Privacy Policy

Last Revised: 18th June 2026

Effective Date: 18th June 2026

PREAMBLE

This Privacy Policy explains how LastMen LLP ("we", "us", "our", "Lore") collects, uses, and protects your personal information when you use our website urbanlore.in and Shopify store (the "Website") or purchase from us.

We are committed to protecting your privacy and being transparent about our data practices. This Policy complies with the Digital Personal Data Protection Act 2023, Information Technology Act 2000, and Consumer Protection Act 2019.

By using our Website, you agree to this Privacy Policy. If you do not agree, please do not use our Website.

---

1. WHAT INFORMATION WE COLLECT

We collect the following types of information:

Information You Provide:

- Name, email address, phone number

- Delivery address and billing address

- Date of birth and gender

- Payment information (processed through Razorpay - we do NOT store full card details)

- Order history and preferences

- Communications you send us (emails, support tickets)

- Reviews and feedback you submit

Information Collected Automatically:

- IP address and approximate location (city/region level)

- Device type, browser type, operating system

- Pages you visit, time spent on each page

- Products you view and add to cart

- Purchase history

- Cookie data (see Section 7)

Information from Third Parties:

- If you link your social media account (Meta, Google), we receive your username, profile photo, email, and friends list

- Shipping partner may provide delivery status and location tracking

- Razorpay provides payment authorization status

---

2. WHY WE COLLECT THIS INFORMATION

We collect and use your personal data for the following purposes:

Order Fulfillment:

- To process your orders and ship products to you

- To send order confirmations, shipping updates, and delivery notifications

- To manage returns and refunds

- We retain this data for 7 years (required by Income Tax Act and GST Act)

Account Management:

- To create and maintain your account

- To authenticate you and prevent unauthorized access

- We retain this data for as long as your account is active plus 1 year after closure

Payment Processing:

- To authorize and process payments through Razorpay

- Razorpay handles all payment data encryption

- We do NOT store your full card number, CVV, or bank password

- We retain payment records for 7 years (RBI requirement)

Fraud Detection:

- To identify and prevent fraudulent orders

- To protect you and other customers from fraud

- We retain fraud investigation data for 2 years

- Fraud flags may require additional verification (OTP, identity confirmation)

Customer Support:

- To respond to your questions and resolve issues

- To track support tickets and improve service

- We retain support records for 1 year after resolution

Personalized Recommendations:

- To suggest products you may like based on your browsing and purchase history

- To improve your shopping experience

- We retain browsing data for 12 months (anonymized data kept indefinitely)

Analytics & Platform Improvement:

- To understand how you use our Website

- To identify bugs and improve performance

- To analyze traffic patterns and user behavior

- We retain analytics data for 12 months

Marketing Communications (only with your consent):

- To send newsletters and promotional offers

- You can unsubscribe anytime

- We do NOT send marketing without your explicit consent

- We do NOT share your email with third parties for marketing

---

3. HOW WE PROTECT YOUR DATA

Security Measures:

- All data transmitted to our Website is encrypted using SSL/TLS encryption (HTTPS)

- Payment data is processed through Razorpay's PCI-DSS compliant servers

- We use firewalls and intrusion detection systems

- We regularly update software and patch security vulnerabilities

- Access to your data is restricted to employees who need it

- We conduct regular security audits

Important Limitations:

- No security is 100% foolproof

- Internet transmission carries inherent risk

- We are not liable for breaches caused by third parties beyond our control

- If you suspect unauthorized access to your account, change your password immediately and email lorekeepers@urbanlore.in

---

4. WHO WE SHARE YOUR DATA WITH

We only share your data with trusted partners necessary to operate our business:

Shipping Partners:

- We share your name, address, phone, and order details with logistics partners to deliver your packages

- They are contractually bound to keep your data confidential

- They cannot use your data for marketing or other purposes

Razorpay (Payment Gateway):

- We share payment information with Razorpay to process payments

- Razorpay is PCI-DSS compliant and handles all card data encryption

- We do NOT receive or store your full card details

- Razorpay may be required to share information with your bank and card networks

Shopify (Website Hosting):

- Your account data is stored on Shopify's servers

- Shopify has strict data protection agreements in place

- Shopify's privacy policy applies to their data handling

Customer Support:

- Internal support team has access to your email, order history, and communications

- Support data is only used to resolve your issues

Law Enforcement & Government:

- If legally required by court order, government agency, or law enforcement, we may share your data

- We will notify you unless prohibited by law

What We Do NOT Do:

- We do NOT sell your data to third parties

- We do NOT share your email with marketers or data brokers

- We do NOT share your phone number with telemarketers

- We do NOT use your data for credit or employment decisions

- We do NOT allow third parties to scrape your reviews or profile

---

5. DATA RETENTION & DELETION

We retain your data for specific periods based on the purpose:

Order History: 7 years (required by Income Tax Act and GST Act)

Payment Records: 7 years (required by RBI)

Account Information: While account is active + 1 year after closure

Support Tickets: 1 year after issue resolution

Browsing & Analytics: 12 months (older data anonymized)

Fraud Investigation: 2 years (statute of limitations)

Device/IP Logs: 3 months (security audit purposes)

Marketing Consent: Until you unsubscribe

If You Request Deletion:

You can request deletion of your personal data by emailing lorekeepers@urbanlore.in with "Data Deletion Request".

We will delete your data within 30 days, EXCEPT:

- Data required by law (tax records, court orders)

- Data needed for pending disputes or investigations

- Anonymized data (cannot be linked back to you)

Account Closure:

To close your account, email lorekeepers@urbanlore.in with "Account Closure Request".

Your account will be deactivated immediately.

Order history is retained for 7 years (tax requirement).

