This policy explains what personal data we collect when you buy a Mamapod, why we collect it, who we share it with, how long we keep it, and what you can ask us to do with it. It is written to meet the Digital Personal Data Protection Act, 2023 (the DPDP Act).
Under that Act you are the Data Principal and we are the Data Fiduciary — the people who decide what happens to your data and are answerable for it.
What we collect
When you check out:
- Your mobile number, which we verify with a one-time password
- Your name and email address
- Your delivery address, including pincode and any landmark you add
- Your GSTIN, only if you choose to add one for a business invoice
- What you ordered: colour, size, quantity and the amounts due
When you pay: a payment reference and the method used, such as UPI or card, and whether the payment succeeded.
We never see or store your card number, UPI PIN, CVV or bank password. Payments are taken by Cashfree on their own systems. Nothing about your card reaches ours.
When you use the site: basic technical data such as your IP address, device and browser, which pages you looked at, and whether an error occurred. Some of this is collected by the analytics tools listed below.
We do not ask for and do not want any data about your baby beyond what you tell us in a support message.
Why we collect it
| What | Why |
|---|---|
| Mobile number | To verify it is really you, and to send order updates |
| Name, address, pincode | To make and deliver your order |
| Email address | To send your order confirmation, invoice and dispatch updates |
| Order and payment references | To take payment, issue a GST invoice, and handle refunds, returns and disputes |
| GSTIN, if given | To put it on your tax invoice |
| Technical and analytics data | To keep the site working, fix errors, and understand which pages help people |
We use your data for these purposes and no others. Order updates — confirmation, production, dispatch, delivery, cancellation, refund — are transactional: we send them because you bought something, not as marketing.
WhatsApp marketing is opt-in
Offers and news on WhatsApp are opt-in. The checkbox at checkout is unticked by default, and leaving it unticked changes nothing about your order.
If you do opt in, you can opt out at any time by replying STOP on WhatsApp or emailing us, and we will stop. Opting out of marketing does not stop order updates, which we have to send to fulfil your order.
Who we share it with
We share the minimum each partner needs to do its job:
| Partner | What they get | What for |
|---|---|---|
| Cashfree Payments | Your name, mobile number, email and the amount | Taking payment and processing refunds |
| Cashfree Verification Suite | Your mobile number, and the one-time code you enter | Sending the code that verifies your number at checkout, and checking it |
| Shiprocket and its courier partners | Your name, address, mobile number and parcel details | Delivering your order and collecting cash on delivery |
| Resend | Your email address and the message | Sending order emails and your invoice |
| Meta (Facebook, Instagram, WhatsApp) | Hashed identifiers, the pages you view, what you put in your cart, and your order number and total when you buy | Measuring which ads lead to orders, and sending WhatsApp updates |
| Google Analytics | The pages you view, what you put in your cart, and your order number and total when you buy | Understanding how the site is used and where orders come from |
| Vercel | The page you viewed, where you came from, your browser, device and city | Counting visits to our shop pages. No cookies, and nothing that identifies you |
About the number verification. The service that sends and checks your one-time code is able to return further details it holds about a mobile number, beyond a yes or no. We do not ask for those details, do not use them, do not store them and do not share them. Our system reads only whether the code was correct and discards everything else in the same moment, so nothing beyond that answer ever reaches our records.
We do not sell your personal data, and we do not share it with anyone for their own marketing.
We may also disclose data where the law requires it — for example to tax authorities, or in response to a lawful order.
Some of these partners process data on servers outside India. We only use partners who commit to protecting it, and we transfer only what is needed for the purpose above.
How long we keep it
| What | How long |
|---|---|
| Tax invoices, credit notes and order records | 8 years, as tax law requires |
| Your name, address and contact details | While your account is active, and then with the order records above |
| OTP verification records | 90 days |
| Abandoned checkout details | 90 days, then deleted |
| Marketing consent | Until you withdraw it, plus a record that you withdrew it |
| Analytics data | For the period each provider retains it |
When a purpose ends and no law requires us to keep the data, we delete it.
Your rights
Under the DPDP Act you can ask us to:
- Tell you what personal data of yours we hold and who we have shared it with
- Correct anything inaccurate, incomplete or out of date
- Delete your personal data, where no law requires us to keep it
- Withdraw consent you have given, as easily as you gave it
- Nominate someone to exercise these rights if you die or become incapable of exercising them
To ask for any of these, email mamapod.support@gmail.com or message +91 95992 16212 with enough detail for us to find your records — your order number and the mobile number you ordered with is usually enough. We respond within 30 days.
We may not be able to delete data that sits inside a tax invoice, because we are required to keep those. We will tell you if that is the case and delete everything else.
Grievances
If you are unhappy with how we have handled your data, contact our grievance officer:
- Malik
- Email: mamapod.support@gmail.com
- Phone: +91 95992 16212
We acknowledge complaints within 48 hours and aim to resolve them within 30 days. If you are still not satisfied, you may complain to the Data Protection Board of India.
Keeping it safe
Access to customer data is limited to the people who need it, admin accounts require two-factor authentication, every administrative action is logged, and documents like invoices are served through links that expire. We do not store card data at all, so there is none to lose.
Cookies and analytics
We use cookies that are needed for the site to work — remembering your verified session at checkout, and your cart. We also use Google Analytics and the Meta pixel to understand which pages and ads lead to orders. You can block these in your browser without breaking checkout.
Both of those follow you through the shop and into checkout, and they are told your order number and total when an order is placed, so that a sale can be matched to the visit it came from. Neither is told your name, your address or your phone number, and the link that opens your order page is stripped out of the web address before anything is sent, so it is never shared.
We count visits to our shop pages with Vercel Web Analytics, which sets no cookies and stores nothing on your device. It records the page you viewed, the site you came from, your browser, device and city, and it does not follow you to other websites. It does not run on checkout or on your order page, so what you do once you start paying is not counted at all.
Changes to this policy
If we change this policy, we will update the date at the bottom of this page. If a change materially affects how we use your data, we will tell you.