure cookie that keeps you signed in, a cookie that points at the basket we are holding for you, and — kept on your device rather than with us — the things you have saved and the last few products you looked at.
One honest detail about that last one. The list of what you looked at lives in your browser, but to draw the row of pictures your browser has to ask our server for those products, so the item numbers do reach us at that moment. We answer and move on: we do not store the list, and we do not attach it to your account. Clearing your browser data removes all of it.
When we need your permission, and when we do not
The law separates these, and so do we.
We do not ask permission to fulfil an order you placed. When you buy something, you have handed us your address for a reason, and using it to get the parcel to you is the reason. That covers taking the order, charging for it, packing and labelling it, giving it to the courier, telling you where it is, issuing your invoice, and sorting out a return.
Anything else needs a separate yes from you — and it will be a separate tick, never bundled into accepting terms, never pre-ticked, and never a condition of buying. That means offers and marketing messages, a newsletter, or using what you bought to build recommendations. Today we do none of these. When we start, we will ask first.
Who else sees your details
Today, this is a short list, and we would rather keep it that way.
- The courier gets your name, address and phone number, because that is what a delivery is.
- Amazon Web Services hosts the shop. Your details sit on servers in Mumbai. They do not use your data — they run the machines we use.
- Nobody else. There is no payment company, because the only way to pay right now is cash on delivery. There is no SMS company, no email company, no analytics company and no advertising company. We do not sell your details to anyone, ever.
When that changes — an online payment option is the next one — this page will be updated before it goes live, not after.
How long we keep it
Your invoices and order records we have to keep, because tax law requires it. Baskets you abandon are deleted on the schedule above, and expired sign-in sessions are cleared out daily.
Your account details we keep while you have an account with us. If you ask us to remove them, see below — but the invoices stay, because we are not allowed to delete those.
Your rights, and how to use them
You can ask us to:
- show you everything we hold about you;
- correct anything that is wrong or out of date;
- remove your details. Being exact about what that means: the invoices stay, because tax law does not let us delete them; the address already printed on an order you placed stays on that order; and the name on a review you have published stays on the product page unless you ask us to take the review down as well;
- tell us to stop — take back any permission you have given us, and ask us to stop using your details for anything other than finishing an order you have already placed;
- name someone else to do all of the above on your behalf if you die or cannot act for yourself.
Being honest about how this works today: there is no button on the site for any of this, and the tools that blank a name or an address across our own systems are still being built. So if you ask us today, a person does it by hand — and we will tell you plainly what we have not yet been able to remove, rather than say it is done. When the self-service version exists, this page will say so.
Write to us at Krevia Studios LLP, HNO B77/1, Lakhmi Vihar, Meerut - 250004, Uttar Pradesh, India. So we know it is really you, quote the mobile number on your account, or an order number.
If you are not happy
Tell us first — Krevia Studios LLP, HNO B77/1, Lakhmi Vihar, Meerut - 250004, Uttar Pradesh, India. Post is the only route we can promise to read today, so we will reply within seven days of your letter reaching us and sort it out as quickly as we can after that.
If we have not resolved it, you can complain to the Data Protection Board of India — the body the DPDP Act sets up to hear exactly this kind of complaint. It runs its own channel for that, published by the Ministry of Electronics and Information Technology. We have deliberately not printed a link here, because a wrong address on a page like this is worse than none. We would much rather you came to us first.
Children
This shop is meant for adults, and we do not knowingly take orders from anyone under 18. We do not ask anyone’s age, we do not profile anyone, and we run no advertising — so nothing here is aimed at children. If you believe a child has given us their details, tell us and we will remove them.
If something goes wrong
If your details are ever exposed, we will tell you what happened, what was involved, what we are doing about it, and what you should do — and we will report it to the Data Protection Board within 72 hours, as the rules require.
What we ask of you
The Act asks a couple of things of you too: give us details that are actually yours and actually correct, and do not raise a complaint you know to be false. That is the whole of it.
Changes to this page
This is version 1.0, in effect from 26 August 2026. If we change how we handle your details, we will update this page and change the version — and where the change means we need your permission for something new, we will ask you rather than assume.