Privacy Policy

Maanorah ("we," "our," or "us") is a brand operated by its parent entity registered in India. We operate the website maanorah.com (the "Site"). This Privacy Policy describes how we collect, use, disclose, and protect your personal data when you visit our Site, create an account, or make a purchase.

This policy is published in compliance with the Digital Personal Data Protection (DPDP) Act, 2023, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Consumer Protection (E-Commerce) Rules, 2020.

By using our Site, you consent to the collection and processing of your personal data as described in this policy. You may withdraw your consent at any time by contacting us (see Section 14 below). Withdrawal of consent will not affect the lawfulness of processing done before withdrawal.

Personal Data: Any data about an individual who is identifiable by or in relation to such data, as defined under the DPDP Act, 2023.

Data Principal: The individual to whom the personal data relates - i.e., you, our customer or visitor.

Data Fiduciary: The entity that determines the purpose and means of processing personal data - i.e., Maanorah.

Data Processor: Any person or entity that processes personal data on behalf of the Data Fiduciary, including our service providers.

We collect information that you provide directly and information collected automatically when you use our Site.

Under the DPDP Act, 2023, we process your personal data based on the following lawful grounds:

• Consent: For marketing communications, newsletter subscriptions, birthday/anniversary data collection, push notifications, and non-essential cookies
• Contractual necessity: To process and fulfil your orders, manage your account, and provide customer support
• Legitimate use: For fraud prevention, site security, and improving our services
• Legal obligation: To comply with Indian tax laws, accounting regulations, BIS hallmarking requirements, and consumer protection laws

We use the information we collect to:

• Process and fulfil your orders, including shipping, delivery tracking, and payment processing
• Create and manage your customer account, including login via OTP verification
• Communicate with you about orders, deliveries, and customer service enquiries
• Send marketing communications, promotional offers, and personalized birthday/anniversary rewards (only with your consent, and you may opt out at any time)
• Deliver browser push notifications about new launches, price drops, and exclusive offers (only with your explicit permission)
• Save and display your wishlist items across sessions and devices
• Analyse site usage and performance to improve your browsing experience
• Prevent fraud, detect abuse, and ensure the security of our Site
• Comply with legal obligations, resolve disputes, and enforce our agreements

We use cookies and similar technologies to enhance your browsing experience, analyse site traffic, and deliver relevant content. Cookies are small text files stored on your device by your browser. When you first visit our Site, a consent banner allows you to Accept, Reject, or choose Essential Only cookies. You can change your preference at any time by clearing your browser cookies and revisiting the Site.

Google Analytics 4 (GA4): We use GA4 with Google Consent Mode v2. When you reject analytics cookies, GA4 operates in cookieless mode - no identifying cookies are set, and only aggregated, anonymized data is collected. When you accept, GA4 uses first-party cookies to provide richer analytics.

Microsoft Clarity: We partner with Microsoft Clarity to capture how you use and interact with our website through behavioural metrics, heatmaps, and session replay to improve and market our products and services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products and services and online activity. We also use this information for site optimisation and fraud/security purposes. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

Local Storage: In addition to cookies, we use browser local storage to persist your cart contents, wishlist items, cookie consent choice, and browsing preferences. This data remains on your device and is not transmitted to third parties.

With your explicit permission, we may send browser push notifications about new product launches, exclusive offers, price drops on your wishlist items, and order updates. Push notification permission is requested via a non-intrusive prompt after you have browsed the Site for some time.

You can revoke push notification permission at any time through your browser settings. We use a service worker to deliver notifications and do not collect any additional personal data through this mechanism beyond your notification subscription token.

