Privacy policy.
Who we are
Kartik Yadav, sole proprietor, trading as Kaffgum.
43 Krishna Enclave, Sipri Bazar, Jhansi, Uttar Pradesh 284003, India.
GSTIN 09BWMPY6449Q1Z1 · team@kaffgum.com · +91 78870 67070
These details are published as required by Rule 4(5) of the Consumer Protection (E-Commerce) Rules, 2020.
What we collect, and why
To create an account: your name, email address and a password. The password is stored only as a bcrypt hash — we cannot read it, and nobody who obtained our database could recover it. If you sign in with Google instead, we never see a password at all.
To fulfil an order: your name, email, phone number and full delivery address. We keep the items, quantities and amount so we can answer questions about the order later.
To take payment: Razorpay collects your card, UPI or netbanking details directly. Those never reach our servers — we receive only whether the payment succeeded and a reference for it. A cash-on-delivery order collects no payment details at all.
To check it is really you: before your first order we verify either your email or your phone. Email verification sends a six-digit code to your address. Phone verification asks you to send that code to our WhatsApp number from your own handset, which means Meta, who run WhatsApp, see your number and that message — as they would for any message you send us there. Either way the code is held for minutes, not days.
Automatically: your cart lives in your own browser under kaffgum_cart_v2. While you are signed in we also keep a copy against your account, so the same cart follows you to another device; signed out, it never leaves your browser until you check out. We use two strictly necessary cookies to keep you signed in. We record the IP address of sign-in, contact and checkout requests and count them over a short window, so one machine cannot hammer them — that is all it is for, and we build no profile from it. We measure page speed through Vercel Speed Insights, which is cookieless and does not identify you.
We do not run advertising pixels, and we do not track you across other websites.
What we keep when you exercise a choice
Consent records. When you tick or untick something — marketing email, the measurement banner, the checkout map — we store that decision on its own: which purpose, whether you said yes or no, where you were asked, which version of this notice was on screen, the time, and your IP address and browser string. The Act requires us to be able to show consent was given, and a tick with no record of what it was against proves nothing. Withdrawing is stored the same way, as a new record rather than by deleting the old one.
Data-rights requests. If you use the request form we keep the address you gave, what you asked for, anything you added, and how it was resolved — so we can answer you, and show we did.
Who else handles it
We never sell your personal data. These processors handle it on our instructions only:
- Vercel — hosts the site and our servers, and keeps short-lived request logs (United States and global edge).
- Supabase — our database, hosted in Tokyo, Japan.
- Razorpay — card, UPI and netbanking payments (India).
- Brevo — sends your order confirmations and your email verification codes.
- Google — every order is copied into a private Google Sheet that we keep as our sales book. That row carries your name, email, phone, delivery address, what you ordered and the payment reference. Only we can open it.
- Meta — only if you choose to verify by phone, because that is a WhatsApp message you send us.
- Emergent — checks your Google sign-in, and carries email if Brevo is unavailable.
- OpenStreetMap — only on the checkout map, and only if you allow it. Searching for an address sends what you type, and your IP address, to their servers so they can return matching places. The map tiles come from them too. Decline and the map does not load; you can still type the address yourself.
- unpkg — serves the mapping library used above, so it sees your IP address when that map loads. Same condition: it loads only if you allow the map.
Section 16 of the DPDP Act permits transfer to any country the Government has not restricted. None of the countries these processors work from — India, Japan and the United States — is restricted.
How long we keep it
Order and invoice records are kept for eight financial years, because the CGST Act and the Income-tax Rules require it — these cannot be deleted on request, and the matching row in the sales book above is kept for the same eight years for the same reason. Account details are kept until you close your account. Support messages are kept for three years. Verification codes expire within minutes and the rate-limit counters within the hour. Everything else is deleted once its purpose has ended.
Your choices, right here
These are the optional ones. Nothing below is needed to sign in, keep a cart or place an order, and changing them takes effect immediately.
Marketing email is asked separately, unticked, wherever we ask for an address. To stop it, use the request form and choose “withdraw a consent”.
Your rights
Under the DPDP Act you may ask us, free of charge, to: give you a summary of the data we hold and who we have shared it with (s.11); correct, complete, update or erase it (s.12); withdraw consent where we rely on it (s.6); or nominate someone to exercise these rights if you die or become incapacitated (s.14).
Use the data rights request form, or write to team@kaffgum.com. Either way we respond within 30 days. We will ask you to confirm who you are before acting, because anyone can type an address into a form. Exercising a right never affects your access to the site or an order in progress.
Erasure has one extra step. You must be signed in as the address being erased, and the request is only carried out for that account. Deleting is not undoable and an email address on a form proves nothing, so we will not act on it: signing in shows you control the mailbox, which is what stops somebody erasing your data by typing your address into our form. If you cannot sign in, reset your password first, or write to the grievance contact below and we will verify you another way.
Every other request — a copy of your data, a correction, withdrawing a consent, naming someone to act for you — can be made without signing in, because the people who most need them are often the ones who cannot get in.
One limit, stated plainly: order and invoice records are kept eight financial years because the CGST Act and the Income-tax Rules require it, so those cannot be erased on request. Everything else can.
Complaints
Grievance Officer: Kartik Yadav, Proprietor —team@kaffgum.com, +91 78870 67070, at the address above. We acknowledge every complaint within 48 hours and resolve it within 30 days.
If we do not resolve it, you may complain to the Data Protection Board of India. You do not need a lawyer or our permission.
Under 18s
Kaffgum contains caffeine and is not for anyone under 18, who the DPDP Act treats as a child. We do not knowingly collect their data and we never advertise to them. If you believe we hold a child’s data, write to us and we will delete it immediately.
Security, and if it fails
Traffic is encrypted in transit, passwords are hashed, card details never reach us, and access to customer records is limited to those who need it. If your data is ever exposed we will tell you directly and notify the Data Protection Board, as the DPDP Rules require.
Changes
We will update the date at the top when this changes. If a change materially affects your rights we will tell you by email rather than rely on you re-reading this page.