This Privacy Policy explains how COGNIFIN LABS PRIVATE LIMITED (“we”, “us”, “our”), operating Optimise Store (store.optimise.club), collects, uses, stores and protects your personal information in accordance with applicable Indian data-protection and information-technology laws, including the Information Technology Act, 2000 and applicable rules thereunder (including the IT (Reasonable Security Practices) Rules, 2011), and the Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 as and when the relevant provisions become applicable.
1. Information we collect
- Account data: name, email address, phone number, and your password stored only as a one-way cryptographic hash (scrypt). We can never see your plaintext password.
- Address data: shipping addresses you save or enter at checkout (recipient name, address lines, city, state, country, postal code, phone).
- Order data: products purchased, selected options, amounts, order status, fulfilment references and tracking identifiers.
- Payment data: payments are processed by Razorpay. We store only payment identifiers (Razorpay order/payment IDs, method, status) — never card numbers, CVVs, UPI PINs or netbanking credentials.
- Technical data: a single essential session cookie, and standard server logs (IP, user agent, timestamps) for security and troubleshooting.
2. How we use your information
- To process, fulfil and deliver your orders.
- To communicate order status, delivery updates and support responses.
- To operate your account, authenticate sessions and keep the store secure.
- To comply with legal, tax and audit obligations.
- To detect and prevent fraud and misuse.
We do not sell, rent or trade your personal information.
3. Who we share it with
- Third-party sellers — when you buy a product sold via Optimise Marketplace, the seller of record receives your recipient name, shipping address and phone number, strictly to fulfil and support your order. Products sold directly by us involve no third-party seller.
- Delivery & logistics partners — the courier/delivery network engaged by us or the seller receives the details needed to ship and deliver your order.
- Payment processor (Razorpay) — order amount and identifiers for payment processing under Razorpay’s own privacy terms.
- Legal authorities — only when required by applicable law or valid legal process.
No marketing data is shared with third parties.
4. Cookies
We use one essential httpOnly session cookie to keep you signed in — no advertising or tracking cookies. See the Cookie Policy for details.
5. Data storage & security
- We use reasonable technical and organisational security measures to protect personal information, including encryption in transit, access controls and secure credential storage.
- Passwords are stored only as one-way cryptographic hashes; session cookies are httpOnly and transmitted only over HTTPS in production.
- Access to systems is restricted to authorised personnel on a need-to-know basis.
6. Retention
Account and order records are retained while your account is active and as required thereafter for tax, legal and audit purposes (typically up to 8 years for transactional records, per Indian accounting rules). You may request deletion — see below.
7. Your rights
You may at any time:
- View and update your profile and saved addresses in Account settings.
- Request a copy or correction of your personal data.
- Request deletion of your account (subject to records we must retain by law).
- Withdraw consent for optional processing.
Email [email protected] to exercise any right — we respond within 15 days.
8. Children
The store is intended for users 18 and older. We do not knowingly collect children’s data.
9. Changes
We may update this policy; the “last updated” date reflects the current version. Material changes will be flagged on this page.
10. Grievance officer
For privacy concerns or to escalate an unresolved issue, contact our Grievance Officer at [email protected]. We acknowledge grievances within 48 hours and aim to resolve them within 15 days, and in any event within the period required by applicable law.