What we hold
We ask for only what an order needs
This page sets out what we collect, why we need it, who sees it, and how long we keep it.
What we collect, why, and what we never do with it.
Last updated: 18 October 2026 · This policy covers graceyes.in, operated by GraceYes Organics Pvt. Ltd., Amigo, Sector 8, Noida 201301, Uttar Pradesh, India. It is written to comply with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the Digital Personal Data Protection Act, 2023.
1. What we collect
- To fulfil an order: your name, delivery address, phone number, email, and what you bought. Without these we cannot ship to you.
- Payment: handled by our payment partner on their secure pages. We receive a confirmation and a transaction reference; we never see or store your card number, CVV or UPI PIN.
- Account: if you create one, your login email, password (stored hashed), order history, saved addresses and wishlist.
- Messages: anything you write to us by email, WhatsApp or the contact page, so we can answer and keep a record of your order's history.
- Newsletter: your email, only if you subscribe. Every mail has an unsubscribe link.
- Usage data: pages visited, device and browser type, approximate location from your IP address, and the referring site, through cookies and analytics tools described below.
2. Why we use it
To process and deliver orders, send order and delivery updates (by email, SMS or WhatsApp), answer your questions, handle returns and refunds, prevent fraud, meet our tax and legal obligations, understand which pages and products work so we can improve the shop, and, only if you opt in, send our newsletter.
3. Who we share it with
Only the partners needed to serve you: our courier and shipping aggregator (name, address, phone, parcel contents), our payment gateway (transaction details), our accounting and invoicing system, our email and messaging providers, and analytics providers. Each receives only what it needs for its job and is bound to keep it confidential. We do not sell, rent or trade your personal data to anyone, ever. We disclose data to authorities only when the law requires it.
4. Cookies and analytics
Some cookies keep your bag, your login and the checkout working. Those are strictly necessary and are always on.
We also use two measuring tools: Google Analytics 4 to count visits and see which pages and products work, and Microsoft Clarity (Microsoft Corporation), which builds heatmaps and records how pages are used so we can find what is broken. Both are on when you visit, and you can switch them off at any time (see below). Clarity is set to mask the text you type, so what you enter in a form — your name, address, phone number — is not recorded, and we never capture card or payment details.
If you shop as a guest, these recordings are anonymous. If you are signed in to your GraceYes account, we link your Clarity sessions to your account, so we can see where a returning customer got stuck and fix it. For that we send Clarity your customer number, which is scrambled (hashed) in your browser before it leaves your device, and your first name as a label we can read. Once you have signed in on a browser, later visits from that same browser are linked to your account too, until you clear its stored data. We never send your email, phone number or address to Clarity. We also note simple facts about each visit, such as the type of page you were on and whether something was added to your bag. We do not use any of this for advertising, and we do not sell or trade it.
To switch measuring off, tap Cookie settings at the foot of any page and choose Only essential. Recording stops straight away, and nothing that measures you loads on later pages. You can turn it back on the same way, or clear cookies in your browser; the shop will still work, though your bag may empty.
5. How long we keep it
Order records are kept for 8 years, as required for tax and accounting. Account data is kept while your account is active and deleted on request. Newsletter data is deleted when you unsubscribe. Message threads are kept for 2 years after the last message, or longer if a dispute is open.
6. Security
The website is served over HTTPS. Access to customer data inside the company is limited to the people who fulfil orders and answer you. Passwords are stored hashed. No system is perfectly secure, so if we ever learn of a breach affecting your data we will tell you and the authorities as the law requires.
7. Your rights
You may ask us at any time to show you the personal data we hold about you, correct it, delete it (where we are not required to keep it), or stop using it for marketing. Write to wecare@graceyes.in; we answer within 7 working days. If you are not satisfied, you may escalate to our Grievance Officer (see Grievance Redressal) and, thereafter, to the Data Protection Board of India.
8. Children
The website is for adults. We do not knowingly collect data from anyone under 18; if a parent tells us we have, we delete it.
9. Links to other sites
Product pages may link to published research or to our social profiles. Those sites have their own policies; we are not responsible for them.
10. Changes
We will post any change here with a new date at the top, and email account holders about material changes.
Contact
Grievance Officer / Data queries: Amit Kumar, GraceYes Organics Pvt. Ltd., Amigo, Sector 8, Noida 201301, Uttar Pradesh, India · wecare@graceyes.in · +91 85911 02704.