Policies

Privacy Policy

Last updated: 31 July 2026

We’re a small studio in Mumbai. We collect the least we can get away with, we don’t sell it to anybody, and we don’t run advertising trackers on this site. This page tells you exactly what we hold and what you can ask us to do about it.

This policy is written to the standard of India’s Digital Personal Data Protection Act, 2023, which is being brought into force in stages. We’ve chosen to work to it now rather than wait, alongside our existing obligations under the Information Technology Act, 2000 and the Consumer Protection (E-Commerce) Rules, 2020.

1 What we collect, and why

We only ask for what we need to make your order and get it to you.

What	Why we need it	Would we have it if you never ordered?
Your name	To address the order and the courier label	No
Your email address	To send your order confirmation and updates, and to reply to you	No
Your phone number	So the courier can reach you on delivery	No
Your delivery address (line 1 and 2, city, state, PIN code)	To ship your order	No
The names and text you want printed, plus the colours and font you chose	This is the product. We can’t make it without it	No
The amount you paid, in rupees, and a payment reference from Razorpay	To confirm your order and process any refund	No
Your order and delivery status	To make, ship and support your order	No
If you emailed us: your email address, name, and the content of the conversation	To answer you, and so a later question about the same order can be looked up	Yes, if you emailed us without ordering
If you arrived from a printed QR card and left your number: your name and WhatsApp number	To send you the link we promised	Yes
Which page you arrived on and roughly where you came from	So we know which of our own channels works. This is a count, not a profile of you	Yes

We don’t ask for your date of birth, your gender, your PAN, your Aadhaar, or anything else we have no use for. If a form on this site ever asks you for something and you can’t see why, please tell us — that’s a bug in our thinking.

We do not sell or rent your personal data to anyone, ever, for any price. We don’t run behavioural advertising and we don’t share your data with ad networks or data brokers.

2 The names you ask us to print

Something worth saying out loud, because it’s unusual: the text you type into a keychain is often somebody else’s name — your child’s, your colleague’s, a friend you’re giving it to.

We use it only to make and deliver your order.
We don’t build a contact list out of it, we don’t market to it, and we never link it to any other record.
We can’t check whether the person named agreed to it, so please only type a name you’re comfortable putting on a gift. If you’d like us to delete the text after your order is delivered, just ask — see §8.

If you put a phone number on a bag tag or a UPI ID on a QR Code Stand, treat it the same way: we print it, we ship it, and we don’t reuse it for anything else.

3 Who we share it with, and why

Only where the work genuinely requires it, and only the minimum:

Who	What they get	What for
Razorpay Software Private Limited — our payment gateway, an RBI-authorised payment aggregator	Your name, email, phone and the amount. They hold the card/UPI details you enter, we do not	To take your payment and process refunds
Our logistics partner and the courier it assigns — we ship through a third-party multi-carrier logistics aggregator, which hands your parcel to whichever of its carriers serves your Maharashtra PIN code	Your name, delivery address and phone number	To deliver your parcel, and to let the courier call you if they cannot find the address
Cloudflare, Inc. — hosts this website and our database	Whatever is stored, in encrypted storage, plus the usual technical logs of requests	Hosting and security. They are our processor, not an independent user of your data
Google (fonts)	Your browser’s IP address and browser details, because the site loads its typefaces from Google’s servers	To display the site’s fonts. We’re looking at self-hosting these to remove this request

That’s the whole list. There’s no analytics suite, no advertising pixel and no CRM behind this site today. If we add one, this table changes before it goes live, not after.

We may also disclose data where the law requires it — a court order, or a lawful request from an authority — and to our professional advisers if we ever need advice on a dispute.

4 Card details: what we never see

We never receive, see or store your card number, CVV, expiry date, UPI PIN, netbanking password or OTP. Those are entered on Razorpay’s payment interface and stay with Razorpay and your bank. What comes back to us is a payment reference and a “paid” or “failed” result. There is nowhere in our system that a card number could be stored, because we never handle one.

If you pay by direct UPI transfer to our account, we see what any recipient of a UPI transfer sees: that the money arrived, and from which account or handle.

5 Cookies and what your browser loads

We don’t use advertising or tracking cookies.

