Introduction
Welcome to OVIA. We value the trust you place in us when browsing our collections, creating an account, purchasing products, or communicating with our customer support team.
This Privacy Policy explains how OVIA collects, processes, uses, stores, shares, protects, and manages personal information through its website and related services.
OVIA is committed to handling personal information responsibly, maintaining transparency, limiting unnecessary data collection, and protecting customer confidentiality.
By using OVIA, you acknowledge this Privacy Policy. Where applicable law requires consent, we will request it separately.
1. Information We Collect
1.1 Personal Information
Depending on your interactions with OVIA, we may collect:
- Full name
- Email address
- Mobile number
- Billing and shipping addresses
- Postal code, city and state
- Account preferences
- Customer support communications
We collect information for legitimate purposes associated with providing our services.
1.2 Account and Authentication Information
When registering or signing into an OVIA account, we may process:
- Registered email address
- Password authentication information
- Email verification codes
- Authentication session identifiers
- Account creation and login timestamps
- Security-related account activity
- Information received through supported Google sign-in
Authentication credentials must be appropriately secured. Verification codes must not be disclosed to unauthorized parties. Passwords should be stored using secure one-way hashing rather than plaintext.
1.3 Order and Transaction Information
For purchases, OVIA may collect and maintain:
- Order number and associated customer identifier
- Purchased products and selected variants
- Quantities and prices
- Discounts and applicable taxes
- Order confirmation and payment status
- Shipping and delivery information
- Cancellation and return records
- Exchange requests
- Refund details and status
- Invoice and transaction records
This information is used to administer the customer's purchase and related services.
1.4 Product Reviews and Customer Submissions
Where these features are available, OVIA may collect product ratings, reviews, support attachments, return photographs, exchange photographs, and written feedback.
Customers should upload only information relevant to their request and must not submit unnecessary sensitive personal information. Approved public reviews may display the customer's chosen display name and submitted review content.
2. Payment Information and Financial Security
OVIA may use Razorpay or other authorized payment providers to facilitate payments. Supported payment options may include UPI, debit cards, credit cards, net banking, and other methods offered during checkout.
OVIA may receive:
- Payment transaction identifier
- Payment status
- Payment method category
- Transaction amount
- Payment confirmation
- Refund reference and status
- Limited transaction metadata
Payment Security Rules
- Complete card numbers, CVV values, UPI PINs, and banking passwords must not be collected or stored by OVIA's application.
- Customers must enter sensitive payment credentials only through authorized payment interfaces.
- Payment status must be verified using trusted server-side payment confirmation mechanisms.
- An order must not be marked as paid merely because the customer reaches a success page.
- Refunds must be processed through approved payment mechanisms with proper authorization.
- Payment records must be accessible only to authorized personnel for legitimate operational purposes.
- Payment providers may independently process customer information under their own privacy policies.
3. How OVIA Uses Customer Information
OVIA processes information for the following purposes:
Shopping and Orders
- Managing shopping bags and checkout
- Confirming payments and purchases
- Generating invoices
- Maintaining order histories
- Processing applicable discounts
- Coordinating order fulfillment
Shipping and Delivery
- Verifying delivery information
- Creating shipment requests
- Sharing necessary details with couriers
- Tracking shipment progress
- Managing failed delivery attempts and exceptions
Customer Support
- Receiving customer inquiries
- Processing complaints
- Handling cancellation requests
- Evaluating return and exchange requests
- Managing eligible refunds
- Maintaining relevant communication records
Security and Operations
- Detecting suspected fraud
- Preventing unauthorized account access
- Investigating suspicious activities
- Maintaining system reliability
- Troubleshooting technical problems
- Complying with applicable legal requirements
Personal information must not be used for unrelated purposes without an appropriate legal basis.
4. Sharing Information With Service Providers
OVIA shares only information reasonably necessary to operate its services.
4.1 Delivery and Logistics
When Delhivery or another authorized delivery partner handles an order, relevant information may include:
- Recipient name
- Shipping address
- Contact number
- Package and shipment details
- Delivery instructions
- Order reference
Delivery partners may process this information to fulfill shipments, provide tracking updates, resolve delivery exceptions, and meet their legal obligations.
4.2 Payment Providers
Relevant transaction information may be shared with Razorpay or another configured payment service for transaction processing, verification, fraud prevention, and refunds.
4.3 Hosting and Technical Infrastructure
OVIA may use third-party providers for website hosting, databases, cloud storage, authentication, email delivery, search, analytics, and security. Depending on the configuration, these may include Vercel, MongoDB Atlas, Resend, Algolia, and other providers. These providers may process information necessary to provide their respective services.