We do not sell, rent, or trade your personal data to third parties. We may share your information with:

• Shipping Partners: Name, address, and phone number to fulfil and deliver your orders
• Payment Processors (Razorpay): To process your payments securely. Card details are handled directly by Razorpay and never touch our servers.
• OTP Service Provider (MSG91): Your phone number is shared with MSG91 solely for sending one-time passwords for login verification.
• Email Service: Your email address (if provided) for transactional emails (order confirmations, shipping updates) and marketing emails (only with consent).
• Analytics (Google): Anonymized usage data shared with Google Analytics for site performance analysis (only if you consent to analytics cookies).
• Hosting & Infrastructure: Our Site is hosted on secure cloud infrastructure. Data is processed on servers managed by our hosting providers.
• Legal Requirements: When required by law, regulation, court order, or legal process

All third-party service providers are bound by data processing agreements and are contractually obligated to use your information only for providing their services to us, in compliance with applicable data protection laws.

Some of our service providers (e.g., Google Analytics, cloud hosting) may process data outside India. In such cases, we ensure that appropriate safeguards are in place as required by the DPDP Act, 2023, including contractual obligations on the data processors to protect your personal data to a standard no less than what is required under Indian law.

We do not transfer personal data to any country that may be restricted by the Central Government under Section 16(1) of the DPDP Act, 2023.

We implement reasonable security safeguards as required under Section 8 of the DPDP Act, 2023 and Rule 8 of the IT Rules, 2011, including:

• Encrypted data transmission via SSL/TLS (HTTPS) across the entire Site
• Secure database storage with access controls and role-based permissions
• OTP-based authentication (no passwords stored for customer accounts)
• Regular security audits and vulnerability assessments
• Encryption at rest for sensitive data fields

While we take all reasonable steps to protect your data, no method of transmission over the internet or electronic storage is 100% secure. In the event of a personal data breach, we will notify the Data Protection Board of India and affected individuals as required under Section 8(6) of the DPDP Act, 2023.

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy, after which it is securely deleted or anonymized, unless a longer retention period is required by law. Specific retention periods include:

• Account data: Retained as long as your account is active. Deleted within 90 days of account deletion request, subject to legal retention requirements.
• Order & transaction data: Retained for a minimum of 8 years as required by Indian tax and accounting regulations (Income Tax Act, GST Act).
• Marketing consent records: Retained for 3 years after consent withdrawal for compliance evidence.
• Analytics data: Aggregated analytics data retained for 26 months (GA4 default). Individual-level data anonymized after 14 months.

Under the DPDP Act, 2023, you have the following rights:

• Right to Access (Section 11): Request a summary of your personal data being processed and the processing activities undertaken
• Right to Correction (Section 11): Request correction of inaccurate or misleading personal data, and completion of incomplete data
• Right to Erasure (Section 12): Request deletion of your personal data when it is no longer necessary for the purpose for which it was collected (subject to legal retention requirements)
• Right to Withdraw Consent (Section 6): Withdraw your consent for data processing at any time, with the same ease as it was given
• Right to Grievance Redressal (Section 13): Lodge a complaint with our Grievance Officer or the Data Protection Board of India
• Right to Nominate (Section 14): Nominate another individual to exercise your rights in case of death or incapacity

To exercise any of these rights, please contact our Grievance Officer (see Section 14 below). We will respond to your request within 30 days.

Our Site is not intended for children under the age of 18. We do not knowingly collect personal data from children. In accordance with Section 9 of the DPDP Act, 2023, any processing of a child's personal data requires verifiable consent from a parent or lawful guardian. If you believe we have inadvertently collected information from a child, please contact us immediately and we will take steps to delete such information.

In accordance with Section 13 of the DPDP Act, 2023 and Rule 5(9) of the IT Rules, 2011, we have appointed the following Grievance Officer to address your concerns regarding your personal data:

If you are not satisfied with the resolution provided by our Grievance Officer, you may file a complaint with the Data Protection Board of India established under Section 18 of the DPDP Act, 2023.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. The updated policy will be posted on this page with a revised "Last updated" date. Material changes will be communicated through a prominent notice on the Site or via email (if you have provided one). We encourage you to review this page periodically.

If you have any questions about this Privacy Policy, our data practices, or wish to exercise your rights as a Data Principal, please contact us: