Privacy Policy

This Privacy Policy explains how Krishna Naturals ("Krishna Naturals", "we", "us") handles personal data when you use our website and online store at krishnanaturals.co.in (the "Service"). Krishna Naturals is a honey producer based in Madhapar, Bhuj, Gujarat 370020, India. We sell our own raw forest honey to consumers and wholesale buyers through the Service.

We are the data fiduciary (data controller) for the personal data described in this policy.

• You can browse the whole store without an account. We only need an account to process an order.
• We collect what is needed to run the store: your account details, delivery details, order history, and messages you send us.
• We do not sell personal data, and we do not use it for third-party advertising.
• We share data only with the service providers that run the store (hosting, payments, email, delivery) and when the law requires it.
• You can ask us to access, correct or delete your data at any time by emailing info.krishnanaturals@gmail.com.

a) Information you give us

• Account information — if you sign in with Google: your name, email address and profile picture (see section 4). If you sign up with email: your email address, password (stored only as a secure hash by our authentication provider), first and last name, and phone number (optional).
• Order and delivery information — recipient name, phone number, delivery address, city, state and PIN code, the products you order, amounts, coupon codes used, and order status. You may save addresses to your account for future orders.
• Payment information — online payments are processed by Razorpay. We receive the Razorpay order ID, payment ID, payment status and payment method type. We never receive or store your card number, CVV, UPI PIN or bank login details.
• Messages — anything you send us through the contact form, website chat assistant, support tickets, return requests or wholesale enquiries, including your name, email and phone number if you provide them.
• Chat assistant conversations — the messages you type into the chat assistant on our website and its replies, together with the page you were on and, if you are signed in, your account email. If you are signed in, the assistant also reads your recent order details (order number, status, total, tracking) so it can answer questions about them.
• Product reviews — your rating, review text and display name.
• Newsletter — your email address, if you choose to subscribe.

b) Information collected automatically

• Page-view analytics — the page path you visit, a random session identifier stored in your browser, and your browser's user-agent string. We use this only to understand which pages are used. We do not use third-party advertising or tracking pixels.
• Shopping cart — when you are signed in, the contents of your cart are saved to your account so they are available on your other devices and so we can send you one reminder email if you leave items in your cart.
• Push notifications — only if you click "Enable Notifications" and allow them in your browser: a push token issued by Google Firebase Cloud Messaging, your browser user-agent, and whether you are on mobile or desktop.
• Technical logs — our hosting and security providers automatically process your IP address, request time and browser details to deliver pages and protect the Service against abuse.

• To create and manage your account and keep you signed in.
• To process, pack, ship and deliver your orders, and to handle payments, cancellations, returns and refunds.
• To send transactional messages: order confirmations, invoices, shipping and delivery updates.
• To respond to your enquiries and support requests.
• To send marketing emails or push notifications only if you opted in. You can unsubscribe at any time.
• To prevent fraud and abuse, and to keep the Service secure.
• To answer your questions through the chat assistant, and to review conversations so we can improve its answers and follow up when you ask for help.
• To understand how the website is used so we can improve it.
• To meet our legal obligations, such as tax and accounting record keeping.

We process personal data on the basis of your consent, which you give when you create an account, place an order, subscribe, or contact us, and for the legitimate uses permitted by India's Digital Personal Data Protection Act, 2023.

We do not sell or rent personal data. We share it only with:

• Supabase — database, user authentication and file storage.
• Vercel and Cloudflare — website hosting, content delivery and security.
• Razorpay — online payment processing (subject to Razorpay's own privacy policy).
• Resend — sending transactional and (if you opted in) marketing emails.
• Groq — generates the chat assistant's replies. It receives your chat messages and, if you are signed in, your recent order details; it does not receive your password or payment details.
• Google Firebase Cloud Messaging — delivering push notifications, only if you enabled them.
• Google Translate — the optional website translation widget loads from Google and may receive the page content and your IP address.
• Courier and logistics partners — recipient name, phone number and delivery address, to deliver your order.
• Authorities — when required by law, court order, or to protect our rights, customers or the public.

These providers may only use the data to provide their services to us.

• Sign-in cookies (names starting with sb-) — keep you signed in. Required for accounts and checkout.
• googtrans cookie — remembers the language you chose for the translation widget.
• Browser local storage — your cart, wishlist, the delivery details you typed at checkout (so you don't have to re-type them), an analytics session ID, and whether you have dismissed pop-ups.

We do not use advertising cookies. You can clear cookies and local storage in your browser settings at any time; you will be signed out and your saved cart will be cleared.

• Account data — until you delete your account or ask us to delete it.
• Order, invoice and payment records — for as long as required by Indian tax and accounting laws (for example GST record-keeping rules), even if you delete your account.
• Messages and support tickets — for as long as needed to resolve your request and handle any follow-up.
• Chat assistant conversations — up to 12 months, then deleted automatically.
• Newsletter and push subscriptions — until you unsubscribe or disable notifications.
• Analytics and technical logs — only as long as needed for the purposes in section 5, after which they are deleted or anonymised.

• All traffic to the Service is encrypted with HTTPS.
• Customer data is protected by database row-level security, so a signed-in customer can only access their own account, addresses and orders.
• Only authorised staff can access the administration area, and only to run the store.
• Card and UPI payments are handled entirely by Razorpay; payment credentials never reach our servers.

No method of transmission or storage is completely secure. If a personal data breach affects you, we will notify you and the authorities as required by law.

Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you have the right to:

• get a summary of the personal data we hold about you and how it is used;
• correct or update inaccurate or incomplete data (you can edit most details yourself on your profile page);
• have your data erased (see section 11);
• withdraw consent at any time, for example by unsubscribing from emails or disabling notifications;
• raise a grievance with us (section 15) and, if unresolved, with the Data Protection Board of India;
• nominate another person to exercise these rights on your behalf in case of death or incapacity.

To exercise any of these rights, email info.krishnanaturals@gmail.com. We may need to verify your identity first.

Email info.krishnanaturals@gmail.com from the email address linked to your account with the subject "Account deletion request".

We will delete your account, profile (including any data received from Google), saved addresses, cart, wishlist, push tokens and newsletter subscription within 30 days and confirm by email. Order and invoice records that we must keep by law are retained only for the legally required period and are not used for any other purpose.

The Service is intended for adults. You must be at least 18 years old to create an account or place an order. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

We are based in India. Some of our service providers (listed in section 6) may store or process data on servers outside India. We only use reputable providers that protect personal data, and transfers are made in accordance with Indian law.

We may update this policy from time to time. We will change the "Last updated" date above, and for significant changes we will notify signed-in customers by email or on the website before the change takes effect.

For privacy questions, requests or complaints, contact our Grievance Officer:

We aim to respond within 7 days and to resolve grievances within 30 days.

See also our Terms & Conditions, Shipping Policy and Refund Policy.