Privacy Policy & Data Protection Notice

1. Data Fiduciary Identity & Contact Details

For the purposes of applicable data privacy legislation, the Data Fiduciary responsible for the processing of your personal information is:

2. Principles of Data Minimization & Purpose Limitation

In accordance with Section 4 of the DPDP Act 2023, SolBombay adheres strictly to the doctrine of Data Minimization and Purpose Limitation. We only collect the minimal personal data strictly necessary to fulfill your pastry orders, execute hand-delivery logistics across Mumbai, manage your customer profile, facilitate access to unlocked pastry masterclasses, prevent fraudulent promotional manipulation, and comply with statutory tax and food safety requirements.

We never sell, rent, trade, or monetize your personal data to third-party data brokers or unauthorized advertisers.

3. Categories of Personal Data We Collect

We may collect and process the following categories of information:

• Identity & Contact Information: Full Name, Email Address, 10-Digit Mobile / WhatsApp Telephone Number.
• Delivery & Logistics Details: Street Address, Suite / Apartment / Floor number, Landmark, City, State, and Postal Pincode (required for delivery of fragile, temperature-controlled bakery goods).
• Order & Transaction Records: Items purchased, custom cake specifications (flavors, tier counts, dietary notes like 100% Eggless, personalized cake inscriptions), order reference numbers (e.g. SB-XXXXXX), payment confirmation tokens, invoice timestamps, and coupon usage records.
• Account Authentication Data: Secure salted and cryptographically hashed passwords (using bcrypt algorithms), persistent session tokens, and account creation timestamps.
• Masterclass Subscription Records: Records of unlocked pastry tutorial masterclasses and ratio recipe cards bound to your registered customer ID.
• Promotional Telemetry & Anti-Fraud Fingerprinting: IP address, browser user-agent, timestamp, and hardware canvas device telemetry collected exclusively to enforce our strictly audited 1-spin-per-24-hour limit on the Spin & Win promotional wheel.
• Corporate & Bespoke Inquiries: Company name, designated contact person, estimated event quantity, custom branding requirements, and event dates submitted through our inquiry portals.

4. Purpose & Lawful Basis of Processing

Under the DPDP Act 2023 and global privacy frameworks, we process your personal data under the following lawful bases:

5. Payment Data Security (Zero Card Storage via Razorpay)

When you check out, payment processing occurs via Razorpay's encrypted checkout modal over an end-to-end 256-bit TLS/SSL encrypted bridge. Razorpay transmits only an encrypted transaction token, payment ID, and payment status back to SolBombay for order reconciliation.

6. Data Sharing & Third-Party Service Processors

We only share strictly necessary information with verified third-party service providers (Data Processors) under binding confidentiality and data protection agreements:

• Payment Gateway: Razorpay (for automated payment processing, refunds, and fraud prevention).
• Transactional Notifications: Secure SMTP & transactional messaging services (for dispatching order confirmation invoices, password resets, welcome emails, and verification codes).
• Logistics & Delivery Drivers: In-house and verified white-glove pastry delivery couriers (provided only with recipient name, delivery address, contact phone, and time slot instructions).
• Statutory Authorities: Law enforcement or regulatory authorities only when strictly required by applicable Indian law, court order, or formal legal process.

7. Data Security Architecture & Encryption Standards

We employ industry-leading technical, organizational, and physical security measures to safeguard your personal data against unauthorized access, alteration, disclosure, or destruction:

• 256-Bit SSL/TLS Transport Encryption: All data transmitted between your browser and our web servers is protected using modern end-to-end cryptographic transport protocols.
• Cryptographic Password Protection: User passwords are secured using salted, one-way cryptographic hashing algorithms. Raw passwords are never visible, retrievable, or stored in plaintext.
• Multi-Layered Application Defenses: Strict input sanitization, parameterized database access models, and context-aware output encoding to prevent unauthorized injection, script execution, or data tampering.
• Anti-Forgery Token Enforcement: Sensitive forms and actions utilize cryptographically strong Cross-Site Request Forgery tokens to prevent unauthorized transaction execution.
• Secure Session & Cookie Architecture: Session cookies utilize modern security attributes (including HttpOnly, SameSite, and Secure flags) and cryptographically verified tokens to prevent interception.
• Resilient Infrastructure: Continuous automated database backup protocols, fault-tolerant infrastructure, and proactive security monitoring.

8. Data Retention & Disposal Policies

We retain personal data only for as long as necessary to accomplish the purposes outlined in this policy:

• Active Customer Accounts: Retained for the duration of your account's existence to allow you to track past orders, reorder easily, and access purchased masterclasses.
• Tax & Accounting Transaction Invoices: Stored for 8 statutory financial years in compliance with the Indian Goods and Services Tax (GST) Act, 2017, and the Companies Act, 2013.
• Promotional Spin Records & OTP Logs: Temporary verification tokens expire within 10 minutes. Daily spin timestamps are archived for anti-abuse audits.
• Data Erasure: Upon verified request for account deletion (where not required for active legal or tax obligations), your personal data is permanently deleted or irreversibly anonymized.

9. Your Statutory Rights as a Data Principal

Under Chapter III of India's DPDP Act 2023 and applicable privacy legislation, you possess the following actionable rights regarding your personal data:

To exercise any of these rights, simply email our dedicated support desk at support@solbombay.com with the subject line "Data Principal Rights Request". We will verify your identity and respond within 30 calendar days.

10. Cookies, Web Storage & Telemetry

Our website uses cookies and local browser storage to maintain session states, preserve your shopping bag items, remember your login preference, and store your cookie consent choice. For comprehensive details on every cookie we deploy and instructions on managing browser settings, please review our standalone Cookie Policy.

You can modify your cookie preferences at any time by clicking the Cookie Preferences link located in the footer of every page.

11. Children's Privacy (Under 18 Years)

In strict compliance with Section 9 of the DPDP Act 2023, SolBombay does not knowingly collect personal data from or target online retail transactions directly to individuals under 18 years of age without verifiable parental or guardian consent. If we discover that personal data of a minor has been collected without requisite parental authorization, we will take prompt steps to delete such records from our databases.

12. Grievance Redressal Officer & Dispute Resolution

In accordance with the Information Technology Act, 2000, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the DPDP Act 2023, the contact details of our designated Grievance Redressal Officer are published below:

13. Policy Amendments & Notifications

SolBombay reserves the right to amend or update this Privacy Policy periodically to reflect evolving legal frameworks, technological enhancements, or operational revisions. The latest version will always be published on this page with an updated "Last Updated" timestamp. For material modifications, prominent notices will be displayed on our website header or dispatched via email.

For any questions regarding this policy, please reach our support team at support@solbombay.com.