Privacy Policy

What we collect

• Email address (shared by Google or Microsoft when you sign in): to identify your account and send order emails (on by default; you can turn them off in your account).
• If you sign in with Google: your name, your email address, whether Google has verified it, and your Google account identifier. If you sign in with Microsoft: your email address and your Microsoft account identifier. We never receive your Google or Microsoft password.
• Mobile number: only where WhatsApp sign-in is offered, to sign you in with a one-time code and send order updates on WhatsApp (you can turn these off).
• Name, delivery addresses and the phone number on each address: to deliver your orders.
• Orders, payments and refunds: what you bought, amounts, coupons used and the status of each order, including courier tracking events. Card, UPI and bank details are entered on our payment partner's secure form; we do not see or store them.
• Coupons and referrals: your personal coupons, your referral code, who referred you and whom you referred, and a one-way fingerprint (hash) of your verified email address or mobile number, used only to stop people referring themselves.
• Reviews: the rating and text you submit about a product you received, and our moderation decision on it.
• Notification settings: which order updates you receive, and a record of each update we sent.
• Technical data: the cookies and browser storage described below, and security logs (such as the time and outcome of sign-in attempts) used to protect accounts and prevent misuse.

How we use it

• To create your account, sign you in, place and deliver orders, process payments and refunds, and answer your questions.
• To apply welcome and referral coupons and run our referral programme.
• To send order updates (order confirmed, shipped, delivered, refunds). Email updates are on by default and WhatsApp updates apply only where WhatsApp is offered; you can turn either off at any time in your account.
• To keep the website secure, limit misuse (for example, by limiting repeated sign-in attempts) and meet our legal, tax and accounting obligations.
• We do not use your personal data for advertising, and we do not sell it.

Google user data we access (Sign in with Google)

Wellisha Essentials uses "Continue with Google" (and "Continue with Microsoft") to create your account and sign you in. We do not ask you to create a password.

When you choose it, Google asks for your permission and then shares your basic profile with Wellisha Essentials. We request only the openid, email and profile scopes, and we keep only:

• your name;
• your email address and whether Google has verified it;
• your Google account identifier, so we can recognise you the next time you sign in.
• Google may also make your profile picture and language available through the profile scope; we do not keep them.

How we use Google user data

We use Google user data only to provide user-facing features of your Wellisha Essentials account:

• to create your account and sign you in;
• to keep one account per email address, so signing in with Google or with Microsoft using the same email address reaches the same account, orders and coupons;
• to send the order emails that are part of your account to that email address (you can turn them off in your account).
• We do not use Google user data for advertising or retargeting, to build advertising, marketing or user profiles or databases, to assess creditworthiness or for lending, or for any purpose unrelated to your account.
• We do not use Google user data to develop, improve or train artificial intelligence or machine learning models.
• We never receive your Google password, and we cannot read your Gmail, contacts, Drive files, calendar or any other data in your Google account.

How we share Google user data

We do not sell, rent or trade Google user data, and we do not share or transfer it to advertisers, data brokers or other third parties. Only these service providers process it, on our behalf and only to run your account:

• Amazon Web Services, which hosts our website and stores our data in Mumbai, India; this includes Amazon Cognito (sign-in) and Amazon Simple Email Service (delivering emails to your address).
• Razorpay, which receives your name and email address to fill in its payment form when you choose to pay for an order.
• We disclose Google user data only if the law requires us to. If Wellisha Essentials is ever merged or sold, we will ask for your explicit consent before your Google user data is transferred.
• Wellisha Essentials' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements (developers.google.com/terms/api-services-user-data-policy).
• No person at Wellisha Essentials reads your Google user data, except with your permission (for example when you ask customer care for help with your account), for security or abuse investigations, or when the law requires it.

How we protect Google user data

• All traffic to wellisha.com is encrypted with HTTPS (TLS).
• Your account data is stored encrypted at rest on Amazon Web Services in Mumbai, India.
• Your signed-in session is kept in an encrypted, HttpOnly cookie that only our servers can read; sign-in tokens are never exposed to scripts in your browser.
• Access is limited to the people and systems that need it to run the store.

