Privacy Policy - Herb Soul

1. Introduction

This Privacy Policy ("Policy") describes how Synapse Cube Private Limited ("we", "us", or "our"), operating the brand Herb Soul through the website herbsoul.in ("Platform"), collects, stores, processes, and discloses information about users ("you" or "User") in accordance with applicable Indian laws, including the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").

By accessing or using the Platform, you consent to the collection, use, and disclosure of your personal data as described in this Policy. If you do not agree, please discontinue use of the Platform immediately.

2. Data We Collect

2.1 Information You Provide Directly

Full name, email address, and mobile number
Delivery address (including pin code, state, and city)
Payment information (processed securely via our payment gateway; we do not store card data)
Health-related information voluntarily submitted in forms or consultations
Order history and product preferences
Communication records (emails, WhatsApp messages, support tickets)

2.2 Information Collected Automatically

IP address and device identifiers
Browser type, operating system, and language settings
Pages visited, session duration, and clickstream data
Cookie data and tracking pixels (including Meta Pixel and Google Analytics)
Referral source (UTM parameters, ad click IDs including fbclid, gclid)

2.3 Sensitive Personal Data

To the extent that any health-related information you voluntarily share constitutes Sensitive Personal Data or Information (SPDI) under applicable law, we will collect, process, and store such data only for the purposes described in this Policy, and only with your explicit consent.

3. Purpose of Data Collection

We collect and use your personal data for the following purposes:

Processing and fulfilling your orders
Sending order confirmations, shipping updates, and delivery notifications via email and SMS
Providing customer support and resolving disputes
Sending promotional communications, offers, and product updates (with your consent)
Conducting retargeting and abandoned cart recovery via email, SMS, and WhatsApp
Improving our website, user experience, and product offerings through analytics
Fraud detection, security monitoring, and legal compliance
Compliance with applicable laws, regulations, and lawful government requests

4. Marketing Communications & WhatsApp Consent

By providing your mobile number and/or email address on our Platform, you expressly consent to receiving the following from Herb Soul:

Transactional messages: Order confirmations, shipping updates, delivery alerts
Promotional messages: Offers, discounts, new product launches, and wellness content
Retargeting messages: Abandoned cart reminders, reorder nudges, and follow-up communications

These communications may be sent via email, SMS, WhatsApp, and other applicable digital channels. You may opt out of promotional communications at any time by contacting us at care@herbsoul.in or by clicking 'Unsubscribe' in our emails.

Note Transactional messages (order updates, shipping confirmations) cannot be opted out of as they are necessary for service delivery.

5. Data Sharing & Disclosure

We do not sell, rent, or trade your personal data to third parties. We may share your data only in the following limited circumstances:

With logistics partners (e.g., Shiprocket, Delhivery, Xpressbees) solely for order fulfilment and delivery
With payment gateway providers (e.g., Razorpay) for secure transaction processing
With advertising platforms (e.g., Meta, Google) for analytics and targeted advertising, in anonymised or hashed form where applicable
With WhatsApp Business API providers for transactional and retargeting communications
With regulatory authorities, law enforcement, or courts when required by applicable law
With professional advisors (lawyers, accountants) bound by confidentiality obligations

All third-party partners are contractually required to handle your data in accordance with applicable data protection standards.

6. Cookies & Tracking Technologies

We use cookies and similar tracking technologies on our Platform to enhance your experience and for analytical and marketing purposes. These include:

Essential cookies: Required for the Platform to function (cart, session management)
Analytics cookies: Used to understand user behaviour (Google Analytics)
Marketing cookies: Used for ad retargeting (Meta Pixel, Google Ads Tag)

You may manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Platform.

7. Data Retention

We retain your personal data for a period of 36 (thirty-six) months from the date of your last interaction with our Platform or from the date of your last purchase, whichever is later. After this period, your data will be securely deleted or anonymised unless retention is required by applicable law (e.g., GST or accounting obligations under the Income Tax Act, 1961).

8. Data Security

We implement commercially reasonable technical, organisational, and administrative measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include encrypted payment processing, secure HTTPS data transmission, and restricted internal access to personal data on a need-to-know basis.

However, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of data transmitted over the internet.

9. Your Rights

Under the DPDP Act, 2023 and applicable Indian data protection law, you have the right to:

Access the personal data we hold about you
Correct inaccurate or incomplete personal data
Request erasure of your personal data (subject to legal retention obligations)
Withdraw consent for processing at any time (this will not affect the legality of prior processing)
Nominate a person to exercise your rights on your behalf in the event of death or incapacity

To exercise any of the above rights, please contact us at care@herbsoul.in with the subject line "Data Rights Request". We will respond within a reasonable timeframe in accordance with applicable law.

10. Children's Privacy

Our Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will take steps to delete such data promptly.

11. Third-Party Links

Our Platform may contain links to third-party websites. We are not responsible for the privacy practices of such websites and encourage you to review their privacy policies independently before submitting any personal information.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The updated policy will be posted on the Platform with a revised 'Last Updated' date. Continued use of the Platform after such changes constitutes your acceptance of the updated Policy.