Privacy Policy

What we collect

• Your mobile number. We verify it by OTP at checkout and use it for order updates and delivery. It is how we identify your orders when you track them.
• Your name, delivery address and email. Needed to deliver your order and send you a confirmation.
• Your order history. What you bought, what you paid and when — kept for accounting and tax purposes.
• Basic technical data. Your IP address and browser information, recorded by our host for security and to prevent abuse.
• Anything you tell us. Messages you send us, and any photographs you share to support a damage or return claim.

If you tell us about a skin concern — through a quiz, a note on your order or a message — we use it only to answer you and to send what you asked for. We do not build a health profile from it, and we do not use it for advertising.

What we do not collect

We never see or store your card, UPI or netbanking details. Payments are handled entirely by our payment provider, and only the result of a payment is shared with us.

We do not ask for your Aadhaar, PAN or any government identifier, and you should never send one to us.

Who we share it with

Only those who need it to complete your order:

• Our courier partners, who receive your name, address and phone number so they can deliver to you.
• Our payment provider, who receives the amount and your contact details to process and secure the transaction.
• Our SMS and email providers, to send you order updates.
• Our accounting and invoicing system, which holds the invoice raised against your order.
• Our web host, which stores the site and its database.

Each of them receives only what that job needs, and is required to use it for that job alone.

We do not sell your personal data, and we do not share it for anyone else’s advertising.

We may also disclose information where a law, a court or a regulator requires it, or to establish or defend a legal claim.

How we protect it

• The whole of xyviraluxe.com is served over an encrypted connection.
• Checkout is protected by a one-time password sent to your mobile number, so an order cannot be placed on your number without your phone.
• Access to order data is limited to the people who pack and support orders.

No system is perfectly secure. If a breach ever affects your personal data we will tell you and the relevant authority, as the law requires.

How long we keep it

Order records are kept for as long as Indian tax and accounting law requires. You can ask us to delete anything we are not legally required to retain.

If you ask us to delete your account, we remove your contact details and close it, and keep only the invoice records we are obliged to keep.

Your rights

Write to info@xyviraluxe.com and you can ask us to show you the data we hold about you, correct anything that is wrong, delete what we are not required to keep, or stop sending you marketing messages.

We will respond within 30 days. We may ask you to confirm your identity first — usually by an OTP to the number on the order — so that we do not hand your data to someone else.

You can withdraw consent to marketing at any time without affecting your orders. If you are not satisfied with how we have handled a request, you can escalate it to our Grievance Officer, named below.

Cookies

We use cookies to keep your bag and your login working. Blocking them will stop the store functioning correctly.

These are set by the store itself and are what remember the items in your bag between pages and keep you signed in. We do not use them to follow you around other websites.

Children

This store is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us personal data, tell us and we will delete it.

Changes to this policy

If this policy changes we will update the date at the top of this page. Material changes will be announced on the site. Continuing to use the store after a change means you accept the updated policy.