Privacy Policy

StreetSouls ("we", "us", "our") is an independent Indian streetwear brand operating through streetsouls.in. We are committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data. By using our website or placing an order, you agree to the practices described here.

We collect the following categories of personal information: Account Information (when you register or sign in): • Email address • Name (as provided during account setup) Order Information (when you place an order): • Full name • Phone number (10-digit Indian mobile number) • Delivery address (flat/house, street, city, state, pincode) • Email address (optional, for order confirmation) • Order details (products, sizes, quantities, amounts) Payment Information: • We do not store any payment card numbers, CVV, UPI IDs, or bank account details. • All payment processing is handled securely by Cashfree Payments (https://cashfree.com), a PCI-DSS compliant payment gateway. Cashfree's own privacy policy governs the data you provide during checkout. • We only receive a payment confirmation reference (order ID and status) from Cashfree. Usage Information: • Basic server logs (IP address, browser type, pages visited) for security and performance purposes only. These are not linked to your identity and are not used for advertising.

We use your personal information solely for the following purposes: • Processing and fulfilling your order • Sending order confirmation and shipping updates via email • Coordinating delivery through our logistics partner (Shiprocket) • Providing customer support and responding to queries • Verifying payment status and handling refunds • Maintaining records for accounting and legal compliance • Detecting and preventing fraud or abuse We do not use your data for advertising, behavioural tracking, or profiling. We do not sell or rent your data to any third party.

We share your data with the following third-party service providers solely to operate our business. Each is bound by their own privacy policy and data protection obligations: • Cashfree Payments — payment processing. Your payment details are entered directly on Cashfree's secure servers and never pass through ours. See: cashfree.com/privacy-policy • Shiprocket — logistics and shipment. Your name, phone, and delivery address are shared with Shiprocket to arrange courier pickup and delivery. • Supabase — database and user authentication. Your account and order data is stored securely on Supabase's infrastructure (hosted in Singapore/US with SOC 2 compliance). • Resend — transactional email. Your email address is passed to Resend solely to deliver order confirmation and shipping notification emails. No other third parties have access to your personal data.

We use only the following storage mechanisms: • Authentication cookies (HttpOnly, Secure, SameSite=Strict) — set by Supabase to keep you signed in. These are essential and cannot be opted out of while using the site. • Cart data — stored in your browser's localStorage. This never leaves your device and is not sent to our servers until you place an order. • Cashfree may set its own cookies on the payment page for fraud detection and security. These are governed by Cashfree's cookie policy. We do not use advertising cookies, tracking pixels, Google Analytics, or any third-party analytics scripts.

• Order records are retained for 3 years for accounting and legal compliance under Indian law. • Account data is retained for as long as your account is active. You may request deletion at any time. • Server logs are retained for up to 30 days and then automatically purged. • If you do not complete a checkout, any partially entered data is not stored on our servers.

We implement appropriate technical and organisational measures to protect your data, including: • HTTPS/TLS encryption on all data in transit • Secure, HttpOnly session cookies that cannot be read by JavaScript • Supabase's database encryption at rest • All payment data handled exclusively by Cashfree's PCI-DSS Level 1 certified infrastructure • Access to customer data restricted to authorised personnel only No system is completely secure. In the unlikely event of a data breach that affects your rights, we will notify you in accordance with applicable law.

Our website is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal information, please contact us and we will delete it promptly.

You have the following rights regarding your personal data: • Access — request a copy of the personal data we hold about you • Correction — request that inaccurate or incomplete data be corrected • Deletion — request that your data be deleted (subject to legal retention obligations) • Portability — request your data in a commonly used, machine-readable format • Objection — object to processing of your data in certain circumstances To exercise any of these rights, email us at streetsouls3127@gmail.com. We will respond within 30 days.

This Privacy Policy is governed by the laws of India, including the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the courts in Mumbai, Maharashtra.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of our website after changes constitutes acceptance of the updated policy. For significant changes, we will notify you by email (if we have your address) or by a notice on our website.

For any privacy-related queries, requests, or concerns: Email: streetsouls3127@gmail.com Instagram: @streetsouls.in WhatsApp: +91 91377 45541 We aim to respond to all privacy requests within 7 business days.