Privacy Policy
This Privacy Policy explains how Rooteat ("we", "us", "our") collects, uses, shares, stores and protects your personal data when you visit rooteat.in (the "Website") or buy our products. We follow the Digital Personal Data Protection Act, 2023 (DPDP Act), the rules made under it, and the Information Technology Act, 2000.
By using the Website and giving your consent where we ask for it, you agree to this Policy. If you do not agree, please do not use the Website.
1. Who we are
Rooteat is operated by Ajay Sonkar (proprietor), [REGISTERED ADDRESS], India. For the DPDP Act, we are the "Data Fiduciary" for the personal data described here.
- Email: support@rooteat.in
- Phone: +91 83199 28445
2. Personal data we collect
a) Data you give us
- Name, mobile number, email address
- Shipping address and pincode
- One-time password (OTP) verification of your mobile number when you check out or log in
- Product reviews and any photos you choose to upload with a review
- Messages you send to our support team, and our replies
b) Data created when you use the Website
- Order details, order status and shipment tracking details
- Device and usage data: IP address, browser, device type, pages viewed, clicks and approximate location, collected through cookies and similar tools (only after your consent, see Section 6)
- Security and audit logs: records of key actions on the Website (for example login attempts, orders, payments, errors) to detect fraud, abuse and technical faults
c) Data we do not collect
- We do not ask for or collect your health information, medical conditions or symptoms.
- We do not store your card, UPI or bank details. Payments are handled by our payment partner (see Section 5).
3. Why we use your data
| Purpose | Basis |
|---|---|
| Verify your phone number, create your order, process payment, ship and deliver your product | Your consent and performing your purchase |
| Send order confirmations, shipping updates and delivery messages by WhatsApp, SMS or email | Your consent and performing your purchase |
| Customer support, returns, refunds and complaints | Your consent and legitimate use |
| Ask you to review a product after delivery and show your review | Your consent |
| Send promotional offers by WhatsApp or email | Your consent (you can withdraw anytime) |
| Analytics to improve the Website; advertising and measuring ads | Your consent through the cookie banner |
| Prevent fraud, secure the Website, fix errors | Legitimate use permitted by law |
| Keep records for tax, accounting and other legal duties | Legal obligation |
4. Consent
- We ask for your consent in clear language before we collect or use your data for the purposes above. Cookies for analytics and marketing stay off until you click "Agree".
- You can withdraw consent at any time by emailing support@rooteat.in, or by changing your cookie choices on the Website. Withdrawing is as easy as giving consent. It does not affect what we did lawfully before you withdrew. If you withdraw consent needed to complete an order, we may not be able to complete it.
- You can stop promotional messages at any time by replying STOP or emailing us. We will still send necessary order messages.
5. Who we share data with
We do not sell your personal data. We share it only with service providers who process it for us, and only what they need:
| Provider | Purpose |
|---|---|
| Cashfree Payments | Payment processing |
| Shiprocket and its courier partners | Shipping, delivery and tracking (name, phone, address) |
| Neon | Database hosting |
| Vercel | Website hosting |
| PostHog | Website analytics (with consent) |
| Sentry | Error monitoring |
| Meta (WhatsApp Business API, Meta Pixel / Conversions API) | WhatsApp messages; ad measurement and retargeting (marketing, with consent) |
| Zoho ZeptoMail | Sending emails |
We may also disclose data to government authorities, courts or law enforcement when the law requires, or to protect our rights, users or the public from fraud or harm. If our business is ever sold or merged, your data may be transferred to the new owner, who must follow this Policy.
Each provider has its own privacy policy for data it handles under its own responsibility, for example Meta for advertising.
6. Cookies and similar technologies
- Essential: needed for the Website to work (cart, checkout, login, security). These do not need consent.
- Analytics: help us understand how the Website is used (PostHog). Run only after you click "Agree".
- Marketing: used for ads and retargeting (Meta Pixel). Run only after you click "Agree".
You can change or withdraw your cookie choice at any time using the cookie settings link on the Website or by clearing cookies in your browser.
7. Transfer of data outside India
Some of our providers store or process data on servers outside India, including Neon (database), PostHog and Sentry. Meta processes data in its own global infrastructure. We transfer data only to providers that use security safeguards, and only to countries not restricted by the Government of India under the DPDP Act.
8. How long we keep your data
We keep personal data only as long as needed for the purposes in Section 3, and as long as the law requires us to (for example tax, accounting and consumer-protection records). When data is no longer needed or legally required, we delete it or make it anonymous. If you ask us to delete your data, we will do so except for data we must keep by law, which we will keep only for that required period and for no other use.
9. Reviews and public content
After your order is delivered, we may ask you to review the product. Reviews, and any photos you add, may be shown publicly on the Website, usually with your first name. Do not include sensitive information in a review. You can ask us to edit or remove your review at any time.
10. Security
We use reasonable security measures, including encrypted connections (HTTPS), access controls, OTP-based login, and activity logging. No system is completely secure. If a personal data breach affects you, we will inform you and the Data Protection Board of India as the law requires.
11. Your rights under the DPDP Act
You have the right to:
- Access: get a summary of the personal data we hold about you and who we have shared it with
- Correction and updating: correct inaccurate or incomplete data
- Erasure: ask us to delete your data, subject to legal retention duties
- Withdraw consent at any time
- Grievance redressal: complain to us about how we handle your data
- Nominate another person to exercise your rights if you die or become unable to do so
To use any right, email support@rooteat.in from the email address linked to your order, or contact us from your registered mobile number. We may verify your identity first. We aim to respond within 30 days.
Your duties: give accurate information, do not impersonate anyone, and do not file false or frivolous complaints.
12. Children
Our products and Website are for people aged 18 and above. We do not knowingly collect personal data of anyone under 18. If you think a child has given us data, email us and we will delete it.
13. Grievance Officer
Grievance Officer, Rooteat
Email: support@rooteat.in
Phone: +91 83199 28445
Address: [REGISTERED ADDRESS]
We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India as provided under the DPDP Act.
14. Third-party links
The Website may link to other websites. We are not responsible for their privacy practices. Please read their policies.
15. Changes to this Policy
We may update this Policy from time to time. The latest version will always be on this page with its updated date. If we make a material change, we will ask for your consent again where the law requires.
16. Contact
Questions about this Policy: support@rooteat.in or +91 83199 28445.