HAIRSHALOWorking draft. Some of the business details this policy needs have not been provided yet. They are marked on the page rather than filled in with guesses.
This page sets out what personal data this website collects, why, who it is shared with, how long it is kept, and how to use your rights.
Who we are
This policy explains how Hairshalo handles personal data when you use this website and buy from it. In the language of India's Digital Personal Data Protection Act, 2023, Hairshalo is the Data Fiduciary for the personal data described here.
Business name:
Address:
Email:
Phone:
Questions about your personal data can be sent to . We have not appointed a Data Protection Officer; that email address reaches a person who can answer on Hairshalo's behalf.
What we collect, and why
We collect only what the part of the site you are using needs. Each item below is something this website actually collects.
| What | When | Why |
|---|---|---|
| Name, email address, optional phone number, password (stored only as a one-way hash) | When you create an account | To create and run your account, let you sign in, show your orders and saved addresses, and keep your loyalty points |
| Delivery name, phone number and address; your email; the items, amounts and payment status of the order | When you place an order | To process, deliver and support your order, and to keep the records of the sale |
| Saved delivery addresses | If you choose to save one in your account | To fill in checkout for you next time |
| Payment reference and status | When you pay | To match your payment to your order. Card and UPI details you enter on the payment provider’s form go to that provider, not to us |
| Your name, email address and review text | If you write a review | To publish the review (your name and text are shown; your email is not) and to contact you about it |
| Email address, the name you give (if any), the time you subscribed and confirmed, and the IP address used | If you sign up for emails | To send the emails you asked for, and to keep a record of your consent. You confirm through a link we email you before anything is sent |
| Copies of the emails we send you (recipient and content) | Whenever we email you about an account or order | To know what was sent and whether it was delivered |
| IP address, the page or address requested, time and response | On every request to our servers | To keep the site secure, limit abuse (for example repeated sign-in attempts) and fix faults |
What we do not collect
- Try-on photos. A selfie you use in the try-on preview is read by your own browser and is never uploaded to us or stored.
- Quick-answer questions. The quick-answer helper runs in your browser; what you type is not sent to us.
- Tracking. This site uses no analytics, advertising or social-media tracking.
Storage in your browser
The site keeps a few small items in your browser so that it works — your bag, your sign-in, a payment in progress. None of them is used for advertising or tracking. The Cookie Policy lists every one.
How long we keep it
We keep personal data for as long as the purpose it was collected for needs it, and then delete it, unless a law requires us to keep it longer.
- Order and payment records: To be provided: retention period for order and payment records, as required by tax and accounting law.
- Accounts and saved addresses: To be provided: retention period for inactive accounts.
- Email subscriptions: until you unsubscribe; the record of your consent: To be provided: how long the consent record is kept after unsubscribing.
- Records of processing and server logs: at least one year, as the Digital Personal Data Protection Rules, 2025 (rule 8(3)) will require once in force.
Your rights and choices
- See and correct your details. Signed in, you can view and update your profile and saved addresses yourself.
- Stop marketing emails. Every marketing email has an unsubscribe link. Withdrawing is as easy as signing up was, and it does not affect your orders or account.
- Ask for a copy, a correction or erasure of your personal data, or nominate someone to act for you, by emailing from the email address on your account (or giving your order number).
- Complain. Tell us first at the same address. We will respond within To be provided: response period for privacy requests and grievances — no more than 90 days. You can also complain to the Data Protection Board of India.
Account deletion is not yet available as a button on the site; until it is, it is done on request.
Children
This shop is meant for adults. If you are under 18, please do not create an account or place an order yourself; a parent or guardian can order for you.
How we protect it
Passwords are stored only as one-way hashes, never in a form anyone can read. The site is served over an encrypted (HTTPS) connection, and access to order and customer data is limited to signed-in shop staff.
If a breach of personal data occurs, we will tell the people affected and the Data Protection Board of India, as the law requires.
The law this follows
This policy is written for India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (notified 13 November 2025). Most of their obligations come into force eighteen months after notification.
Changes to this policy
If we change how we use personal data, we will update this page and its date.