Privacy Policy

1. Who holds your data

Desi Tekai Business Solutions Private Limited, trading as The Gud Co, is the Data Fiduciary. Registered office: 80/69 Nyay Path, Madhyam Marg, Mansarovar, Jaipur, Rajasthan, India, 302020. GST: Not registered under GST. Contact: founder@thegudco.in.

The person you may write to for privacy and grievance requests is Saumya Dutta (founder@thegudco.in). For a small D2C brand this person also acts as the point of contact for Data Principal requests under the DPDP Act, 2023.

2. What we collect

When you order: name, email, 10-digit Indian mobile, shipping address (street, city, state, PIN), optional delivery notes, the packs you bought, and amounts (including the mill-share figure we print).

When you write to us: whatever you put in the email thread.

When you use the site: standard device and log data a host may keep (IP address, browser, pages). This local build also stores a cart, a catalogue overlay, and orders in your browser’s localStorage so the shop can work without a database. That copy lives on your device unless you later connect a real backend.

We do not ask for Aadhaar, PAN, or card numbers on our own forms. A live payment gateway will collect payment credentials on its own page under its own privacy notice.

3. Why we collect it (purpose and lawful use)

We use order data to accept the order, pack it, hand it to a courier, talk to you about dispatch, handle refunds and replacements, keep accounts, and respond to grievances. That processing is necessary to perform the contract you offered when you checked out, and to meet legal duties (tax, consumer, food safety follow-up).

If we ever send marketing mail beyond order updates, we will do so only with your consent or as otherwise allowed under the DPDP Act, 2023, and you can withdraw that consent as easily as it was given.

We do not sell personal data. We do not use it to train a public model. We do not run a credit bureau.

4. Who we share it with

Indian payment aggregators, when live, to take prepaid payment and issue refunds.

Logistics partners, to print a label and attempt delivery.

Professional advisers and statutory authorities when Indian law requires it (for example a GST officer, a consumer commission, or a police request with lawful authority).

Processors who host email or the website, bound to use the data only on our instructions.

We do not share farmer-story photographs of you; those portraits on the site are of named producers who work with us, not of customers.

5. Retention and security

Order and invoice records are kept as long as tax and company law require, and then deleted or archived so they are no longer used for selling. Browser localStorage on this demo build stays until you clear the site data.

We use HTTPS on a live host and limit who can open the shop’s inbox. No small food brand should promise “military-grade” encryption. We will notify you and the Data Protection Board as the DPDP Act, 2023 requires if a personal-data breach is likely to cause harm.

6. Your rights under the DPDP Act, 2023

You may ask for a summary of the personal data we hold about you, correct it, update it, and — where the Act allows — erase it or withdraw consent. You may nominate another person to exercise rights in the event of death or incapacity, when the Act’s machinery for that is in force.

Write to founder@thegudco.in with “Data request” in the subject. We may need enough detail to find your order (mobile and order id). We will not erase data we must keep for tax law, a live dispute, or fraud prevention.

You may also complain to the Data Protection Board of India once it is receiving such complaints, and you retain consumer-forum rights under the Consumer Protection Act, 2019.

7. Children

The shop is not directed at children under 18. We do not knowingly sell to a child as the contracting party. A parent may order food for a household. If you believe we have collected a child’s personal data without verifiable parental consent as the DPDP Act requires, write to the grievance officer and we will delete it where the Act so requires.

8. Cookies

This build uses the browser’s own storage for cart and admin overlays. A live host may add a session cookie or an analytics cookie. We will not drop non-essential tracking cookies without a fair notice. Third-party payment pages set their own cookies.

9. IT Act, 2000

Intermediary and reasonable-security obligations under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 continue to inform how we handle passwords and payment-adjacent data until they are fully displaced by DPDP rules. We do not publish a fake list of “SPDI clauses” copied from a US privacy policy.

10. Changes and governing law

This policy was last updated on 24 August 2026. We will post revisions here. Indian law governs this notice. Privacy complaints may be sent to the grievance officer; jurisdiction for legal proceedings follows the Terms.