Privacy policy
What we collect, why we collect it, who else sees it, and how to get it removed.
Last updated September 2026 · [REPLACE] By The Carat Jewellers Private Limited
What we collect
When you buy: your name, email address, phone number and delivery address. We need these to take payment and deliver the order.
When you create an account: your name and email, plus a one-way cryptographic hash of your password. We never store the password itself and cannot recover it.
Automatically: your IP address, used to rate limit sign-in and checkout against abuse.
We never collect card numbers, UPI IDs or bank credentials. Those go directly to our payment gateway and never reach our servers.
Cookies
We set a small number of strictly functional cookies, all of them HTTP-only: one to keep you signed in, one to remember your shopping bag, and one so a guest can return to an order they placed. There are no advertising or cross-site tracking cookies on this site.
Your theme preference (light or dark) is stored in your browser and never sent to us.
Who else sees your data
Only the processors we need to run the shop: our payment gateway, our hosting and database providers, our email provider for order confirmations, and the courier delivering your parcel. Each receives only what that task requires — the courier gets your address, the gateway does not.
We do not sell your personal information, and we never have.
How long we keep it
Order records, including the delivery address as it stood at the time, are retained for as long as tax and company law require. Account details are kept until you ask us to delete them. Abandoned shopping bags expire on their own.
Your rights
You can ask for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete your account. Write to care@bythecarat.in and we will respond within thirty days. Note that we cannot delete completed order records we are legally required to retain.
Security
Traffic is encrypted in transit. Passwords are hashed. Sessions are signed and stored in HTTP-only cookies that JavaScript cannot read. Access to production data is limited to the people who need it.
Contact
[REPLACE] By The Carat Jewellers Private Limited, [REPLACE] Registered address, Bengaluru, Karnataka 560025, India. Email care@bythecarat.in.
Questions about this policy?
Write to care@bythecarat.in or call +91 80 4718 2200. We answer in one working day.