Legal

Privacy Policy

Last updated: 2026-09-04

This Privacy Policy explains how Zerafto (“Zerafto”, “we”, “us” or “our”) collects, uses, shares and protects your personal information when you visit www.zerafto.com, create an account, place an order, or otherwise interact with us (together, the “Platform”). It is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023.

By creating an account or using the Platform you consent to the practices described in this policy. If you do not agree, please do not use the Platform.

1. Information we collect

We collect the following categories of information:

• Identity & contact details — your name, mobile number, email address and, where you choose to provide it, your business name and GSTIN for tax invoices.
• Delivery information — the delivery addresses you save, landmark notes, and the location you share so we can find the nearest fulfilling store and calculate delivery charges.
• Order & transaction details — the products you view, add to cart and purchase, order history, invoices, delivery status and any feedback or ratings you give.
• Communications — messages you send us through the contact or inquiry forms, WhatsApp, email or phone, and our replies.
• Technical & usage data — IP address, device and browser type, pages visited, referring URLs, and approximate location derived from your IP, collected automatically via cookies and similar technologies (see section 6).

We do not collect or store your card, UPI or bank details. All payments are processed by our payment partner, Razorpay, under its own privacy policy.

2. How we use your information

• To create and manage your account and verify your identity via one-time passwords (OTP) sent over WhatsApp or email.
• To process, fulfil and deliver your orders, including sharing your name, phone number and address with the fulfilling store and the delivery partner assigned to your order.
• To send transactional messages such as order confirmations, delivery updates, delivery OTPs, invoices and refund notifications via WhatsApp, SMS, email or in-app notifications.
• To respond to your queries, complaints and feedback and to provide customer support.
• To calculate delivery charges, detect and prevent fraud, abuse or security incidents, and to enforce our Terms & Conditions.
• To analyse how the Platform is used so we can improve products, pricing, performance and user experience.
• To comply with legal obligations, including tax, accounting and consumer-protection requirements.
• With your consent, to send you offers and updates about our products. You can opt out at any time (see section 8).

3. Legal basis for processing

We process your personal data on the basis of your consent (given when you register or place an order), the performance of our contract with you (fulfilling your order), our legitimate business interests (security, analytics, improving the Platform), and compliance with applicable law.

4. How we share your information

We do not sell or rent your personal information. We share it only with:

• Fulfilling stores and delivery partners — the store preparing your order and the delivery partner assigned to it receive the details needed to deliver: your name, phone number, delivery address and order contents.
• Service providers — companies that help us run the Platform, such as Razorpay (payments), WhatsApp Business / messaging providers (OTPs and order updates), email providers, cloud hosting and storage providers, and analytics providers (Google Analytics, Vercel Analytics). They may access your data only to perform services for us and are bound by confidentiality obligations.
• Legal and regulatory authorities — where required by law, court order or government request, or to protect the rights, property or safety of Zerafto, our customers or others.
• Business transfers — in the event of a merger, acquisition or sale of assets, your information may be transferred to the successor entity, which will remain bound by this policy.

5. Data retention

We keep your account and order history for as long as your account is active so you can review past purchases and re-order. Invoices and transaction records are retained for the period required by Indian tax and accounting laws (currently up to 8 years) even after account deletion. Technical logs are typically retained for up to 12 months. You may request deletion of your account and personal data at any time (see section 8); we will delete or anonymise it unless we are legally required to keep it.

6. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember your cart, secure the Platform against cross-site request forgery, and understand how visitors use the site. We use Google Analytics and Vercel Analytics, which set their own cookies and collect anonymised usage statistics. You can control cookies through your browser settings; disabling essential cookies may prevent you from logging in or checking out.

7. Data security

We use reasonable security practices and procedures to protect your information, including encrypted (HTTPS) connections, secure httpOnly authentication cookies, access controls, and OTP-based login instead of stored passwords. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security. Please keep your OTPs confidential and never share your delivery OTP before the delivery partner arrives.

8. Your rights and choices

Subject to applicable law, you have the right to:

• Access and review the personal information we hold about you from your Profile page.
• Correct or update your name, email, phone number and saved addresses at any time.
• Request deletion of your account and personal data.
• Withdraw consent to marketing communications by replying STOP to a WhatsApp message, using the unsubscribe link in an email, or writing to us.
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity, as provided under the Digital Personal Data Protection Act, 2023.
• Raise a grievance about how your data is handled (see section 11).

To exercise any of these rights, email us at support@zerafto.com from your registered email address. We will respond within 30 days.

9. Children

The Platform is intended for users aged 18 and above. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Third-party links

The Platform may contain links to third-party websites or services (for example, brand websites or social media). We are not responsible for their privacy practices. Please review their policies before sharing any information.

11. Grievance officer

In accordance with the Information Technology Act, 2000 and rules made thereunder, and the Digital Personal Data Protection Act, 2023, you may contact our Grievance Officer with any complaints or concerns regarding this policy or the handling of your personal data:

• Email: support@zerafto.com
• Phone: +91 88281 70595
• Address: Zerafto, Mumbai, Maharashtra, India

We aim to acknowledge grievances within 48 hours and resolve them within 30 days.

12. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top shows when it was last revised. Material changes will be notified through the Platform or by email. Continued use of the Platform after changes take effect constitutes acceptance of the revised policy.

13. Contact

For any privacy-related questions, email support@zerafto.com. See also our Terms & Conditions and Return Policy.