Skip to content
PRIMECRAFT
LoginCart

Privacy Policy

Last updated 12 August 2026

This notice explains what personal data ⚠ NOT CONFIGURED — set STORE_LEGAL_NAME ("Prime Craft", "we", "us") collects when you use primecraft.com, why we collect it, who else sees it, how long we keep it and what you can ask us to do with it. It is written to meet the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules made under it, and the Consumer Protection (E-Commerce) Rules, 2020.

Please read the section on personalisation carefully. What you type into a name plate is manufactured onto a physical object, so it is handled differently from the rest of your data.

Who is responsible for your data

⚠ NOT CONFIGURED — set STORE_LEGAL_NAME is the Data Fiduciary for the personal data described here.

  • Registered address: ⚠ NOT CONFIGURED — set STORE_ADDRESS
  • Email: ⚠ NOT CONFIGURED — set SUPPORT_EMAIL
  • Phone: ⚠ NOT CONFIGURED — set SUPPORT_PHONE
  • WhatsApp: +919920251961

Our Grievance Officer is named at the end of this notice.

What we collect, and why

Contact and delivery details — your name, delivery address, phone number and email address. We use these to make and deliver your order and to tell you where it is. Without them an order cannot be fulfilled.

Personalisation content — the names, dates and words you type into a product's personalisation form. This is used to generate the artwork, is printed or engraved onto the item, and is stored against the order so that we can reprint a damaged piece and answer a query about what was made. Please do not enter anything into these fields that you would not want manufactured and stored: it becomes part of a physical product and of our order records.

Order and payment records — the items, amounts, order number, delivery status and the payment identifier returned by our payment gateway. We do not receive or store your card number, CVV, UPI PIN, or net-banking credentials. Those are entered on RazorPay's payment window and never reach our servers.

Account details — if you create an account, your email address and a bcrypt hash of your password. A hash is one-way: we cannot read your password and cannot tell you what it is.

Reviews — the rating and text you choose to submit, published against your first name once approved.

Technical data — your IP address, browser type, and the pages you requested, in our server logs; plus a small number of essential cookies described below.

Cookies

We set only cookies that are necessary for the site to work:

  • a session cookie, so that you stay signed in;
  • a basket cookie, so that your basket survives a page reload;
  • a cross-site request forgery token, which protects forms from being submitted by another site on your behalf.

We do not use advertising cookies, cross-site trackers or analytics that profile you across other websites, and we do not sell or rent personal data to anyone.

The basis on which we process it

When you place an order you provide your data for a specified purpose — making and delivering that order — and we process it for that purpose and no other. Certain processing also falls within the legitimate uses recognised by section 7 of the Digital Personal Data Protection Act, such as complying with a legal obligation.

You may withdraw your consent at any time by writing to ⚠ NOT CONFIGURED — set SUPPORT_EMAIL. Withdrawal is not retrospective: it does not undo processing already carried out, and if you withdraw while an order is in production we will not be able to complete or deliver it. We must also keep the records the law requires us to keep, as set out below.

Who else sees your data

We share the minimum necessary with:

  • RazorPay Software Private Limited, our payment gateway, which processes your payment and holds the payment instrument details we never see.
  • Courier partners, who receive the delivery name, address and phone number needed to deliver the parcel.
  • Our image host, which stores product photographs and the artwork generated for your order.
  • Our email provider, which delivers the order confirmation and dispatch notices sent to you.
  • Our hosting provider, on whose infrastructure the site and database run.

Each acts as a Data Processor on our instructions. We do not sell personal data, and we do not disclose it for anyone else's advertising. We will disclose data where we are legally required to — for example to a court, a tax authority, or a law-enforcement agency acting under lawful authority.

Where your data is held

The site, its database and its backups are hosted in India. Some of the processors above may process data outside India in the ordinary course of providing their service; where they do, that transfer is made on the basis permitted by section 16 of the Digital Personal Data Protection Act.

How long we keep it

  • Order records, including the personalisation text and the invoice: eight years from the end of the relevant financial year, which is the retention required of us by Indian tax law.
  • Account details: until you ask us to delete the account. We then erase or anonymise it within 30 days, except for order records we are required to retain.
  • Baskets that never became an order: 30 days.
  • Server logs: 90 days.
  • Reviews: until you ask us to remove them.

How we protect it

Traffic to the site is encrypted with TLS. Passwords are stored only as bcrypt hashes. The administrative panel is served from a separate hostname with its own short-lived, host-locked session cookie, so a compromise of the public site cannot reach it. Access to order data is limited to the staff who need it to make and dispatch your order. Backups are taken nightly and stored encrypted.

No system is perfectly secure. If a personal data breach occurs we will notify the Data Protection Board of India and every affected person, in the form and within the time the Digital Personal Data Protection Act requires.

Your rights

As a Data Principal you have the right to:

  • obtain a summary of the personal data we hold about you and how it is processed;
  • have it corrected, completed or updated if it is wrong or out of date;
  • have it erased, unless we are required to keep it;
  • nominate another person to exercise these rights on your behalf in the event of your death or incapacity;
  • a readily available means of grievance redressal, described below.

Some of these you can exercise yourself at any time: your saved addresses can be edited or deleted at /account/addresses, and your order history is at /account/orders. For anything else, write to ⚠ NOT CONFIGURED — set SUPPORT_EMAIL from the address on your account, or message +919920251961. We will respond within 30 days.

Children

Our products are sold to adults. We do not knowingly create an account for, or process the personal data of, anyone under 18 without the consent of a parent or lawful guardian, and we do not track children or direct advertising at them.

Grievance Officer

In accordance with Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the Consumer Protection (E-Commerce) Rules, 2020:

  • Name: ⚠ NOT CONFIGURED — set GRIEVANCE_OFFICER_NAME
  • Email: ⚠ NOT CONFIGURED — set GRIEVANCE_OFFICER_EMAIL
  • Phone: ⚠ NOT CONFIGURED — set SUPPORT_PHONE
  • Address: ⚠ NOT CONFIGURED — set STORE_ADDRESS

We acknowledge every complaint within 48 hours and aim to resolve it within one month of receipt.

If you are not satisfied with our response, you may complain to the Data Protection Board of India in respect of your personal data, or to the National Consumer Helpline on 1915 or at consumerhelpline.gov.in in respect of your order.

Changes to this notice

We update this notice when our practices change. The date it was last revised is shown at the top of this page. Material changes affecting how we use data you have already given us will be notified to you by email.