Privacy Notice

How [Registered business name] (trading as House of Saar, “we”) uses the personal data you give us when you register interest in The Diwali Edition 2026. This notice is meant to be read on its own — you shouldn’t need any other document to understand it.

Last updated 6 October 2026

Draft — awaiting legal review. Details in [square brackets] are placeholders.

Who we are#

[Registered business name] decides why and how your personal data is used for this site, which makes us the “Data Fiduciary” under India’s Digital Personal Data Protection Act, 2023. For anything about your data, contact our Grievance Officer:

Name: [Grievance Officer name], Grievance Officer
Email: grievance@example.com
Phone: +91 00000 00000
Post: [Registered business name], [Registered address, City, State, PIN]

What we collect and why#

Each item below is used only for the purposes listed next to it. We don’t use your data for anything else, and we don’t combine it with data from other sources.

Personal data we collect, what we use it for, and our legal basis
Data	What we use it for	Basis
Name	Addressing you when we write about the drop.	Your consent (s.6 DPDP Act), given with the required checkbox.
Email address	Telling you when the drop opens for orders and about any change to its dates or price. Future drops only if you opted in.	Your consent; your separate consent for future drops.
Phone number (optional)	A WhatsApp or SMS message when the drop opens, if you’d rather hear that way.	Your consent — leave it blank and we won't ask for it.
Number of boxes you'd like	Planning how many sets to make. It doesn't reserve anything.	Your consent.
Consent records	When you agreed to be contacted, and whether and when you opted into future drops — so we can show what you agreed to.	Required to show valid consent (s.6(10) DPDP Act).
Technical data	IP address to limit repeated submissions (our counter stores only a one-way hash of it), and browser signals for the bot check when it's switched on (Cloudflare Turnstile).	Keeping the list free of spam and the site secure.
Messages you send us	Answering questions, data requests and complaints.	Legitimate use — you choose to write to us.

What we don’t collect

No address, no payment details, no date of birth, no ID documents, no location and no data from social networks. You don’t need an account. We don’t run analytics on this site.

We never sell your personal data, share it for advertising, or let anyone use it for their own marketing. These service providers (“Data Processors”) handle it for us, under contracts that limit them to our instructions and require reasonable security:

Service providers that process personal data for us
Provider	What they do	Data	Where
Vercel Inc.	Website hosting	Everything you submit passes through Vercel's servers; request data such as IP address and browser type.	Global edge network; application servers in Mumbai (bom1)
Neon (Databricks, Inc.)	Database for the interest list	Name, email, phone, number of boxes wanted, consent choices and when you gave them.	[Region, e.g. Singapore (aws-ap-southeast-1) — confirm in the Neon dashboard]
[Your email provider, e.g. Google Workspace / Zoho Mail]	Emails about the drop	Name, email address and email content.	[Region]
Cloudflare, Inc. (Turnstile)	Bot check on the form, when switched on	IP address and browser signals, used only to tell people from bots.	Global network

We may also share data with courts, regulators or law-enforcement agencies when the law requires it.

Where your data is stored#

Some of our providers store or process data outside India — for example, our database. Indian law currently allows this except to countries the Government specifically restricts (s.16 DPDP Act); none of our providers’ locations is restricted. If that changes, we’ll move the data or stop the transfer.

How long we keep it#

We keep personal data only as long as we need it for the purposes above:

Retention period for each category of data
Data	Kept for	Why
Your registration (name, email, phone, boxes wanted, consent record)	Until 30 days after the drop closes, then deleted	Long enough to tell you about the drop and answer questions about it.
If you opted in to future drops	Your name and email until you withdraw; your phone number is deleted with the rest	To tell you about future drops — that purpose needs only your email.
After you withdraw or ask to be deleted	Just your email on a do-not-contact list	So we never email you again by mistake.
Emails, data requests and complaints	3 years after the matter is closed	To show how we handled it if it’s raised again.
Rate-limit counters (hashed IP)	Overwritten every 10 minutes	Only to slow down repeated automated submissions.
Hosting and security logs	[Vercel log retention for our plan, e.g. 1–30 days]; up to 1 year where the law requires	Security and investigating incidents. We keep names, emails and phone numbers out of our logs.

When a retention period ends, we delete the data or make it permanently anonymous.

How we protect it#

All traffic is encrypted (HTTPS with HSTS). Our providers encrypt stored data.
Only the people who need it to run the drop can access the list.
We keep personal data out of application logs and error reports.

If a breach affects your personal data, we’ll tell you without delay — what happened, the likely consequences, what we’re doing about it and what you can do — and we’ll report it to the Data Protection Board of India and CERT-In as the law requires.

Your rights#

You can ask us to:

Access — a summary of your data, what we do with it, and who we’ve shared it with.
Correct, complete or update it.
Erase it.
Withdraw consent at any time.
Nominate someone to exercise these rights for you if you die or become unable to.
Complain about how we’ve handled your data.

How: email grievance@example.com from the address you registered with, or use the ready-made request links on our Contact page. If you write from a different address we may ask you to confirm it’s you. It’s free. We acknowledge within 48 hours and respond within 30 days.

The law also asks you not to impersonate anyone or give false details when using these rights.

If you're unhappy#

Please contact our Grievance Officer first — the DPDP Act requires that before going to the regulator, and we’d like the chance to put it right. If you’re not satisfied with our response, you can complain to the Data Protection Board of India (see meity.gov.in (opens in a new tab) for current details). Until the Board’s complaint powers take effect (expected 13 May 2027), you can also seek remedies under the Information Technology Act, 2000.

Children#

The interest list is for adults: the form asks you to confirm you’re 18 or older. We don’t knowingly collect personal data from children. If you think a child has registered, contact us and we’ll delete their details.

Cookies#

We don’t use analytics, advertising, tracking or social-media cookies, so there’s no cookie banner. When the bot check is switched on, Cloudflare may set a strictly necessary cookie inside it for security. If we ever want to add analytics or advertising cookies, we’ll ask for your consent first.

Changes to this notice#

If we change this notice, we’ll update the date at the top. When the drop opens for orders, a new notice will cover the extra details an order needs (such as your delivery address), and you’ll see it before you buy. If a change affects how we use data you’ve already given us, we’ll email you before it takes effect and, where needed, ask for your consent again.

The law behind this notice#

This notice is written to meet the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (most of whose obligations take effect on 13 May 2027), and the rules that apply today under section 43A of the Information Technology Act, 2000 (the SPDI Rules, 2011).