Policy

Privacy notice

Updated 1 May 2026. Aligned with the Digital Personal Data Protection Act, 2023.

Who we are: Basuva is operated by the proprietor at a registered office in Kolkata, West Bengal, India. For any privacy concern, we are the data fiduciary and you are the data principal under the Digital Personal Data Protection Act, 2023 (DPDP Act).
Data we collect: When you create an account: name and email. When you place an order: shipping and billing address, phone number for the courier, and a record of what you bought. When you pay: a Razorpay payment reference — we do not see or store your card or UPI credentials. When you visit: basic server logs (IP, user-agent, request path) retained for 30 days for security and abuse prevention.
Why we collect it: We process your data to fulfil your order, communicate about it, issue a GST-compliant invoice, allow you to track shipments and request returns, and to maintain the security and integrity of the site. We do not sell your data, ever.
How long we keep it: Account and order records are retained for eight years to meet GST and Companies Act audit requirements. Server logs are deleted after 30 days. If you ask us to delete your account, we anonymise personal identifiers in old orders and remove your contact details — the anonymised order remains for tax records.
Who else sees it: Razorpay (payment processing), Resend (transactional email), and the courier carrying your parcel are the only third parties that receive your data, and each receives only what they need to do their job. None are authorised to use your data for their own marketing.
Your rights: You can request a copy of the data we hold about you, ask us to correct anything inaccurate, withdraw consent to non-essential processing, and ask for deletion of your account. Write to the grievance officer (below) and we'll respond within 30 days as the DPDP Act requires.
Cookies: We use a single first-party session cookie to keep you signed in and a cart-state cookie for guest checkout. No third-party advertising cookies, no cross-site trackers. We do not need a consent banner because we set only strictly-necessary cookies.
Children: Basuva is not directed at minors. We do not knowingly create accounts for users under 18; if you believe a minor has signed up, write to us and we will delete the account.
Changes to this notice: Material changes will be announced on the homepage and by email to active account holders at least 14 days before they take effect. The 'last updated' date at the top of this page always reflects the current version.

Privacy notice

Updated 1 May 2026. Aligned with the Digital Personal Data Protection Act, 2023.

Who we are

Basuva is operated by the proprietor at a registered office in Kolkata, West Bengal, India. For any privacy concern, we are the data fiduciary and you are the data principal under the Digital Personal Data Protection Act, 2023 (DPDP Act).

Data we collect

When you create an account: name and email. When you place an order: shipping and billing address, phone number for the courier, and a record of what you bought. When you pay: a Razorpay payment reference — we do not see or store your card or UPI credentials. When you visit: basic server logs (IP, user-agent, request path) retained for 30 days for security and abuse prevention.

Why we collect it

We process your data to fulfil your order, communicate about it, issue a GST-compliant invoice, allow you to track shipments and request returns, and to maintain the security and integrity of the site. We do not sell your data, ever.

How long we keep it

Account and order records are retained for eight years to meet GST and Companies Act audit requirements. Server logs are deleted after 30 days. If you ask us to delete your account, we anonymise personal identifiers in old orders and remove your contact details — the anonymised order remains for tax records.

Who else sees it

Razorpay (payment processing), Resend (transactional email), and the courier carrying your parcel are the only third parties that receive your data, and each receives only what they need to do their job. None are authorised to use your data for their own marketing.

Your rights

You can request a copy of the data we hold about you, ask us to correct anything inaccurate, withdraw consent to non-essential processing, and ask for deletion of your account. Write to the grievance officer (below) and we'll respond within 30 days as the DPDP Act requires.

We use a single first-party session cookie to keep you signed in and a cart-state cookie for guest checkout. No third-party advertising cookies, no cross-site trackers. We do not need a consent banner because we set only strictly-necessary cookies.

Children

Basuva is not directed at minors. We do not knowingly create accounts for users under 18; if you believe a minor has signed up, write to us and we will delete the account.

Changes to this notice

Material changes will be announced on the homepage and by email to active account holders at least 14 days before they take effect. The 'last updated' date at the top of this page always reflects the current version.