Keeping and deleting Google user data

• We keep your name, email address and Google account identifier for as long as your Wellisha Essentials account is active.
• To delete your account and the Google user data we hold, write to care@wellisha.com from the email address or mobile number on your account. We then delete it, except order records that Indian tax and accounting law requires us to keep. Deleted data can remain in our encrypted backups for up to 14 days and in system logs for up to 3 months before it is removed automatically.
• You can remove Wellisha Essentials' access at any time in your Google account at myaccount.google.com/permissions (for Microsoft: account.live.com/consent/Manage). After that we receive nothing further from Google or Microsoft.

Who we share it with

We do not sell your personal data and we do not use advertising or tracking cookies. We share only what each partner needs to do its job for us:

• Amazon Web Services: hosts our website, sign-in (Amazon Cognito) and email delivery (Amazon Simple Email Service), and stores our data in Mumbai, India.
• Razorpay: processes payments and refunds, and receives your name, email address and phone number to fill in its payment form.
• Amazon Shipping and other courier partners: receive your name, delivery address and phone number to deliver your parcel.
• Google and Microsoft: confirm who you are when you choose to sign in with them.
• Meta (WhatsApp): only where WhatsApp is offered, delivers sign-in codes and order updates to your mobile number.
• Authorities: when the law requires us to share information.
• Some partners, such as Google, Microsoft and Meta, may process the data they handle for us outside India, as Indian law permits.

Reviews you publish

Approved reviews are shown publicly with your first name and the first letter of your last name, taken from the name on your delivery address (or "Verified buyer" if we cannot use a name), and marked as a verified purchase. Your mobile number, email and address are never shown.

Cookies and browser storage

We use only essential cookies: one keeps you signed in (for up to 30 days), one remembers your cart before you sign in (currently for up to 30 days) and short-lived ones protect the sign-in process. Without them the website cannot work, so they cannot be switched off.

We also keep a few small items in your browser's storage: a referral code from a link you opened, whether you closed the welcome-offer message, details that let you safely resume a checkout in progress, and a marker used to retry a Google or Microsoft sign-in once.

When you pay, our payment partner's checkout may set its own security cookies, under its own privacy policy.

How long we keep it

• Your account and addresses: while your account is active, and until you ask us to delete them.
• Orders, invoices and payment records: for as long as Indian tax and accounting laws require.
• Security records of sign-in attempts are stored only as one-way hashes and expire after about 2 days.
• A cart created before sign-in is removed after 30 days without changes.
• Encrypted database backups are kept for up to 14 days and system logs for up to 3 months.

Your rights

You can ask us to show you the personal data we hold about you, correct it or delete it. Write to care@wellisha.com from the email address or mobile number on your account. We may need to keep some order records where the law requires it.

You can withdraw a consent as easily as you gave it: turn order updates off in your account's notification settings, or write to us. Withdrawing does not affect what we did before.

You can nominate a person to exercise these rights for you if you die or become unable to act.

If you are not satisfied with our response, you can contact our Grievance Officer and, after that, complain to the Data Protection Board of India.

Children

Accounts are for adults aged 18 and over. A parent or guardian may order for their family from their own account. We do not knowingly create accounts for children.

Security

Data is encrypted in transit and at rest, access is limited to people and systems that need it, and you sign in with your Google or Microsoft account, so we never store a password for you. Wellisha Essentials will never ask you for your Google or Microsoft password.

If a personal data breach affects you, we will inform you and the Data Protection Board of India as the law requires.

Changes to this policy

If we change how we use your data, we will update this page and the date above. For significant changes we will let you know before they take effect, and we will ask for your consent before using Google user data in a new way.

Grievance Officer

For any complaint about your order, your account or how we handle your personal data, contact the Grievance Officer, Wellisha Essentials, at care@wellisha.com (subject "Grievance") or on +91 85278 88580. Include your order reference if your complaint is about an order.

We acknowledge complaints within 48 hours and aim to resolve them within one month of receiving them.