Legal

Privacy Policy

Last updated: July 2025  ·  Effective from the date Canvas Theory began accepting orders.

Canvas Theory ("we", "us", "our") is a one-person hobby shop based in Bangalore, India, selling hand-painted denim jackets, tote bags, and wall clocks. This Privacy Policy explains what personal data we collect when you place an order or use this website, how we use it, and your rights in relation to it.

1. What data we collect

When you place an order, we collect:

• Your name, email address, and phone number
• Your delivery address, including pincode and state
• Your order details (product type, size, design description, notes)
• Payment confirmation data from Razorpay (we do not see or store your card details — Razorpay handles payment processing directly)

When you sign in with Google, we receive your name, email address, and profile photo from Google. We do not access any other Google account data.

We do not use tracking cookies, analytics scripts, or advertising pixels on this website.

2. How we use your data

We use your personal data solely to:

• Process and fulfill your order
• Send you progress photos and updates about your piece via email or WhatsApp
• Arrange delivery to your address
• Respond to questions or support requests you send us

We do not use your data for marketing, profiling, or any purpose beyond fulfilling your order and communicating with you about it.

3. Who we share data with

We share the minimum necessary data with the following third parties to fulfill your order:

• Razorpay — payment processing. Razorpay processes your payment and sends us a payment confirmation. Razorpay's own privacy policy applies to data they handle.
• Shipping courier — your name and delivery address are shared with the courier (e.g. Delhivery, India Post) to complete delivery.
• Google / Firebase — our website and order database run on Firebase (Google). Order data is stored in Firestore, a Google Cloud service. Google's data processing terms apply.

We do not sell your data. We do not share it with advertisers.

4. How long we keep your data

We keep order records for up to 3 years for accounting and dispute-resolution purposes. After that, records are deleted. If you'd like your data deleted earlier, contact us and we'll do it within 30 days, subject to any legal retention obligations.

5. Your rights

Under Indian law (Digital Personal Data Protection Act, 2023) and as a general principle, you have the right to:

• Request a copy of the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to retention obligations for completed orders)

To exercise any of these rights, contact us at the address below. We will respond within 30 days.

6. Data security

Order data is stored in Firebase Firestore with access controls that prevent any user from reading another user's orders. Payment data is handled entirely by Razorpay's PCI-compliant infrastructure — we never see raw card numbers or CVVs. Sign-in is handled by Google's authentication infrastructure.

7. Minors

This website is not directed at children under 13. We do not knowingly collect personal data from anyone under 13. If you believe a minor has placed an order or submitted personal data, please contact us and we will delete it promptly.

8. Changes to this policy

If we make material changes to this policy, we'll update the "Last updated" date at the top. Continued use of the website after changes constitutes acceptance of the revised policy.