Privacy Policy
Last updated: 13 October 2026
This Privacy Policy explains how thevastria.in (“Vastria (Test)”, “we”, “us”) collects, uses, shares and protects your personal data when you use test.thevastria.in, our seller and admin apps, and our related services (together, the “Platform”). It applies to shoppers, to sellers who register to sell on the Platform, and to anyone who visits it.
We process personal data in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it, the Information Technology Act, 2000 and its rules, and the Consumer Protection (E-Commerce) Rules, 2020. For the purposes of the DPDP Act, we are the “Data Fiduciary” for the personal data described here.
By creating an account, placing an order, registering as a seller or otherwise using the Platform, you consent to the processing described in this policy. You can withdraw your consent at any time (see Your rights).
1. Information we collect
Information you give us
- Account details: your name, email address, mobile number and password. We store your password only as a one-way hash (bcrypt); we cannot see it.
- Delivery details: the addresses you save or use at checkout — name, mobile number, address, city, state and pincode.
- Orders and returns: what you buy, sizes, prices, coupons used, wallet use, cancellation and return reasons, and the order history that follows.
- Reviews: ratings and reviews you write. Reviews are public and show your first name only.
- Messages: anything you send us by email or through support.
- Seller details (sellers only): see section 8.
Information collected automatically
- Network and device data: your IP address when you sign up, log in and place orders, and, when something goes wrong, the page address and your browser type, recorded in our error logs.
- Security records: login attempts, one-time password (OTP) and verification-code requests, and request counts used to stop abuse.
- Cookies: a small number of essential cookies (see section 6). We do not use advertising or third-party analytics cookies.
Information from our partners
- Payments: from our payment gateway, the status of your payment, the payment method type (for example “UPI” or “Credit card”), transaction and refund references. We never receive or store your full card number, CVV, UPI PIN or net banking password.
- Delivery: shipment and tracking updates from our shipping partner and couriers.
- Verification: whether an OTP sent to your mobile number was entered correctly.
2. How we use your information
- To create and manage your account, and to let you log in with your password or a mobile OTP.
- To process, pack, ship and deliver your orders, take payments, and handle cancellations, returns and refunds.
- To send you service messages by email and SMS: order confirmations, shipping and delivery updates, return and refund updates, verification codes, password reset links and security alerts. These are part of the service and are sent even without marketing consent.
- To run your wallet, referral rewards and coupons (including per-customer coupon limits).
- To prevent fraud and abuse and keep the Platform secure (see section 3).
- To provide customer support and respond to your requests.
- To issue invoices and meet our legal, tax and accounting obligations, and to respond to lawful requests from authorities.
- To understand and improve our products and services using our own order and stock records.
We do not currently send promotional emails or SMS. If we start, we will ask for your consent first and every message will let you opt out.
3. Fraud prevention and automated checks
To protect shoppers, sellers and ourselves, each order receives an automatic risk score. The score considers signals such as a coupon meant for one customer being reused through linked accounts (the same IP address, mobile number or delivery address), many orders or failed payments in a short time, a new account placing a large order, and unusually high return rates. A high score places the order on hold for review by our team; a person, not the system, decides whether to release or cancel it. If an order of yours is held or cancelled and you think it was a mistake, contact us at support@thevastria.in.
We may block IP addresses, mobile numbers or email addresses involved in fraud or abuse from signing up, logging in or checking out.
4. Who we share your information with
We do not sell or rent your personal data. We share it only as needed to run the Platform, with:
| Who | What they receive | Why |
|---|---|---|
| Sellers on Vastria (Test) | Your name, delivery address, mobile number and the items you bought from them | To pack your order and print the shipping label |
| Shipping partner (Shiprocket) and courier companies | Your name, mobile number, delivery address, parcel contents and value, and the amount to collect for Cash on Delivery orders | To pick up, deliver and track parcels, and to collect returns |
| Payment gateway (Cashfree Payments) | Order number, amount, your name, email and mobile number; you enter payment details directly on the gateway’s secure page | To process payments and refunds |
| SMS provider (Message Central) | Your mobile number | To send and check one-time passwords |
| Email provider (Hostinger) | Your email address and the content of the emails we send you | To deliver service emails |
| Website content networks (jsDelivr, Google Fonts) | Your IP address and browser details, when your browser loads page styles and fonts | To display the website |
| Hosting provider | All Platform data is stored on servers we rent | To run the Platform |
| Government authorities, courts and law enforcement | What the law requires | To comply with legal obligations, and to protect our rights and the safety of others |
These partners may use your data only to provide their service to us, and must keep it secure. If our business is sold or merged, your data may transfer to the new owner, who will remain bound by this policy.
