What is collected
Accurate as built: name, email and phone via Clerk; delivery addresses and optional GSTIN; order and payment records; WhatsApp opt-in state. Card details are never seen or stored by this site — they go directly to Razorpay.
Processors
Clerk (authentication), Neon (database), Vercel (hosting), Razorpay (payments), Resend (email), Meta/WhatsApp where a customer chooses that channel. Each needs naming, with where they process data.
Retention and rights
How long order records are kept — note that GST rules impose their own retention minimum on tax invoices, which can exceed what a customer would prefer. Access, correction and erasure rights under the DPDP Act, and how to exercise them.
Grievance officer
The DPDP Act and the IT Rules require a named grievance contact with a published address and response timeline.