Legal

Privacy Policy

Last updated 2 October 2026

This policy explains what personal information AASHAS collects when you browse this website, create an account, place an order or contact us; why we collect it; who we share it with; and the choices and rights you have.

We collect what we need to make your piece, deliver it and look after you afterwards. We do not sell your personal information.

Who We Are

AASHAS (“Aashas”, “we”, “us”) is a designer boutique in Hyderabad, Telangana, India, and decides how and why your personal information is used. Under India’s Digital Personal Data Protection Act, 2023, that makes us the data fiduciary. You can reach us at care@aashas.in.

What We Collect

Information you give us

Account details — your name, email address, phone number and password. Passwords are stored only as a one-way hash. If you sign in with Google, we receive your name, email address and profile picture from Google instead of a password.
Delivery and billing details — the recipient’s name, phone number, address, city, state, PIN or postal code and country, for each address you save or enter at checkout, and your email address if you check out as a guest.
Order details — the pieces you order, sizes, notes and instructions you send us, coupons you use, and your order and invoice history.
Body measurements — where you choose custom sizing, the measurements you provide, such as bust, waist, hips and height. We treat these as sensitive and use them only to make your piece.
Messages — what you send us through the contact and support forms (your name, phone number, email address and message), by email, or on WhatsApp.

Information collected automatically

Technical information needed to serve the site securely, such as your IP address, browser and device type and the pages you request; the cookies and local storage described below; and, where analytics and advertising tools are in use, information about how you use the site.

Information from others

Razorpay tells us whether your payment succeeded, with a payment reference, amount and currency. Courier partners tell us where your parcel is.

What we never collect

We never see or store your card, UPI or net-banking credentials. Razorpay handles them directly.

How We Use It

To take your order, make your piece to your size or measurements, and deliver it or arrange its collection.
To take payment, and to process changes, cancellations, store credit and any refunds.
To send messages about your order — confirmation, progress, dispatch and tracking, invoices — and to reply when you contact us.
To run your account, saved addresses and order history.
To meet legal, tax and accounting obligations, including GST invoicing and record-keeping.
To keep the site and our customers safe from fraud and abuse, and to diagnose faults.
To understand how the site is used and to measure and improve our advertising, as described under Analytics and Advertising.

We do not send you marketing email unless you ask us to, and any we do send will include a way to unsubscribe.

We never use your photographs, measurements or messages to create the AI-generated imagery on this site, and the models in it are not real people. Our Legal Disclaimer explains how those images are made.

We share personal information only with the service providers who help us run the boutique, and only what each of them needs:

Razorpay — payment processing. Your name, email address and phone number are passed to its checkout.
Courier partners — delivery. They receive the recipient’s name, address and phone number and the parcel details. We choose the courier for each order.
Resend — sending our emails, such as order confirmations and invoices.
Google — if you choose to sign in with Google, and for Google Analytics, which measures how the site is used.
Meta — WhatsApp, if you choose to message us there, and for advertising measurement where the Meta Pixel is in use.
Cloudflare and Amazon Web Services — hosting, databases, file storage and image processing.
Sentry — error monitoring, so we can fix faults. It is configured not to receive IP addresses or request headers.
A PIN-code lookup service and a currency exchange-rate service — these receive only a PIN code or a currency code, never your identity.

We may also disclose information where the law requires it, or to establish or defend a legal claim.

Cookies and Local Storage

These are the cookies and browser storage the site itself sets. All of them are needed for the site to work; none is used for advertising.

Name	Type	Purpose	How long
aashas_session	Cookie	Keeps you signed in.	7 days, or until you sign out
aashas_auth_token	Local storage	Keeps you signed in on this device.	Until you sign out
aashas_cart_session, aashas_cart_session_id	Cookie, local storage	Remembers your bag before you sign in.	30 days (cookie); until cleared (local storage)
aashas_guest_checkout_email, aashas_guest_checkout_address	Local storage	Saves the details you typed at checkout as a guest, so a refresh does not lose them.	Until your order is placed, or you clear them
custom_measurements	Local storage	Holds custom measurements between the product page and checkout.	Until your order is placed
aashas_currency	Cookie	Remembers the currency you chose to view prices in.	1 year
aashas-oauth-state, aashas-oauth-redirect, aashas-oauth-frontend-origin	Cookie	Protects Google sign-in against forgery and returns you to the right page.	10 minutes
aashas_analytics_consent	Local storage	Remembers whether you allowed or declined Google Analytics.	Until you change it or clear it
buddy_posthog_id	Local storage	A random id that lets us count how Buddy is used, without knowing who you are.	Until cleared
buddy_notice_seen	Local storage	Remembers that you have read Buddy's notice, so it is not shown again.	Until cleared

You can clear cookies and local storage in your browser settings at any time. Doing so signs you out and empties your bag.

Analytics and Advertising

We use Google Analytics to understand how visitors find and use the site and to measure and improve our advertising on Google. It receives information about your visit — the pages you view, your device and browser, your approximate location derived from your IP address, and actions such as adding a piece to your bag or completing an order. We do not send it your name, email address or phone number. Google processes this information under its own privacy policy.

