Privacy Policy — Voltaro

A sample policy for a demo store. Voltaro takes no real orders. Mercayo wrote this text from the store's details; words in [square brackets] are choices a real store makes before it opens.

Effective date: 23 October 2026

1. Who is responsible for your data

1.1 Voltaro Demo Store (a Mercayo showcase), trading as Voltaro, of Demo address: 4th floor, Circuit House, Sector 62, Noida, 201309 ("we"), decides how and why your personal data is used when you visit or buy from -. Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary.

1.2 Our platform provider. Our store runs on Mercayo, a platform operated by Wahenam International, India. Mercayo hosts the store and processes your data on our behalf and on our instructions, as our Data Processor, under a written contract. Mercayo does not use your data for its own marketing, and does not share it with other stores on Mercayo.

1.3 Questions about your data: Voltaro demo desk, voltaro.demo@mercayo.com, +91 00000 00000.

2. What we collect

What	When
Name, mobile number, email	When you check out, sign in, track an order, ask for an exchange, or write a review
Delivery address and PIN code	At checkout, to check delivery and to deliver
Your order: items, amounts, discounts, payment method and status, delivery and exchange history	When you order
Payment references from our payment partner (Razorpay). We never see your card number, CVV, UPI PIN or bank login.	When you pay online
One-time-code records: that a code was sent and verified. The code itself is stored only in scrambled (hashed) form	When you confirm your number
Reviews you write: name, rating, text, photos	If you write one
Exchange requests: reason, the variant wanted, courier details, and an unboxing-video link if you give one	If you ask for an exchange
Messages we exchange with you, and your message preferences (opt-ins and opt-outs)	When you contact us, or change your preferences
Technical data: IP address, browser and device type, pages visited, cookies (see section 8)	When you use the store

We do not ask for sensitive data such as health or biometric information. Please do not send it to us.

3. Why we use it

Purpose	Basis
To take, confirm, deliver and support your order, including invoices, exchanges, returns and refunds	You provide it voluntarily for this purpose (DPDP Act, section 7(a)), and by placing the order you agree to its use for it
To confirm your mobile number by one-time code for cash on delivery, and to prevent fake orders and fraud	As above, and as part of the security safeguards the law requires us to keep
To send order, payment, shipping, delivery and exchange updates by SMS, email	As above. These are service messages about your order
To ask for, and publish, your product review	Your consent, when you write it or answer our request
To keep our accounts and tax records, and to comply with the law	Our legal obligations, for example under the CGST Act, 2017. Where the law requires us to keep data, we keep it for that period only
To keep the store secure, and stop abuse (for example, limiting repeated code requests)	Reasonable security safeguards (DPDP Act, section 8(5))

We do not sell your data. We do not use it for automated decisions that significantly affect you.

4. Who we share it with

Mercayo (our platform), and Mercayo's own service providers, which host and run our store and send our messages:
servers at [Mercayo's data-centre location];
Cloudflare (network security);
Brevo (email, EU);
MSG91 (SMS, India);
[Mercayo's backup provider].

Mercayo's current list is at [MERCAYO SUB-PROCESSOR URL].

Our payment partner Razorpay, to take online payments and refunds.
Our shipping partners: [Shiprocket / Shipway] and the courier they assign. They receive your name, phone, delivery address, order value and the amount to collect on delivery, so they can deliver.
Google Fonts: when the page loads its fonts, Google receives your IP address and browser details.
Authorities, when the law requires it: for example, tax authorities, or a court or agency with a lawful order.
A buyer of our business, if we sell it, under this policy.

Some of these providers process data outside India (for example, email in the EU). Section 16 of the DPDP Act allows this, except to countries the Government restricts. We, and Mercayo, choose providers that protect data properly.

5. How long we keep it

Data	How long
Orders, invoices and credit notes	As the GST and Income-tax laws require: at least 72 months from the due date of the annual GST return for that year (CGST Act, section 36), about 8 years
Your contact details and order history, for support	While you are a customer, and for [3] years after your last order. Then erased, unless needed for the tax records above
Bags that never became orders	[90] days
Reminder consent and opt-outs	Until withdrawn, plus [1] year as proof
Reviews	While they are published. Rejected reviews: 90 days
One-time-code records	[30] days; the code itself expires in 10 minutes
Security logs	As the law requires: at least 180 days, and one year where the DPDP Rules apply

6. Your rights

Under the DPDP Act you may:

ask for a summary of your personal data we hold, how we use it, and who we have shared it with (section 11);
ask us to correct, complete, update or erase it (section 12). We will erase it unless the law requires us to keep it (for example, invoices);
withdraw consent you gave, at any time, as easily as you gave it (section 6(4)). Withdrawal does not affect what was done before;
raise a grievance with us (section 13), and, if you are not satisfied with our answer, complain to the Data Protection Board of India;
nominate someone to exercise these rights if you die or become unable to (section 14).

How: write to voltaro.demo@mercayo.com or call +91 00000 00000, with the mobile number or email you used. We may verify it is you, for example with a one-time code. We reply within [30] days, or sooner if the law requires.

7. Children

Our store is not meant for children (anyone under 18) to buy from alone. If you are under 18, please ask a parent or guardian to place the order. We do not knowingly collect children's data without verifiable consent from a parent or guardian. We do not track children, or target advertising at them.

8. Cookies

We use only the cookies the store needs:

mercayo_cart, which keeps your bag for 30 days;
session storage during an online payment;
Razorpay's cookies on the payment page;
Cloudflare's security cookies.

We use no advertising or tracking cookies. [If the merchant adds analytics or advertising tools later, list them here and ask for consent first.]

9. Security

Our store uses HTTPS everywhere. Data is held in Mercayo's database, which walls off each store's data from every other store's. Access is limited by role, and passwords and one-time codes are stored only in hashed form. Payment details are handled by Razorpay, not us. If we learn of a breach affecting your data, we will tell you and the Data Protection Board, as the law requires.

10. Contact and grievance officer

Voltaro demo desk, Grievance Officer (demo store), Voltaro Demo Store (a Mercayo showcase), Demo address: 4th floor, Circuit House, Sector 62, Noida, 201309. Email voltaro.demo@mercayo.com · Phone +91 00000 00000 · Monday to Saturday, 10 am to 7 pm IST.

11. Changes

We will post changes here with a new date. If a change affects how we use data you gave with consent, we will ask you again.