Privacy Policy

ZIVAYU is a brand of Ayurvedagems Wellness Solution, GF-16, P-2, Deep Ganga Apartments, Sector 5A, SIDCUL, Haridwar, Uttarakhand 249403, India (“ZIVAYU”, “we”, “us”).

This policy explains how we collect and use your personal data when you visit zivayu.com, create an account, place an order or contact us. It is written in line with India’s Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules. By using the website you agree to the practices described here.

• Account details: your name, email address and phone number. If you set a password, we store only a secure hash of it. If you sign in with a one-time code, we send it to your email.
• Order and delivery details: shipping address, contact number, items ordered, coupons used, order and delivery status, and your order history.
• Payment information: payments are handled by our payment partners. We do not see or store your card number, UPI PIN or bank login. We receive only the payment status, method type and a transaction reference.
• Location, only if you choose: if you tap “Use my location” or “Use GPS”, your browser asks for permission and we use your location only to fill in your pincode and check delivery. We do not track your location otherwise.
• Things you send us: messages through our contact form, email or WhatsApp; product reviews; and the mobile number or email you give us to receive offers.
• Technical data: your IP address and basic browser and device information, which our servers record for security, fraud prevention and to keep the site working.

We do not currently use third-party advertising or analytics trackers on the website. If that changes, we will update this policy first.

• To process, pack, ship and deliver your orders, and send you order and tracking updates (including on WhatsApp).
• To handle returns, replacements, cancellations and refunds.
• To provide customer support and reply to your messages.
• To run your account, sign you in securely and keep your account safe.
• To prevent fraud and abuse of the website.
• To keep the invoices and records we are required to keep by law, including tax records.
• To send you offers and updates, where you have signed up for them. You can unsubscribe at any time using the link in the message or by writing to us.

We do not sell your personal data. We share it only with service providers who help us run the store, and only what they need for their task:

• Payments: Razorpay and Shiprocket Checkout, together with the payment gateways they use.
• Shipping: Shiprocket and its courier partners, who receive your name, address and phone number to deliver your order.
• Hosting and infrastructure: Hostinger (website hosting), MongoDB Atlas (account and order database), Upstash (security and rate limiting) and Cloudinary (images).
• Email: Resend, to send sign-in codes, order confirmations and other emails.
• WhatsApp (Meta): when you message us or we send you order updates on WhatsApp.

We may also disclose data where required by law, a court order or a government authority, or to protect the rights and safety of ZIVAYU and our customers.

Some of these providers may process data on servers outside India. Where they do, we rely on their contractual and security commitments to protect it.

We use only what the website needs to work:

• Sign-in cookies: keep you signed in (a short-lived session cookie and a longer-lived one of up to 30 days, unless you sign out). They are protected and cannot be read by scripts on the page.
• Local storage in your browser: remembers your cart and simple preferences on your device.

We do not use advertising cookies. You can clear cookies and site data from your browser settings at any time.

• Account details: while your account is active, or until you ask us to delete it.
• Orders and invoices: for as long as tax and accounting laws require us to keep them.
• Sign-in codes: only for the few minutes they are valid.
• Security and technical logs: for a limited period, typically up to 90 days.
• Offer sign-ups: until you unsubscribe.

Subject to applicable law, you can:

• Ask for a summary of the personal data we hold about you and how it is used.
• Ask us to correct or update inaccurate data. You can manage your saved addresses yourself in your account.
• Ask us to delete your data, unless we must keep it by law (for example, invoices).
• Withdraw consent you have given, for example to marketing messages.
• Nominate a person to exercise these rights on your behalf in case of death or incapacity.
• Raise a grievance with us, and if it is not resolved, with the Data Protection Board of India.

To make a request, email care@zivayu.com from your registered email address. We may need to verify your identity before acting on it.

• All traffic to the website is encrypted (HTTPS).
• Passwords are stored only as secure hashes; we never see them.
• Sign-in cookies are protected from access by page scripts.
• Sign-in and other sensitive actions are rate-limited to stop abuse.
• Staff access to customer data is limited by role and logged.

No system is perfectly secure. Please use a strong, unique password and tell us promptly if you suspect misuse of your account.

Our products and website are meant for adults. We do not knowingly collect personal data from anyone under 18 without verifiable parental consent. If you believe a child has shared data with us, contact us and we will delete it.

We may update this policy when our services or the law change. The “last updated” date at the top always shows the current version. For significant changes, we will also put a notice on the website.

For any question, request or complaint about your personal data, contact our Grievance Officer:

We acknowledge grievances within 48 hours and aim to resolve them within one month.