Privacy Policy

1. Information We Collect

We collect information strictly necessary to provide an authentic, high-speed, and secure e-commerce shopping experience:

• Customer Contact & Identification: Name, email address, and mobile phone number for order updates and automated verification.
• Delivery & Tax Addresses: Physical delivery address, landmark, PIN code, and optional corporate GSTIN for statutory B2B tax invoice generation.
• Transaction Identifiers: Merchant transaction reference numbers (razorpay_order_id, razorpay_payment_id, payment method, and settlement timestamps).
• Device & Session Telemetry: IP addresses, browser agents, and security session cookies collected by our Vercel Edge infrastructure to mitigate bot scalping and fraudulent transactions.

2. How Your Data Is Utilized

Your personal data is utilized solely for:

• Dispatching authentic items and generating official GST-compliant tax invoices.
• Booking parcel consignments, generating Air Waybills (AWBs), and enabling door-to-door courier tracking via NimbusPost multi-carrier logistics network (Delhivery, Bluedart, Xpressbees, Shadowfax, DTDC).
• Delivering automated transactional milestone notifications via WhatsApp, SMS, or email (order confirmation, dispatch, out for delivery).
• Validating phone numbers and delivery pincodes to minimize Return-to-Origin (RTO) overhead.

3. Data Storage & Encryption Infrastructure

Customer records are stored securely in dedicated PostgreSQL databases hosted in the AWS Mumbai (ap-south-1) region. All communication between your device and our platform is encrypted via TLS 1.3 / 256-bit HTTPS encryption. Database tables employ Row-Level Security (RLS) policies to prevent unauthorized data cross-contamination.

4. Third-Party Disclosures

We do not sell, trade, or monetize your personal information to marketing brokers. Data is shared exclusively with verified operational partners:

• Razorpay Software Private Limited: Payment processing and instant refund disbursement.
• NimbusPost Technologies: Pan-India multi-carrier freight dispatch, automated AWB generation, and delivery tracking.
• Indian Statutory Authorities: When legally required under applicable Indian laws, tax regulations, or judicial summons.

5. Cookies, Ad Tracking & Performance Marketing Technologies

In compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and global ad privacy standards, EZPICK uses cookies, local storage, and server-side tracking APIs for functional, analytics, and advertising purposes:

• Strictly Necessary Cookies & Storage: Required for core site operations, including maintaining your secure shopping bag, user session tokens, and CSRF protection. These cannot be disabled.
• Functional & Wishlist Storage: Retains your curated Wishlist items and recently viewed pieces locally on your device across visits without requiring an immediate account login.
• Performance Marketing & Retargeting (Meta Pixel, Google Ads & Server-Side CAPI): We utilize client-side tags and privacy-first Server-Side Conversions APIs (Meta CAPI & Google Ads API) to deliver personalized ads on Instagram, Facebook, and Google Shopping. When you browse, add an item to your wishlist, or abandon a cart, anonymized, cryptographically hashed event data (SHA-256) is shared with ad networks to display relevant editorial recommendations.
• User Choice & Opt-Out: You have full control over non-essential tracking cookies via our interactive on-site Cookie Consent banner. You can update your cookie preferences or clear tracking storage at any time directly through your web browser settings.

6. Your Rights Under DPDP Act 2023

Under Indian data privacy regulations, you retain the right to review, update, or request the deletion of your personal account data stored with EZPICK. To submit a data erasure or access request, please contact our designated Grievance Officer below.