Privacy policy.
The short version
- We collect what it takes to sign you in, deliver your order and answer your messages. Nothing else is required.
- Card, UPI and bank details go to Razorpay and never reach us.
- We never sell your data. We run no advertising pixels and do not track you across other websites.
- Our only cookies keep you signed in. Anything optional stays off until you switch it on, and you can switch it off again on this page.
- Ask for a copy, a correction or a deletion at team@kaffgum.com. We reply within 30 days.
Who we are
Kartik Yadav, sole proprietor, trading as Kaffgum.
43 Krishna Enclave, Sipri Bazar, Jhansi, Uttar Pradesh 284003, India.
GSTIN 09BWMPY6449Q1Z1 · team@kaffgum.com · +91 78870 67070
These details are published as Rule 4(2) of the Consumer Protection (E-Commerce) Rules, 2020 requires. The same person answers any question about how we handle your data.
What we collect, and why
Your account: your name, email address and a password, so you can sign in and see your orders, and a record that you confirmed you are 18 or over. The password is stored only as a bcrypt hash — we cannot read it, and nobody who obtained our database could recover it. If you sign in with Google instead, Google gives us your name, email address and an account identifier, and we never see a password at all.
Your order: your name, email, phone number and full delivery address, plus a map pin if you choose to drop one, so the courier can find you. We keep the items, quantities, amount and payment reference so we can answer questions about the order later, and the time you confirmed you are 18 or over.
Payment: Razorpay collects your card, UPI or netbanking details directly. Those never reach our servers — we receive only whether the payment succeeded and a reference for it. A cash-on-delivery order collects no payment details at all.
Checking it is really you: before your first order we verify either your email or your phone. Email verification sends a six-digit code to your address. Phone verification asks you to send that code to our WhatsApp number from your own handset, which means Meta, who run WhatsApp, see your number and that message — as they would for any message you send us there. Either way the code is held for minutes, not days.
Your messages: the name, email address and message you send through the contact form or by email, so we can reply.
Keeping the site safe: we record the IP address of sign-in, contact and checkout requests and count them over a short window, so one machine cannot hammer them. That is all it is for, and we build no profile from it.
Why the law allows this: everything above is information you give us to get something done — an account, an order, a reply — and the DPDP Act lets us use it for that purpose (section 7(a)) and for nothing else. Keeping order and invoice records afterwards is required by tax law. Marketing email, measurement and the checkout map rely on your consent instead, which is optional and can be withdrawn at any time.
Cookies and browser storage
We keep this to what the site needs to work. There are no advertising, analytics or cross-site tracking cookies on kaffgum.com.
Strictly necessary. These are part of the service you ask for, so they are not behind a switch. Blocking them in your browser stops sign-in or the cart from working, and nothing else.
access_token— cookie. Keeps you signed in. Page scripts cannot read it, it travels only over HTTPS and only ever to kaffgum.com. It expires seven days after your last visit and is deleted when you sign out.kaffgum_google_transaction— cookie, set only while you sign in with Google. It matches Google’s reply to the sign-in you started, so nobody else’s sign-in can be slipped into your browser. It expires after ten minutes.kaffgum_guest_cart_v3— browser storage, not a cookie. Holds your cart while you are signed out. It stays on your device until you sign in or check out.kaffgum_consent_v1— browser storage. Remembers the choices you make below, so we do not ask again.kaffgum_chunk_reload— storage for this tab only. Stops the page reloading in a loop after we publish an update, and is cleared when you close the tab.
Optional, and off until you say yes.
- Measurement — Vercel Speed Insights reports how fast our pages load. It sets no cookies and cannot identify you or follow you from page to page.
- Checkout map — pinning your address on a map uses OpenStreetMap. It is offered at checkout, and loads nothing until you choose it.
Other websites you choose to use. Razorpay’s payment window and Google’s sign-in page run on their own websites and may set their own cookies under their own policies. We cannot read those cookies.
Clearing this site’s data in your browser removes everything listed here.
What we keep when you exercise a choice
Consent records. When you tick or untick something — marketing email, measurement, the checkout map, the 18+ confirmation when you open an account — we store that decision on its own: which purpose, whether you said yes or no, where you were asked, which version of this notice was on screen, the time, and your IP address and browser string. The Act requires us to be able to show consent was given, and a tick with no record of what it was against proves nothing. Withdrawing is stored the same way, as a new record rather than by deleting the old one.
Data-rights requests. If you use the request form we keep the address you gave, what you asked for, anything you added, and how it was resolved — so we can answer you, and show we did.
Who else handles it
We never sell your personal data. These processors handle it on our instructions only:
- Vercel — hosts the site and our servers, and keeps short-lived request logs (United States and global edge).
