Bhoomi & BeyondData practices
Your privacy, plainly stated
We collect only what we need to process your orders and improve your experience. This page explains what that means in practice.
- IT Act 2000
- Consumer Protection 2019
- India
What we hold
Information we collect
We gather information in two ways: directly from you when you place an order or contact us, and automatically through standard web technologies.
Order & billing details
Name, delivery address, email address, and phone number — required to fulfil and communicate about your order.
Payment references
We do not store card numbers or UPI credentials. Razorpay handles payment capture; we receive only a payment ID and order reference to confirm a completed transaction.
Account information
If you create an account, we store your email, a securely hashed password (via Supabase Auth), and order history. We never store passwords in plain text.
Contact form submissions
Name, email, and message content when you write to us. Used only to respond to your query.
Technical data
Server logs, browser type, and IP address — collected automatically by our hosting provider (Vercel) for security and uptime monitoring.
How we use it
How we use your information
Your data is used to run the order you placed and nothing else without your permission.
Order fulfilment
Packing, dispatch, and delivery updates. We share your name and address with our courier partner solely for this purpose.
Transactional email
Order confirmation, shipping notification, and admin alerts. Sent via Titan Mail from support@bhoomiandbeyond.com. We do not send marketing email without a separate opt-in.
Customer support
Responding to queries, processing returns or replacements under the Consumer Protection Act 2019.
Legal compliance
Retaining transaction records as required under the Information Technology Act 2000 and applicable GST regulations.
Session handling
Cookies & session data
We use cookies strictly to keep you signed in to your account. Your cart is stored locally in your browser, not in a cookie. We do not use advertising cookies or cross-site tracking.
sb-access-token / sb-refresh-token
Authentication cookies set only when you log in. Set as httpOnly so they cannot be read by JavaScript on the page — this protects against session theft. Used to keep you signed in and to authenticate requests to your order history and profile. You can clear them by logging out.
Your cart
Your shopping cart is stored locally in your browser (localStorage), not sent to our servers until you check out. Clearing your browser data will empty your cart.
No third-party tracking cookies
We do not embed Facebook Pixel, Google Ads, or other advertising tags that place cookies on your device.
Commerce backend
Database & payment data
Our store runs on Supabase, a managed database platform, for orders, products, and accounts. Payment is handled by Razorpay. Neither system stores sensitive financial data on our servers.
When you complete a purchase, your order details (items, address, contact) are stored in our Supabase database, hosted on secure cloud infrastructure in Mumbai, India. We do not store card numbers. Your payment is processed entirely within Razorpay’s PCI-DSS compliant environment.
We verify each payment using HMAC-SHA256 signature validation before creating an order — this prevents fraudulent order creation. The only payment data we retain is the Razorpay payment ID, which we use to reference the transaction if a dispute or refund is raised.
Order records are retained for a minimum of three years to comply with GST record-keeping requirements under Indian tax law.
External processors
Third-party services
We use a small number of external services. Each receives only the data it needs to perform its function.
Razorpay
Payment processorReceives your payment details (card, UPI, netbanking) to process the transaction. Governed by Razorpay’s Privacy Policy and RBI regulations. Razorpay is a PCI-DSS Level 1 certified provider.
Titan Mail
Transactional emailReceives your name and email address to deliver order confirmations and support notifications from support@bhoomiandbeyond.com. No marketing use.
Vercel
Hosting & edge networkHosts our website and serverless API functions. Vercel collects server access logs (IP, user agent, request path) for security and performance monitoring. Vercel is GDPR-compliant and operates data centres outside India; however, since the IT Act 2000 does not restrict international data transfer for business purposes, this is permissible.
Supabase
Database & authenticationOur database and authentication provider. Stores order, product, and account data on secure cloud infrastructure hosted in Mumbai, India. Access is protected by row-level security policies restricting each customer to their own data.
Your entitlements
Your rights
Under the Consumer Protection Act 2019 and the Information Technology Act 2000, you have the following rights with respect to your personal data.
Access
You may request a copy of the personal data we hold about you. We will respond within 30 days.
Correction
If your details are inaccurate or incomplete, you may ask us to correct them. You can also update your delivery address and contact number directly in your account.
Deletion
You may ask us to delete your account and associated personal data. We will do so within 30 days, except where retention is required by law (e.g. GST transaction records).
Withdrawal of consent
If you opted in to marketing communication, you may withdraw that consent at any time by writing to us. This does not affect the lawfulness of processing that occurred before withdrawal.
Grievance redressal
Under Section 14 of the Consumer Protection Act 2019, you may raise a dispute with the Consumer Disputes Redressal Commission if your concern is not resolved to your satisfaction.
Get in touch
Questions about your data
Write to us and we will respond within 5 working days. For formal data-related requests, please mark the subject line “Data Request” so we can route it correctly.
Email: hello@bhoomiandbeyond.com
Post: Bhoomi and Beyond, India. (Full registered address available on request.)
This policy was last reviewed in June 2026. Material changes will be communicated by email to registered customers before taking effect.
Questions or concerns
Our contact form is the fastest way to reach us for any data or order-related queries.