Your cart lives in your own browser’s local storage until you check out. It never leaves your device until you place the order.
A first-touch marker is stored in your browser if you arrive from one of our printed QR cards, so a discount you were promised isn’t lost if you forget to retype the code, and so we can count how well that card worked. It records the page you landed on and when — not who you are.
Google Fonts are loaded from Google’s servers, which means your IP address reaches Google when you load a page. We’ve listed it in §3 because it’s a real third-party request even though we get nothing back from it.

You can clear all of this by clearing your browser storage. Nothing on this site requires you to accept a tracker.

6 How long we keep it

Nothing is kept forever. Here is the whole schedule:

What	How long	Why that long
Order records (name, contact, address, amount, status)	7 years from the end of the financial year of the order	Books-and-records retention. This is a legal clock, not a preference — see the note under this table
The personalisation text we printed	12 months after delivery, then deleted — or immediately on request	We need it while a defect or replacement claim is live. After that it has no purpose, and it’s the most personal thing we hold
Payment references from Razorpay	With the order record	Needed to trace a refund
Email conversations with support@ or sales@	3 years from the last message	Long enough to answer “what did you quote us”; not indefinite
Leads captured from a QR card (name, WhatsApp number)	12 months, then deleted	If they haven’t ordered in a year, we have no reason to hold a phone number
Channel counts (which page, which source)	Indefinitely, but only as aggregate counts with no name, email, phone or address attached	An anonymous count is not personal data

Why seven years on the order record. That one isn’t our choice. Income-tax law requires a business to keep its books for six years from the end of the relevant assessment year, which for an order placed this financial year works out at seven years from the end of the financial year of the order. Everything else on this table is set as short as the job allows.

When a period ends we delete the record. Where we’re legally required to keep the financial record but not the personal detail, we keep the minimum the law needs and delete the rest.

7 How we protect it

Everything is stored on Cloudflare’s infrastructure, encrypted in transit (HTTPS on every page) and at rest.
Access to order data is behind an authentication token held by the studio, not open on the internet. Only the people who actually make and ship your order can see it.
We don’t hold payment credentials at all (§4), which removes the single most damaging thing we could lose.
We keep the amount of data small on purpose. It’s the most effective security control available to a studio our size.

8 Your rights, and how to use them

Write to grievance@bombay3dstudio.com from the email address on your order and tell us what you want. You can ask us to:

Tell you what we hold about you, and who we’ve shared it with.
Correct anything wrong or out of date — a misspelt name, an old address.
Delete your data. We’ll delete everything we’re not legally required to keep, and we’ll tell you specifically what we’re keeping and which law requires it (usually just the financial record of the sale — see §6).
Delete the personalisation text from a delivered order, even if you want us to keep the rest.
Nominate someone to exercise these rights on your behalf if you die or become incapacitated.
Complain, if you think we’ve handled your data badly.

We’ll acknowledge your request within 48 hours and complete it within 30 days. In practice the acknowledgement is immediate — the moment your email reaches grievance@bombay3dstudio.com you get an automatic reply with a ticket reference, and a person picks it up after that. We won’t charge you for it and we won’t ask you to justify it. We may need to check you are who you say you are before we delete something — that’s a protection for you, not an obstacle.

Once the DPDP Act’s rights provisions are fully in force you’ll also be able to complain to the Data Protection Board of India. Nothing here stops you doing that.

9 Children

Our products are often bought for children — party favours, school bag tags — but the person placing the order is an adult, and we don’t knowingly collect data directly from children. We do not track children, profile them, or show them targeted advertising. We don’t show targeted advertising to anybody.

If a child’s name is printed on a keychain, see §2: we use it to make the item and nothing else, and you can ask us to delete it after delivery.

10 Contact us

For anything about your data, or to use any of the rights in §8:

Data-protection contact / Grievance officer: Jagdeep Nagpal
Designation: Proprietor
Email: grievance@bombay3dstudio.com
Postal address: JP Designs (trading as Bombay 3D Studio), Nagpal House, 35th Road, Khar West, Mumbai, Maharashtra 400050

General questions are always welcome at support@bombay3dstudio.com.

11 Changes to this policy

We’ll update this page when what we do changes — a new courier, a new tool, or the next stage of the DPDP Act coming into force. The “last updated” date at the top is always current. If a change materially affects how we use data you’ve already given us, we’ll email you rather than quietly edit the page.