- Supabase — our database, hosted in Tokyo, Japan.
- Razorpay — card, UPI and netbanking payments, and refunds (India).
- Our courier — receives your name, phone number and delivery address, and only to deliver the parcel or collect a return.
- Brevo — sends your order confirmations and your email verification codes.
- Google — every order is copied into a private Google Sheet that we keep as our sales book. That row carries your name, email, phone, delivery address, what you ordered and the payment reference. Only we can open it.
- Google sign-in — if you choose it, Google confirms your identity to us directly. Your account itself stays in our Supabase database.
- Meta — only if you choose to verify by phone, because that is a WhatsApp message you send us.
- GoDaddy or Emergent — fallback routes for the same emails, used only if Brevo is not set up.
- OpenStreetMap — only for the checkout map, and only if you choose it. Searching for an address sends what you type, and your IP address, to their servers so they can return matching places, and the map tiles come from them too. Decline and nothing is sent; you type the address yourself.
- unpkg — serves the mapping library used above, so it sees your IP address when the map loads. Same condition: only if you choose the map.
Section 16 of the DPDP Act permits transfer to any country the Government has not restricted. None of the countries these processors work from — India, Japan and the United States — is restricted.
How long we keep it
- Orders and invoices: eight financial years, because the CGST Act and the Income-tax Rules require it. The matching row in the sales book above is kept for the same reason. These cannot be erased on request.
- Your account: until you close it.
- Support messages: three years.
- Verification codes and rate-limit counters: minutes for the codes, under an hour for the counters.
- From 13 May 2027: the DPDP Rules require every business to keep a record of its processing — the personal data, traffic data and logs involved — for at least one year after it happens, so it can be produced if an authority lawfully asks for it. We will keep that record for that purpose only, even if you close your account in the meantime, and delete it after the year unless another law requires longer.
- Everything else: deleted once its purpose has ended.
Your choices, right here
These are the optional ones. Nothing below is needed to sign in, keep a cart or place an order, and changing them takes effect immediately.
Marketing email is asked separately, unticked, wherever we ask for an address. Every marketing email we send says why you are getting it, carries our postal address and ends with an unsubscribe link that works in one click. You can also email team@kaffgum.com with the word “stop”, or use the request form and choose “withdraw a consent”. Withdrawing does not affect anything done before it, or an order already placed.
Your rights
Under the DPDP Act you may ask us, free of charge, to: give you a summary of the data we hold and who we have shared it with (s.11); correct, complete, update or erase it (s.12); withdraw consent where we rely on it (s.6); or nominate someone to exercise these rights if you die or become incapacitated (s.14).
Use the data rights request form, or write to team@kaffgum.com. Tell us the email address you use with us and, if it is about an order, the order number — that is how we find your data. We respond within 30 days. We will ask you to confirm who you are before acting, because anyone can type an address into a form. Exercising a right never affects your access to the site or an order in progress.
Erasure has one extra step. You must be signed in as the address being erased, and the request is only carried out for that account. Deleting is not undoable and an email address on a form proves nothing, so we will not act on it: signing in shows you control the mailbox, which is what stops somebody erasing your data by typing your address into our form. If you cannot sign in, reset your password first, or write to the grievance contact below and we will verify you another way.
Every other request — a copy of your data, a correction, withdrawing a consent, naming someone to act for you — can be made without signing in, because the people who most need them are often the ones who cannot get in.
The limits, stated plainly: order and invoice records are kept eight financial years because tax law requires it, and from 13 May 2027 the one-year processing record described above is kept for its year. Neither can be erased on request. Everything else can.
Complaints
Grievance Officer: Kartik Yadav, Proprietor — team@kaffgum.com, +91 78870 67070, 43 Krishna Enclave, Sipri Bazar, Jhansi, Uttar Pradesh 284003. We acknowledge every complaint within 48 hours and resolve it within 30 days.
If we do not resolve it, you may complain to the Data Protection Board of India. The Act asks you to try our grievance process first. You do not need a lawyer or our permission.
Under 18s
Kaffgum contains caffeine and is not for anyone under 18, who the DPDP Act treats as a child. We ask everyone who opens an account, and every order, to confirm they are 18 or over. We do not knowingly collect a child’s data and we never advertise to children. If you believe we hold a child’s data, write to us and we will delete it immediately.
Security, and if it fails
Traffic is encrypted in transit, passwords are hashed, card details never reach us, and access to customer records is limited to those who need it. If your data is ever exposed we will tell you directly and without delay — what happened, what it means for you and what you can do — and report it to the Data Protection Board within 72 hours, as the DPDP Rules require.
Changes
We will update the date at the top when this changes. If a change materially affects your rights we will tell you by email rather than rely on you re-reading this page. Earlier versions are available on request.