Privacy policy
Draft – this text is being reviewed by our lawyer and may change.
CharismaLoyal LLP (Surat, Gujarat, India) is responsible for your personal data ("Data Fiduciary" under India's Digital Personal Data Protection Act 2023, "controller" under the EU GDPR).
What we collect and why
- Orders: name, address, e-mail, phone, what you bought – to deliver, invoice and give service. Invoices are kept for the period tax law requires.
- Payments: handled by our payment providers (Razorpay, Stripe). We never see or store your card number.
- Account and Loyal Club: your profile, points and wish list.
- Newsletter, WhatsApp, push messages: only with your consent; you can withdraw it at any time with one click.
- Analytics and advertising cookies: only after you agree in the cookie banner. See cookies.
- Camera try-on: runs entirely in your browser. No picture or video is sent to us.
- Video consultations: we do not record them.
Who receives data
Only service providers we need: payment, shipping, e-mail delivery, hosting, and – for trade customers – sanctions screening. Partner manufacturers receive only what they need to confirm and ship a stone, never your payment data.
Your rights
You can ask for a copy of your data, correct it, have it erased (except what tax law makes us keep), withdraw consent and complain. Logged-in customers can download their data in the account area. Write to grievance@charismaloyal.com; we answer within 30 days. In India you may also approach the Data Protection Board; in the EU your local data protection authority.