Privacy Policy
Effective Date: October 22, 2026 • Last Reviewed & Updated: October 2026
At Vistāra Krafts (@resin.art.memories) ("we", "our", "us", or "Atelier"), we treat the privacy and personal data of our patrons with architectural precision and utmost respect. This Privacy Policy sets forth our practices regarding the collection, use, processing, storage, and protection of personal data when you visit our website (vistarakrafts.com), create an account, purchase handcrafted epoxy formulations or custom preservation keepsakes, or utilize our third-party authentication services.
This policy is published pursuant to Section 5 of the Digital Personal Data Protection (DPDP) Act, 2023 (Government of India) and adheres strictly to the Google API Services User Data Policy.
corporate_fare 1. Identity of the Data Fiduciary
Entity Name: Vistāra Krafts
Operating Brand: Vistāra Krafts (@resin.art.memories)
Registered Address: Guwahati, Assam 781028, India
Data Protection Officer (DPO) & Grievance Officer: Kakoli Borah (ad4064773@gmail.com / grievance@vistarakrafts.com)
Support & Inquiries: support@vistarakrafts.com
inventory_2 2. Personal Data We Collect & Specified Purposes
local_shipping A. Shipping & Contact Details
Full Name, mobile phone number, delivery street address, city, state, and 6-digit PIN code. Used strictly to route BlueDart Priority Air logistics, send SMS/WhatsApp delivery milestones, and issue statutory GST tax invoices.
lock B. Authentication & Account Identity
Email address, encrypted authentication credentials, and 6-digit OTP verification codes. Used solely to authenticate your identity, prevent unauthorized account access, and isolate customer order history.
photo_library C. Custom Keepsake & Floral Media
Customer-uploaded photographs of wedding varmalas, preservation flowers, and custom brass lettering proofs. Handled confidentially and used exclusively for casting design approval.
payments D. Financial & Transaction Tokens
We never store your raw credit/debit card numbers or UPI PINs. All payment transactions are securely processed directly by Razorpay (RBI-authorized payment aggregator) using PCI-DSS Level 1 compliant tokenization.
security E. Technical Telemetry, Anti-Bot & Rate-Limiting Protection (IP Address & Request Metadata)
When you interact with our authentication, customer sign-in, or email verification endpoints, our servers automatically log your Internet Protocol (IP) address, request timestamp, and HTTP User-Agent.
3. Google User Data & OAuth 2.0 Compliance Notice
When you select "Continue with Google", Vistāra Krafts requests access only to basic Google profile information via the standard OpenID Connect scopes (openid, email, profile).
- Data Accessed: Your primary Google account email address, full name, and avatar profile picture.
- Purpose of Access: To seamlessly authenticate your identity, create your Vistāra Krafts patron profile, and securely associate your orders and curated wishlist across devices without needing a separate password.
- Data Sharing & Transfer: Vistāra Krafts NEVER sells, licenses, or transfers Google user data to third parties. We do not use Google user data for advertising, marketing profiling, or AI training.
- Limited Use Requirements: Vistāra Krafts' use and transfer to any other app of information received from Google APIs adheres strictly to the Google API Services User Data Policy, including the Limited Use requirements.
cookie 4. Cookie Policy & Binary Choice Telemetry Controls
Vistāra Krafts provides patrons with transparent, binary control over browser cookies and analytics telemetry. You can choose either [Accept All] or [Essential Only] via our floating privacy banner or consent preferences.
Strictly required to maintain core atelier functionality: your Shopping Bag (ram_vk_cart_v2), Keepsake Wishlist (ram_vk_wishlist_v2), Supabase secure authentication session (ram_vk_cf_auth_v2), and Razorpay checkout token. These items are strictly operational and cannot be switched off.
Includes Google Analytics 4 (G-QVM9JT6BW3), Meta Pixel (1183595563273188), and Microsoft Clarity (z6d831rvdh). When you choose [Essential Only], these trackers are entirely disabled via Google Consent Mode v2, Meta consent revocation, and client-side suppression.
shield 5. Database Security & Order Isolation
Our PostgreSQL database implements strict Row Level Security (RLS). Customer orders, delivery addresses, and payment logs are cryptographically bound to the authenticated patron's unique user ID (auth.uid() = user_id). Customer A can never view, query, modify, or infer any order or address data belonging to Customer B under any network circumstance.
delete_sweep 5. Data Retention & User Deletion Requests
We retain your account profile and order records only for as long as necessary to fulfill purchases, provide customer warranty support, and comply with statutory tax laws (such as GST audit retention).
How to Request Account & Data Deletion:
You may request complete erasure of your personal data and account at any time by:
- Sending an email from your registered account to grievance@vistarakrafts.com or support@vistarakrafts.com with the subject line "Account Data Erasure Request".
- Or opening the DPDP Grievance & Rights Portal from the website footer to submit a verified rights request.
Upon verification, your profile, authentication records, and uploaded media will be permanently deleted from our primary servers within 7 business days.
gavel 6. Statutory Rights of Data Principals
- Right to Access: You may request an itemized summary of all personal data held by Vistāra Krafts.
- Right to Correction: You may update or correct any inaccurate contact, address, or profile information.
- Right to Withdraw Consent: You may toggle optional consent preferences or unsubscribe from Atelier Circle notes at any time.
- Right to Grievance Redressal: You may file grievances with our Data Protection Officer, who is mandated to resolve inquiries within a 7-day SLA.
- Right to Nominate: You have the right to nominate an individual to exercise your privacy rights in the event of death or incapacity.
support_agent 7. Grievance Redressal Officer
Name: Kakoli Borah
Title: Grievance Redressal Officer & Data Protection Officer (DPO)
Official Grievance Email: ad4064773@gmail.com / grievance@vistarakrafts.com
Operating Location: Guwahati, Assam, India
Support & Inquiries: support@vistarakrafts.com
Response Timeline: Immediate acknowledgment within 24 hours; binding resolution within 7 calendar days.