4.4 Restrictions on Information Sharing
OVIA's operational policy is to:
- Never sell customer personal information.
- Never provide customer passwords or OTPs to marketing partners.
- Never grant unrestricted access to customer records for unrelated purposes.
- Limit access to business-authorized systems and personnel.
- Disclose information in response to valid legal obligations when required.
5. Customer Account Security
Customer accounts must be protected with appropriate authentication and session-management controls.
Security protections should include:
- Secure password hashing
- Verification-code expiry
- One-time verification-code use
- Limits on verification attempts
- Resend controls and abuse prevention
- Secure authentication cookies
- Session invalidation when appropriate
- Authorization checks for protected pages
- Restricted administrative access
Customer Responsibilities
- Customers must maintain the confidentiality of passwords, verification codes, and account access.
- Customers must promptly report suspected unauthorized access.
- OVIA support representatives must never ask customers to disclose passwords, UPI PINs, card security codes, or active login OTPs.
6. Customer Communications
OVIA may communicate with customers through registered email addresses, website notifications, account dashboards, and other enabled support channels.
6.1 Transactional Communications
These may include:
- Account verification
- Login and security notifications
- Order confirmation
- Payment confirmation or failure
- Invoice availability
- Shipment creation
- Tracking updates
- Delivery status changes
- Cancellation updates
- Return and exchange decisions
- Refund initiation and completion
- Important service notices
Transactional communications may be necessary to deliver the services requested by customers.
6.2 Promotional Communications
- Marketing messages must be sent only where permitted by law and in accordance with applicable consent requirements.
- Customers must be provided an appropriate way to opt out of promotional communications.
- Opting out of promotional messages will not necessarily stop essential order-related or security communications.
6.3 Communication Conduct
All OVIA customer communications must follow professional standards:
- Messages must be respectful, accurate, and relevant.
- Communications must not contain misleading payment or shipping claims.
- Customers must not be asked for confidential authentication credentials.
- Order and refund references must be verified before disclosing account-specific information.
- Sensitive personal information must not be unnecessarily included in messages.
- Staff must not threaten, harass, or discriminate against customers.
- Customers must be given an appropriate way to raise unresolved complaints.
OVIA may retain relevant communications for legitimate support, dispute resolution, and security purposes.
7. Order, Cancellation, Return, Exchange and Refund Information
7.1 Order Processing
Customer and transaction information may be processed from checkout through order confirmation, packing, dispatch, delivery, and post-delivery support.
7.2 Cancellations
Where permitted by OVIA's published cancellation policy and applicable law, customers may request cancellation. OVIA may record cancellation reasons, timestamps, request status, and associated refund information.
7.3 Returns and Exchanges
Customers may be asked for information reasonably necessary to evaluate a request, including:
- Order number
- Product details
- Reason for return or exchange
- Relevant photographs
- Requested resolution
- Pickup address, where applicable
Photographs and attachments must be used for legitimate verification and support purposes.
7.4 Refunds
OVIA may process and store refund transaction references, approval statuses, payment-provider responses, and related communications.
Refund approval, processing, and settlement are separate stages. A refund must not be described as completed until confirmation has been received from the appropriate payment or financial system. Actual eligibility and timelines are governed by OVIA's published policies, applicable law, and payment-provider processes.
8. Administrative Access and Confidentiality
OVIA's administrative systems may contain confidential customer and business information. Administrative access must be limited to properly authenticated and authorized personnel.
Security rules include:
- Customer account data must not be publicly exposed.
- Admin privileges must be enforced on the server, not merely hidden in the interface.
- Unauthorized users must not view order addresses, payment details, or support records.
- Administrative actions involving sensitive information should be logged.
- Payment credentials, API secrets, and database passwords must not be exposed in frontend code.
- Personal information must not be exported for unrelated use.
- Access must be revoked when no longer required.
- Sensitive operations should require appropriate authorization and verification.
OVIA must investigate suspected misuse of administrative access and take appropriate corrective measures.
9. Cookies and Tracking Technologies
OVIA may use cookies or similar mechanisms to support:
- Login sessions
- Shopping bag functionality
- Checkout continuity
- Website security
- Customer preferences
- Performance measurement
- Search and product discovery
- Analytics and permitted marketing
Essential cookies may be required for core website features. Where legally required, non-essential cookies must not be activated before valid consent.
Customers may manage available cookie preferences through website controls or browser settings. Disabling certain cookies may affect website functionality.
