Privacy Policy

This Privacy Policy explains what personal data UrDesign by Anshika collects, why, who we share it with, and the rights you have over it. It applies to urdesign.space and to every service offered through it.

UrDesign by Anshika is a sole proprietorship operated by Anshika Singh. For the purposes of the Digital Personal Data Protection Act, 2023 we are the Data Fiduciary for the data described here, and you are the Data Principal. Our contact details are in section 10.

We ask for consent where the law requires it, and we only collect what a stated purpose actually needs. You can withdraw consent at any time — see section 7.

1. What We Collect

1.1 Information You Give Us

• Account — name, email address, phone number, and a password (stored only as a one-way hash, never in readable form). If you sign in with Google we receive your name, email and profile picture from Google, not your Google password.
• Orders — billing and delivery address, the items you bought, and the order history shown in your dashboard.
• Payments — card and UPI details go directly to Razorpay and are never seen or stored by us. We keep only the transaction reference, the amount, the method type, and the last four digits where Razorpay returns them.
• Project information — photographs of your rooms, measurements, floor plans, briefs and preferences you upload for a design package. This can reveal a lot about your home, so it is stored in private object storage that is not publicly reachable, and is shared only as described in section 3.
• Style quiz and profile — your answers and the resulting style profile.
• Correspondence — emails, live chat transcripts, and support messages, including anything you choose to include in them.
• Consent records — when you agree to something (our terms, marketing email, that you are over 18), we store what you agreed to, when, the version of the policy in force at that moment, and the IP address and browser the agreement came from. The law puts the burden of proving consent on us, and that evidence is the only way to meet it. It is used for nothing else — not tracking, not profiling.

1.2 Information Collected Automatically

When you browse the site we record, through our own first-party analytics rather than a third-party advertising network:

• IP address, and the approximate city, region and country derived from it
• Device, browser, operating system, language and time zone
• Pages viewed, time on page, scroll depth and clicks
• The site or campaign that referred you, including UTM parameters

This is used to understand how the site is performing and, if you start a live chat, to give whoever answers the context of what you were looking at. It is not sold, and it is not used to build advertising profiles. If you would rather not be counted, decline analytics in the cookie banner.

1.3 Sensitive and Children's Data

We do not ask for financial account credentials, health data, biometrics, caste, religion or any other special category of data, and you should not send them to us. Our services are for adults; we do not knowingly collect data from anyone under 18. If you believe a child has given us data, write to [email protected] and we will delete it.

2. How We Use Your Information

We use the information we collect to:

3. Who We Share It With

We do not sell, rent or trade your personal data. We share it only with the processors below, only for the purpose stated, and only to the extent that purpose needs:

We also disclose data where the law requires it, to enforce our Terms, or to investigate fraud. If the business is ever sold or transferred, your data may pass to the new owner under this same policy, and we will tell you before that happens.

3.1 Use of AI Tools

We use AI assistants internally — for drafting replies, summarising a brief and similar support work. Where a request includes customer data it is limited to what the task needs, and our providers are contractually barred from using it to train their models. An AI never makes a final decision about you on its own: a person reviews anything that affects your order, refund or project.

3.2 Transfers Outside India

Some of these providers process data on servers outside India. Where that happens we rely on the provider's contractual data-protection commitments, and we transfer only to countries not restricted by the Central Government under the DPDP Act.

4. Cookies and Tracking

We use cookies and similar tracking technologies to enhance your experience. Types of cookies we use include:

• Essential Cookies: Required for basic site functionality
• Preference Cookies: Remember your settings and preferences
• Analytics Cookies: Help us understand how you use our site
• Marketing Cookies: Used to deliver relevant advertisements

You can control cookie settings through your browser. Disabling cookies may affect some site functionality.

5. Data Security

We implement appropriate security measures to protect your personal information, including:

• SSL/TLS encryption for data transmission
• Secure payment processing through Razorpay (PCI-DSS compliant)
• Regular security audits and updates
• Access controls and employee training

While we strive to protect your information, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

6. How Long We Keep It

We keep personal data only as long as the purpose it was collected for still applies, or as long as the law requires — whichever is longer. In practice:

• Account details — until you close your account, then deleted within 90 days except where a record must be kept below.
• Orders, invoices and payment references — 8 years from the end of the financial year, as tax and company-records law requires. This is a legal obligation and cannot be waived by a deletion request.
• Project files and room photographs — 3 years after the project completes, so we can support you afterwards. Ask us sooner and we will delete them.
• Marketing consent — until you unsubscribe, plus a suppression record so we do not email you again by mistake.
• Analytics and visitor sessions — 30 days, then deleted automatically by the database itself rather than by anyone remembering to run a job.
• Support and chat transcripts — 3 years, for dispute handling.

7. Your Rights

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• Access— a summary of the personal data we hold about you, what we do with it, and who we have shared it with. Download it yourself at any time from Settings → Privacy & Data; you do not have to ask us.
• Correction and completion — have inaccurate or incomplete data fixed. Most of this you can do yourself in Settings.
• Erasure — delete your account from Settings and we erase your profile, projects, uploaded photographs, quiz answers and saved items outright. Invoices are not deleted but are stripped of your name, address and contact details, because tax law requires the financial record itself to survive for 8 years.
• Withdraw consent— at any time, as easily as you gave it. Marketing consent is a single toggle under Settings → Privacy & Data and takes effect immediately. Withdrawal does not undo processing already carried out, and may mean we can no longer provide a service that depended on it.
• Nominate— name someone to exercise these rights on your behalf if you die or become incapacitated. Set this yourself under Settings → Privacy & Data.
• Grievance redressal — complain to us first, and if we do not resolve it, to the Data Protection Board of India.

Write to [email protected] to exercise any of these. We may ask you to verify your identity first — that is to stop someone else obtaining your data. We respond within 30 days.

The Act also asks that you provide accurate information and do not file frivolous or false complaints.

8. If Something Goes Wrong

If a breach affects your personal data, we will notify you and the Data Protection Board of India without undue delay, telling you what happened, what data was involved, and what you can do about it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date. Continued use of our services after changes constitutes acceptance of the updated policy.

10. Contact and Grievances

Questions about this policy, or a request to exercise any right in section 7, go to the person responsible for data protection at UrDesign by Anshika:

• Grievance Officer: Anshika Singh
• Email: [email protected]
• Phone: +91 98765 43210
• Address: 123 Design District, Andheri West, Mumbai, Maharashtra 400053

We acknowledge within 48 hours and aim to resolve within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

11. This Notice in Another Language

Section 5(3) of the Digital Personal Data Protection Act, 2023 entitles you to receive this notice in English or in any language listed in the Eighth Schedule to the Constitution of India — including Hindi, Marathi, Bengali, Tamil, Telugu, Gujarati, Kannada, Malayalam, Punjabi, Odia, Assamese and Urdu.

This page is published in English. If you would prefer it in one of those languages, write to [email protected] naming the language, and we will send you a translated copy within 30 days at no cost. The English version remains the operative text; a translation is provided so you can understand it, not to change what it says.

Related Policies: Terms of Service | Refund Policy | Shipping Policy