Privacy Policy

Last updated: 15 September 2026

This Privacy Policy explains how Toto's Botanica(“we”, “us”, “our”) collects, uses, and protects your personal data when you visit totosbotanica.com(the “Site”) or place an order. We are committed to handling your information responsibly and in line with India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000 and its rules.

For the purposes of the DPDP Act, the data fiduciary is Sanya Garg, who runs Toto's Botanica as an individual (a small, unregistered venture), contactable at totosbotanica@gmail.com.

1. Information we collect

We only collect what you choose to give us when you order:

  • Contact details: your name, phone number, and email address.
  • Delivery address, including your PIN code.
  • Order details: the items you buy and any custom request you describe (colours, occasion, sizes, and similar notes you type in).
  • Payment records: the amount, the payment status, and a payment reference from our payment partner. We do not receive or store your card number, UPI PIN, or bank login details — those are handled entirely by Razorpay.
  • Items in your cart are stored only in your own browser (using local storage) until you check out. They are not sent to us beforehand.

2. How and why we use your information

We use your information only to fulfil the order you asked us to fulfil:

  • to take payment and confirm your order;
  • to make and deliver your order, including sharing your delivery details with the courier;
  • to email you order updates, such as confirmation and tracking;
  • to answer your questions and handle cancellations, replacements, and refunds;
  • to keep the transaction records the law requires.

We do not use your details for advertising, and we do not sell or rent your personal data to anyone.

3. Who we share it with

We share your information only with the service providers we need to run the shop, who act on our behalf, or where required by law:

  • Razorpay — processes your payment.
  • Courier partners — receive your name, phone number, and delivery address to deliver your order.
  • Sanity — stores our order records and product catalogue.
  • Resend — sends your order emails.
  • Vercel — hosts the Site and provides the analytics described below.

Some of these providers may store data on servers outside India.

4. How long we keep it

We keep order information for as long as needed to fulfil your order and handle any cancellation, replacement, or refund. Payment and transaction records are kept for as long as Indian tax and accounting law requires. Other personal data is then deleted. You may ask us to erase your data at any time, subject to those legal record-keeping duties (see your rights below).

5. Your rights under the DPDP Act

You have the right to:

  • access a summary of the personal data we hold about you;
  • request correction or completion of inaccurate data;
  • request erasure of your data;
  • withdraw your consent at any time;
  • nominate another person to exercise your rights in the event of death or incapacity;
  • raise a grievance with us and, if unresolved, with the Data Protection Board of India.

To exercise any of these, email totosbotanica@gmail.com. We will respond within a reasonable period.

6. Cookies and analytics

The Site does not use advertising cookies, and we do not track you across other websites. We use your browser’s local storage only to remember the items in your order while you browse. You can clear this at any time through your browser settings.

We use Vercel Analytics and Vercel Speed Insights to understand how many people visit the Site and which pages are slow. These are cookie-free and do not identify you personally: they record aggregate information such as page views, the page you arrived from, approximate country, and device type. Vercel acts as our data processor for this.

7. Children

The Site is intended for adults. We do not knowingly collect the personal data of children. In line with the DPDP Act, processing a child’s data requires verifiable consent from a parent or lawful guardian; if you believe a child has shared data with us, please contact us so we can delete it.

8. Security

We take reasonable technical and organisational measures to protect your information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Grievance Officer

In accordance with the IT Act and the DPDP Act, our grievance contact is Sanya Garg, reachable at totosbotanica@gmail.com. A postal address can be provided on request.

10. Changes to this policy

We may update this policy from time to time. The “last updated” date above reflects the latest version. Please review it periodically.

This policy is provided for general information. Consider having it reviewed by a qualified professional before relying on it.