10. Data Security Measures
OVIA aims to apply safeguards appropriate to the type and sensitivity of information processed.
Such safeguards may include:
- HTTPS encryption for transmitted information
- Secured database access
- Restricted infrastructure permissions
- Protection of application secrets
- Server-side authorization
- Secure session management
- Input validation
- Monitoring of suspicious activities
- Software security updates
- Backup protection
- Incident investigation procedures
No online system can guarantee complete protection against every security risk. Security arrangements must be reviewed as OVIA's infrastructure and services evolve.
11. Data Retention
OVIA retains personal information only as long as reasonably necessary for disclosed business purposes and applicable legal obligations.
Retention needs may differ for:
- Customer accounts
- Order and payment records
- Invoices and tax records
- Shipment information
- Returns and refunds
- Customer support requests
- Authentication and security logs
- Marketing preferences
Information that is no longer required should be securely deleted or anonymized where appropriate. Certain transaction information may be retained where necessary for legal compliance, financial records, fraud prevention, or dispute resolution. Backup copies may remain temporarily until their applicable retention and deletion cycles are completed.
12. Customer Privacy Rights
Depending on applicable law, customers may be entitled to:
- Request information about their personal data
- Access eligible personal information
- Request correction of inaccurate details
- Request deletion of eligible information
- Withdraw consent where applicable
- Raise privacy-related grievances
- Exercise other rights available under applicable law
Requests may require reasonable identity verification to prevent unauthorized disclosure. Some information cannot immediately be deleted where retention is required under applicable law. OVIA must respond to valid privacy requests according to applicable legal requirements.
13. Children's Privacy
OVIA does not knowingly process children's personal information in violation of applicable law. Where age-based consent or other protections are required, OVIA must implement the necessary safeguards.
Parents or legal guardians may contact OVIA regarding concerns about a child's personal information.
14. Security Incidents and Data Breaches
When OVIA becomes aware of a suspected personal data breach, the matter must be assessed promptly.
The response process should include:
- Identifying and containing the incident.
- Restricting further unauthorized access.
- Assessing affected systems and information.
- Preserving necessary evidence.
- Investigating the cause.
- Taking appropriate corrective measures.
- Informing affected individuals and authorities where required by law.
- Reviewing security controls to reduce recurrence.
Notifications must not knowingly misrepresent the scope or seriousness of an incident.
15. Legal Compliance in India
OVIA will seek to handle personal information in accordance with the laws of India applicable to its activities. Relevant legal frameworks may include the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, and applicable consumer protection requirements, subject to their respective commencement provisions and applicability.
Where consent is required, OVIA must provide appropriate notices and obtain valid consent. Where applicable law requires a grievance redressal mechanism, OVIA must provide an accessible method for submitting and resolving grievances.
Nothing in this Privacy Policy limits mandatory rights available to consumers under applicable law.
16. International Data Processing
Some technology service providers may operate infrastructure outside India. Where OVIA uses such services, personal information may be processed in other jurisdictions to the extent reasonably necessary.
Any international processing or transfer must comply with applicable legal restrictions and safeguards.
17. Third-Party Websites and Services
OVIA may provide links to payment interfaces, courier tracking pages, or other third-party services. These services may maintain independent privacy policies and security practices.
Customers should review the applicable privacy information when interacting directly with a third-party service.
18. Changes to This Policy
OVIA may update this Privacy Policy to reflect operational changes, new services, security improvements, or legal requirements.
The most recent version will be published on the website with an updated revision date. Where applicable law requires additional notice or consent, OVIA will follow those requirements.
19. Contact, Privacy Requests and Grievances
Customers may contact OVIA for:
- Personal information inquiries
- Account privacy concerns
- Requests for correction or deletion
- Unauthorized account activity
- Payment-related privacy concerns
- Order information concerns
- Support complaints
- Privacy-related grievances
Official Contact Information
- Business Name: OVIA
- Website: https://www.ovias.shop
- Privacy Email: privacy@ovias.shop
- Customer Support: support@ovias.shop
- Business Address: OVIA Retail, Mumbai, Maharashtra, India
- Grievance Officer: Designated Grievance Officer
- Grievance Contact: grievance@ovias.shop
OVIA will acknowledge and resolve grievances within the timelines required by applicable law.
Our Commitment to Customers
OVIA believes that privacy, transparency, responsible communication, and security are essential to a trustworthy shopping experience.
We aim to protect customer information, respect applicable privacy rights, maintain appropriate security safeguards, and communicate clearly throughout the customer journey.
OVIA — Crafted for the Journey.