Some of these partners may process data outside India. Where that happens, we do so only as permitted under Indian law.
5. Payment security
Payments are handled by Cashfree Payments, a payment aggregator authorised by the Reserve Bank of India. Your card, UPI and net banking details are entered on Cashfree’s secure page and are never stored on our servers. Refunds go back to your original payment method; any amount paid from your Vastria (Test) wallet is returned to your wallet.
6. Cookies
| Cookie | Purpose | Lasts |
|---|---|---|
vastria_sid | Keeps you logged in and remembers your bag; protects forms against forgery | Until you close your browser |
vs_ref | Remembers which referral link brought you here, so the person who shared it can earn their reward | 30 days |
These cookies are essential for the Platform to work. Blocking them in your browser may stop login and checkout from working.
7. How we protect your information
- All traffic to the Platform is encrypted with HTTPS.
- Passwords are stored as one-way hashes. OTP and verification codes are never stored in readable form.
- Seller documents are kept in private storage that is not reachable from the web and is visible only to our authorised staff.
- Only the last four digits of an Aadhaar number are stored.
- Access to personal data is limited to staff who need it to do their work. Login attempts and code requests are rate-limited.
No system is perfectly secure. If a personal data breach affects you, we will inform you and the Data Protection Board of India as the DPDP Act requires.
8. Additional information for sellers
When you register to sell, we also collect:
- Business and KYC details: business name and type, PAN, GSTIN or enrolment ID, the type and number of your ID proof (masked for Aadhaar), registered address, store name and the categories you sell.
- Pickup details: pickup address, contact name and mobile number.
- Bank details: account holder name, account number, IFSC and bank name, for paying out your earnings.
- Documents: PAN card, GST certificate or ID proof, shop proof, cancelled cheque or passbook, and signature, as applicable.
- Verification: your email address and mobile number are verified with one-time codes during registration.
- Policy acceptances: which seller policies you accepted, and the version, language, date, device and IP address of each acceptance.
We use this to verify your identity and business, comply with GST and tax law (including tax collection at source), list your products, send you orders, arrange pickups, and pay you. Your pickup address and contact are shared with our shipping partner and couriers. Your store name is shown to shoppers. Tax details may be reported to tax authorities as the law requires.
As a seller you receive shoppers’ personal data only to fulfil their orders. You must not use it for any other purpose, as set out in the seller policies you accepted.
9. How long we keep your information
- Account and address details: while your account is active, and deleted within a reasonable time after you ask us to delete it.
- Orders, invoices, payments, refunds and seller payouts: for as long as tax and accounting laws require (generally up to 8 years), even after the account is deleted.
- Seller KYC details and documents: while you sell with us, then for the period the law requires.
- Security records: verification codes and OTP records are deleted within about a week; login attempts and request counters are kept only briefly; error logs are kept while needed to fix problems.
- Fraud blocks: until they expire or are removed.
10. Your rights
Under the DPDP Act you have the right to:
- Access: get a summary of the personal data we hold about you and how we process it, and the identities of those we have shared it with.
- Correct and update: fix inaccurate or incomplete data. You can update your name, mobile number, addresses and password yourself in My Account.
- Erase: ask us to delete your account and personal data, except what the law requires us to keep.
- Withdraw consent: at any time. This does not affect processing already done. Some services, such as placing orders, need your data to work.
- Nominate: name a person to exercise these rights on your behalf in the event of your death or incapacity.
- Grievance redressal: complain to our Grievance Officer (below), and, if you are not satisfied, to the Data Protection Board of India.
To make a request, email support@thevastria.in from the email address on your account. We may ask you to confirm your identity first.
11. Children
The Platform is meant for people aged 18 and over. Anyone under 18 may use it only with the involvement and verifiable consent of a parent or lawful guardian. We do not knowingly collect personal data from children without that consent, and we do not track children or target advertising at them. If you believe a child has given us personal data without that consent, contact us and we will delete it.
12. Grievance Officer
In line with the Information Technology Act, 2000, the Consumer Protection (E-Commerce) Rules, 2020 and the DPDP Act, our Grievance Officer is:
Grievance Officer, thevastria.in
Email: support@thevastria.in
Mon–Sat, 10:00 AM – 7:00 PM IST
We acknowledge complaints within 48 hours and aim to resolve them within one month. Please include your order number or registered email so we can help faster.
13. Changes to this policy
We may update this policy as our services or the law change. The date at the top shows the latest version. If we make significant changes, we will tell you by email or with a notice on the Platform before they take effect.
14. Contact us
Questions about this policy or your data? Email support@thevastria.in.