Other personal data is deleted per the retention schedule above.

Inactive Accounts:

Accounts inactive for 24+ months may be anonymized or deleted.

We will send a 30-day notice before doing this.

---

6. COOKIES

What are Cookies?

Cookies are small files stored on your device that help us recognize you and provide personalized features.

How We Use Cookies:

Essential Cookies (Always On - No Choice Needed):

- Session ID: Keep you logged in while browsing

- Security token: Prevent unauthorized access

- Checkout security: Protect payment data

Functional Cookies (You Can Choose):

- Remember preferences: Language, theme, saved items

- Analytics: Measure feature usage

Marketing Cookies (You Can Choose):

- Advertising networks: Show relevant ads elsewhere

- Retargeting pixels: Remind you of abandoned carts

- Analytics: Track behavior for recommendations

Your Cookie Choices:

- On your first visit, you'll see a cookie consent banner

- You can choose to accept all or manage individual categories

- You can change your preferences anytime in Settings > Privacy > Cookies

- You can also manage cookies through your browser settings

- Disabling non-essential cookies does NOT prevent checkout or account login

---

7. YOUR DATA RIGHTS (DPDP Act 2023)

You have the following rights regarding your data:

Right to Know:

- You can request a copy of all personal data we hold about you

- Email: lorekeepers@urbanlore.in with "Data Access Request"

- We will provide data within 30 days at no cost

- One free request per calendar year

Right to Correct:

- You can correct inaccurate or incomplete data

- Option 1: Login and edit your profile directly

- Option 2: Email lorekeepers@urbanlore.in with details

- We will make corrections within 15 days

Right to Deletion:

- You can request the deletion of your personal data

- Email: lorekeepers@urbanlore.in with "Data Deletion Request"

- We will delete within 30 days (except legally required data)

- Cannot be undone - deleted data cannot be recovered

Right to Withdraw Consent:

- You can stop any specific use of your data

- Email: lorekeepers@urbanlore.in with what you're opting out of

- Examples: "Stop marketing emails"

- We will process within 7 days

- May affect your experience (e.g., no personalized suggestions)

Right to Data Portability:

- You can request your data in a portable format (CSV or JSON)

- Email: lorekeepers@urbanlore.in with "Data Portability Request"

- We will provide within 30 days

---

8. CHILDREN'S DATA

Our Website is intended for adults (18+ years). We do NOT knowingly collect data from children under 18 without parental consent.

If you are under 18:

- You need your parent or guardian's permission to use our Website

- Parents can contact us to delete their child's data

If you are a parent/guardian:

- We will delete your child's data within 30 days upon request

- Email: lorekeepers@urbanlore.in with "Child Data Deletion"

---

9. THIRD-PARTY LINKS

Our Website may contain links to external websites. We are NOT responsible for their privacy practices.

Please read the privacy policies of any third-party websites before providing your data.

If you link your social media account to our Website, that platform's privacy policy applies to their data handling.

---

10. AUTOMATED DECISIONS & ALGORITHMS

We use automated systems in the following ways:

Personalized Recommendations:

- Our algorithm analyzes your purchase and browsing history

- It shows you products similar to what you've viewed or purchased

Fraud Detection:

- Our system automatically flags suspicious orders for review

- Examples: Multiple orders in minutes, unusual locations, payment failures

- Flagged orders may require additional verification (OTP, selfie)

- If you believe you were incorrectly flagged, email lorekeepers@urbanlore.in with your order number

You Have Rights:

- You can request explanation of any automated decision within 7 days

- You can request human review instead of automated flagging

- You can appeal if you disagree with the decision

---

11. DATA BREACH NOTIFICATION

If we discover a data breach that exposes your personal information:

What We Will Do:

- Notify you via email within 72 hours of discovery

- Explain what data was breached and potential risks

- Provide steps you should take

- Notify relevant authorities if required

Your Rights:

- Right to know details of the breach

- Right to claim damages if we were negligent

- Right to escalate to the Data Protection Board of India

---

12. INTERNATIONAL TRANSFERS

Our Website is hosted on Shopify's servers. Shopify may process and store data on servers located outside India.

By using our Website, you consent to:

- International transfer of your data

- Processing by international companies

- Storage on non-India servers (where necessary)

---

13. GRIEVANCE & COMPLAINTS

Data Protection Officer:

Name: Sumit Jha

Email: lorekeepers@urbanlore.in

Response Time: Acknowledgment within 48 hours; resolution within 30 days

How to File a Complaint:

1. Email lorekeepers@urbanlore.in with "Data Privacy Complaint"

2. Include: What happened, what data is involved, what you want done

3. We will respond within 30 days

---

14. POLICY UPDATES

We may update this Privacy Policy at any time to:

- Reflect changes in law

- Add new features or processors

- Improve clarity

How We Notify You:

- Minor changes: Posted with new date

- Continued use after notice = you accept new policy

Current Version: Updated 18th June 2026

---

15. CONTACT US

For any privacy-related questions or requests:

Email: lorekeepers@urbanlore.in

Website: urbanlore.in

Data Protection Officer: Sumit Jha

Please include in your email:

- Subject: Clear (e.g., "Data Access Request", "Privacy Complaint")

- Order number (if applicable)

- Detailed description of your concern

We will respond within the timeframes mentioned in this policy.

---

ACKNOWLEDGEMENT

By using our Website or providing your information, you acknowledge that:

1. You have read and understood this Privacy Policy

2. You consent to collection, use, and sharing of your data as described

3. You understand your rights under DPDP Act 2023

4. You can withdraw consent or request deletion anytime

5. You accept that we may update this policy

If you do NOT agree, please do not use our Website.

---