What personal data Kaniwa collects, why we collect it, who we share it with, how long we keep it, and the rights you have over it.
Kaniwa is an online store selling imitation jewellery to customers in India, operating at https://kaniwa.in. This policy explains how we handle personal data for that store. It covers this website and the order, delivery and support email we send you.
For any question about this policy, or to exercise any right described in it, write to shop@kaniwa.in.
Account details you give us: your name, email address, phone number, and the delivery addresses you choose to save.
Order data: the items you bought, the amount paid, the delivery address used, and the status of payment, shipping, and any return or refund.
Payment data: we do not collect or store your card number, CVV, UPI PIN or bank credentials. Payment is completed on our payment gateway. They return to us only the outcome of the transaction, a reference number, and the type and last digits of the instrument used.
Support data: the contents of support tickets you open and our replies, so we can resolve them and keep a record.
Technical data: your IP address, browser and device type, and cookies needed to keep you signed in and to remember your basket.
If you choose "Continue with Google", Google sends us your name, your email address, your profile picture, and an identifier for your Google account. We request no other permissions and receive nothing else: not your contacts, not your calendar, not your Google password.
We use that information for one purpose only: to create your Kaniwa account and sign you in, so you can place orders and see your order history.
We do not use it for advertising, we do not sell it, and we do not share it with anyone beyond the service providers listed below who help us run the store.
Kaniwa's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
We keep it for as long as your account exists. You can disconnect Kaniwa at any time from your Google account permissions page at https://myaccount.google.com/permissions, and you can ask us to delete the account itself as described under "Your rights" below.
To take payment for an order, deliver it, and keep you informed of its progress. This is necessary to perform the contract you enter into when you place an order.
To provide customer support, handle returns, and process refunds.
To detect and prevent fraud and abuse of the store.
To meet our obligations under Indian tax, accounting and consumer-protection law, which require us to keep records of what was sold and to whom.
Our payment gateway, to charge you and to issue refunds. They receive the order amount, a reference, and your contact details.
Our logistics partners, including courier aggregators and India Post, to deliver your parcel. They receive your name, delivery address and phone number, because a parcel cannot be delivered without them.
Our email provider, to send order confirmations, delivery updates, password resets and support replies. They receive your email address and the content of the message.
Our hosting and infrastructure providers, who operate the servers this store runs on.
Government authorities, where we are legally required to disclose information.
We do not sell your personal data, and we do not share it with advertisers or data brokers.
The site is served only over HTTPS, so traffic between you and us is encrypted in transit.
Passwords are stored as bcrypt hashes and never in readable form. We cannot see your password, and neither could anyone who obtained a copy of our database.
Third-party API keys and administrative credentials are encrypted at rest, and staff accounts require a second factor sent by email in addition to a password.
Access to customer data is limited to the people who need it to run the store, and administrative actions are recorded in an audit log.
Order and invoice records: retained for the period Indian tax and accounting law requires. We cannot delete these earlier, even at your request.
Account details and saved addresses: kept while your account is open, and removed within 30 days of you asking us to close it, except where they form part of a retained order record.
Support tickets: kept for three years after they are closed.
Technical logs: kept for up to 90 days.
You can see and correct your name, phone number and saved addresses at any time from your account page.
You can ask us for a copy of the personal data we hold about you, ask us to correct anything inaccurate, or ask us to delete your account. Write to shop@kaniwa.in and we will respond within 30 days.
You can withdraw consent to marketing email at any time using the unsubscribe link in any such message. That does not stop transactional email about an order you have already placed, which we must send in order to fulfil it.
Where the law requires us to keep certain records even after you ask for deletion, we will tell you which records and why.
We use only cookies that are strictly necessary to operate the store: a session cookie that keeps you signed in, and an identifier that keeps your basket together before you sign in.
We do not use advertising or cross-site tracking cookies.
Kaniwa is not intended for children under 18, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, write to shop@kaniwa.in and we will delete it.
If we change this policy we will update this page. Where a change materially affects how we use your data, we will tell you by email before it takes effect.
Privacy and data-protection queries: shop@kaniwa.in.
Grievance Officer: complaints about this site or about your personal data may be sent to shop@kaniwa.in. We will acknowledge within 24 hours and aim to resolve within 15 days, as required by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.