Privacy Policy

The DRAFTOX website is a working storefront. When you create an account, place an order, or send an inquiry, the information you provide is genuinely stored and used to run the service — it is not a preview. This policy describes exactly what is collected, why, and what happens to it.

Account sign-up stores your name, email address, and a password that is hashed before it is stored. If you sign in with Google, we store the name, email address, and Google account reference returned by Google to us (we never receive or store your Google password). Signing in creates a session and, when you do, the session is stored in your browser as a cookie.

Orders capture your name, email, phone number, and delivery address (line, city, state, pincode). Support, product-inquiry, and project-inquiry forms store your name, contact details, and the message you send so the relevant team can read and reply.

Card, UPI and netbanking payments are processed by Razorpay on their own servers. DRAFTOX never sees or stores full card numbers. We store your order total, currency, the payment method used, and Razorpay's order and payment references so we can confirm payment and check your order status.

We send transactional email — order confirmations, shipment updates with a tracking link, and replies to your inquiries — to the address you provided. These are part of the service and are always sent.

Marketing email (product updates and offers) is only ever sent if you opt in through your account's communication preferences. You can switch that preference on or off at any time and it updates immediately. There is no consent assumed: it defaults to off.

The site sets a session cookie (HttpOnly) while you are signed in and a small CSRF-protection cookie for form security. No advertising trackers, fingerprinting, or third-party analytics are used. Fonts are served from the site itself rather than an external provider, so visiting a page does not disclose your visit to a third party.

Public shipment tracking uses a unique, unguessable link emailed to you; it reveals shipment progress to whoever holds that link, so treat tracking emails as private.

Passwords and session tokens are stored only as cryptographic hashes. Login and form endpoints are rate-limited to slow abuse. We use the information you provide to operate the store, take and fulfil orders, answer inquiries, send shipment and support emails, and keep the service secure.

Your information is not sold. It is shared only with the services required to run the store — the payment processor (Razorpay) to take payment, and the email provider to deliver transactional mail — plus any courier or carrier that handles the delivery you request.

Account data, orders, addresses, and the messages you send are kept while your account and relevant orders are active. You can ask to see what we hold about you, ask for a correction, withdraw marketing consent, or request deletion by contacting us at the address below. Some transactional records may need to be kept for a short time afterwards to comply with financial record-keeping rules.

When you message DRAFTOX on WhatsApp or call a support number listed on this site, WhatsApp or your phone provider processes the exchange under its own privacy policy. DRAFTOX uses what you send only to answer your question, prepare a quote, or handle a product inquiry or order.

Product inquiry messages may include your name, delivery location, and which product you are asking about. That information is used to confirm details with you and is not sold or shared for advertising.

The site links to external services, including WhatsApp, phone contact, and payment. Those services have their own privacy policies. DRAFTOX does not control what those services collect once you follow a link or begin processing with them.

You can ask what information DRAFTOX holds about you, request a correction, withdraw marketing consent, or ask for deletion by writing to draftoxcustomersupport@gmail.com. You may also object to any use of your details the same way.