Privacy Policy

1. Who is responsible for your data

Girly Talk is the data fiduciary for the personal data described here — meaning we decide why and how it is processed. We can be reached at hello@girlytalk.in, 7879439920, or House No 71, Ward no: 11 Dak Bangla, Sunser MP.

We handle personal data in line with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and the rules made under it.

2. What we collect

Information you give us

• Account: your name, email address and a password (stored only as a one-way hash, never in readable form).
• Orders: delivery and billing address, phone number, and the contents and value of your order.
• Payment declaration: the fact that you tapped “I have paid”, the time you did so, and the UTR / transaction reference if you choose to enter one.
• Correspondence: messages you send through the contact form, reviews you post, and your email address if you subscribe to our newsletter.

Information collected automatically

• A secure, http-only session cookie that keeps you signed in.
• Standard technical data our hosting provider records for every visit — IP address, browser type, pages requested and timestamps — used for security and to keep the site running.

Information from our bank

• When we check that your payment arrived, we see what our bank statement shows: the amount, the date and time, the reference number, and the payer name or UPI ID the transfer came from. We record what we need to match the payment to your order and to satisfy our tax and accounting obligations.

3. What we never collect

4. Why we use it, and on what basis

We process your data only for these purposes:

• To perform your order — accepting it, verifying payment, issuing an invoice, arranging delivery, handling cancellations and refunds, and providing support.
• To keep accounts and records — invoices and payment records are retained because tax and company law require it.
• To prevent fraud and abuse — including detecting false payment claims and protecting other customers.
• To communicate with you — order updates and replies to your messages. These are service messages, not marketing.
• Marketing, only with your consent — we send the newsletter only to people who signed up, and every edition has an unsubscribe option.

Where we rely on your consent — the newsletter, and optional fields such as the UTR reference — you can withdraw it at any time. Withdrawing consent does not affect processing already carried out, and it does not affect data we must keep for legal reasons.

5. Who we share it with

We do not sell, rent or trade your personal data. We share it only with parties who help us run the store, and only with what they need:

• Courier partners — your name, delivery address and phone number, so your order can be delivered.
• Hosting, database and file-storage providers — who store the site's data on our behalf under contract.
• Our bank — which processes the incoming payment and any refund we send you.
• Authorities — where we are legally required to disclose data, or where it is needed to establish or defend a legal claim.

Some of these providers store data on servers outside India. Where that happens, transfers are made in accordance with applicable Indian law.

6. Cookies

We use a small number of cookies. The essential one is your authentication cookie: it is http-only, cannot be read by scripts, and exists only to keep you signed in and to protect your account. Your cart and wishlist may also be kept in your browser's local storage so they survive a page refresh.

You can clear or block cookies in your browser settings, but signing in and checking out will not work without the authentication cookie.

7. How long we keep it

• Order, invoice and payment records — retained for as long as Indian tax and accounting law requires, currently up to eight years from the end of the relevant financial year.
• Account data — kept while your account is open. If you ask us to delete your account we remove your profile and close it, keeping only the transaction records described above.
• Newsletter subscription — kept until you unsubscribe.
• Contact form messages — kept for as long as needed to resolve your query and to handle any follow-up.

8. How we protect it

• The whole site is served over HTTPS.
• Passwords are hashed with bcrypt; we cannot read them, and we can never tell you your password.
• Sessions use signed, http-only cookies rather than tokens exposed to page scripts.
• Order and customer records are reachable only through authenticated, role-checked admin routes.
• Because we take no card or UPI credentials, there is no such data on our systems to be exposed in the first place.

No system is perfectly secure, but if a breach ever affects your personal data we will notify you and the Data Protection Board as required by law.

9. Your rights

Under the Digital Personal Data Protection Act, 2023 you may ask us to:

• tell you what personal data of yours we hold and who we have shared it with;
• correct or complete anything that is inaccurate or out of date;
• erase data we no longer need for the purpose it was collected for;
• stop sending you marketing, or otherwise withdraw a consent you gave us; and
• nominate someone to exercise these rights on your behalf if you are unable to.

Write to hello@girlytalk.in and we will respond within a reasonable period. We may need to verify your identity first. You can also update most of your details yourself from your account page.

10. Children

Our store is not intended for children. We do not knowingly collect data from anyone under 18 without verifiable parental consent, and we do not use anyone's data for behavioural advertising or tracking directed at children. If you believe a child has given us data, contact us and we will delete it.

11. Other sites

Our pages may link to other sites — a courier's tracking page, or your UPI app. Those services have their own privacy policies and we are not responsible for how they handle your data.

12. Changes to this policy

We will update this page if our practices change — for example if we adopt a payment gateway, which would introduce a new processor. The date at the top always reflects the latest version.

13. Contact and grievances

For any privacy question, request or complaint, contact our Grievance Officer. This is the same contact point named in our Terms of Service.

We acknowledge complaints within 48 hours and aim to resolve them within one month. If you are not satisfied with our response, you may complain to the Data Protection Board of India.