Google Analytics sets two cookies: _ga, which tells one browser from another, and _ga_*, which keeps track of the current visit. Both last up to two years.

If you visit from the European Economic Area, the United Kingdom or Switzerland, we ask before Google Analytics sets any cookies. Wherever you are, you can allow or decline it from Cookie preferences at the foot of any page, and change your choice at any time; declining removes the Google Analytics cookies already set. You can also use the Google Analytics opt-out browser add-on.

We may later use the Meta Pixel to measure our advertising on Facebook and Instagram, and will update this page when we do. You can manage how Meta uses your information in your Meta ad preferences.

Buddy, Our AI Assistant

Buddy is an AI assistant on this site. It answers questions about our opening hours, our policies and your orders, and passes other questions to our team. It can be wrong. The cards it shows quote our own verified wording; where Buddy and a card differ, the card is right.

What Buddy collects

What you type to Buddy, and its replies.
If you look up an order: the order number and the email or phone number you enter. These are checked by our own systems and are never sent to the AI provider.
A random conversation id, the time of each message, and a random browser id used only to count usage.

Please do not share card numbers, passwords or other sensitive details in the chat. Phone numbers, email addresses, card numbers and PIN codes you type are removed (replaced with “[redacted]”) before a conversation is saved in our records or in our diagnostic traces. While the conversation is going on, the assistant keeps it as typed so that it can follow what you said.

Who processes it

Meta — the AI model that writes Buddy’s replies. It receives your messages and the conversation so far, on Meta’s systems, which may be outside India. Meta may use these messages and Buddy’s replies to train its AI models — that is the basis on which we use it. Please don’t share anything in the chat you would not want used this way.
Cloudflare — hosting, the gateway that routes requests to the AI model, and the storage of the conversation in progress.
Langfuse — diagnostic traces of how each reply was produced, with the details above removed.
Sentry — error reports, which carry ids but not what you typed.
PostHog — counting how Buddy is used, by the random ids above and never by what you typed.

How long it is kept

Conversations — 90 days after your last message, then deleted, both from our records and from the conversation store.
A question Buddy passed to our team — until we answer it, then 90 days. If our answer could help other customers, we keep the question (with your details removed) and our answer — not the rest of your conversation.
Traces and error reports — for the period set in those services, and no longer than we need them.

To have a conversation with Buddy deleted sooner, email care@aashas.in with roughly when it took place and what it was about, so that we can find it. We will delete it from our records, the conversation store and our traces.

International Transfers

We are based in India and ship worldwide. Your information is processed in India and by the service providers above, some of which store or process data in other countries. Where you order from outside India, customs authorities in your country may also need your delivery details to clear your parcel.

How Long We Keep It

Orders, invoices and payment records — for as long as Indian tax and accounting law requires, currently up to eight years.
Body measurements — with the order they were given for. Ask us and we will delete them, except where they form part of a record the law requires us to keep.
Your account and saved addresses — while your account is open, and deleted when you ask us to close it.
Enquiries and support messages — for up to three years.
Analytics and advertising data — for the period set in those tools, and no longer than we need it.

Your Rights

Under the Digital Personal Data Protection Act, 2023, and other laws that may apply to you, you can ask us to:

tell you what personal information we hold about you and how we use it;
correct, complete or update it;
delete it, and close your account, unless the law requires us to keep it;
withdraw a consent you gave — this does not affect what we did before you withdrew it;
nominate someone to exercise these rights for you if you are unable to; and
hear and resolve a grievance about how we have handled your information.

If you live in the European Union or the United Kingdom, you also have the rights your local law gives you, including to object to or restrict our use of your information, to receive a copy of it in a portable form, and to complain to your data protection authority.

To exercise any of these rights, email care@aashas.in. We may need to verify your identity first, and we will respond within one month.

Children

This site is for adults, and we do not knowingly collect personal information from anyone under 18.

When you order a piece for a child, the measurements you give us describe that child. By giving them, you confirm that you are the child’s parent or guardian and agree to our using them to make that piece. We use them for nothing else, and we do not track children or direct advertising at them.

Security

The site is encrypted in transit, passwords are stored only as hashes, payment credentials never reach our systems, and access to customer information is limited to the staff who need it. No system is perfectly secure; if a breach affects your personal information, we will tell you and the Data Protection Board of India as the law requires.

Contact and Grievances

For any question about this policy, or to exercise your rights, contact our Grievance Officer. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Grievance Officer
Anitha Kommareddy, Founder
AASHAS, 377, Road No. 10, Jubilee Hills, Hyderabad, Telangana 500033, India
Email: care@aashas.in
Phone and WhatsApp: +91 99899 90983

We acknowledge every complaint within 48 hours and aim to resolve it within one month of receiving it.

Changes to This Policy

We will update this policy when what we collect, or the law, changes. The date at the top shows when it last changed, and we will highlight material changes on this page.