Privacy notice

Who operates Origyn and how to contact us

Operator identity and the address for formal notices: [Operator legal identity and service address to be confirmed before launch]. Privacy and grievance contact: [Origyn support email and grievance officer to be confirmed before launch]. Do not use this draft as the final complaint channel.

Information handled by the current application

Account name, email, password hash, sign-in session, seller profile and seller-submitted business information; product listings and review content; saved products, cart, order and payment-provider references; fulfilment status; and limited account activity used for account and publisher views. A person may anonymously submit a product/review report with a selected reason and optional description; Origyn stores that report and its status history, plus a hash of a random status-reference token, to support moderation. The report form does not request an email address. Do not include private identity/payment details in a report. Report records currently have no owner-approved retention period. The application does not need a user's card number, CVV, UPI PIN or bank login to create an order. The selected payment provider may separately receive payment information on its checkout flow; the actual production provider and data flow are not yet approved.

Choices and account controls

At registration, the account form separately records acknowledgement of this notice and an adult-age self-confirmation. These are not identity or age verification. Optional product-update email consent is unchecked by default and can be withdrawn in the account. No product-update email campaign is currently configured. Signed-in users can download a JSON copy of available account data, correct the account name, withdraw this optional choice, or request account closure. Email correction needs a verified change flow. Account closure pseudonymizes the account and removes or archives some data; order, payment, tax or security records may remain where retention is required. Exact purposes and periods need owner and legal review.

Consent appears automatically only on Store pages: the catalogue, Bharatiya, product, saved products, similar products, cart and search results. Elsewhere, optional analytics, marketing and personalization do not load before a visitor opens “Privacy choices” from the footer. Essential session and security storage remains active.

Browser storage, cookies and external scripts

Origyn uses first-party browser storage for appearance preferences and a non-secret sign-in display hint. The privacy-choice prompt stores separate essential, personalization, analytics and marketing purposes. Personalization stays off until selected and governs recently viewed product IDs and activity-based recommendations. A saved browser choice lasts 400 days; Origyn asks again after expiry, if browser data is cleared, or if the privacy choices are updated. Signing in on the same browser does not reset that choice. In the prompt, “Accept all” enables every optional purpose; “Manage choices” opens each optional purpose separately; “Save choices” records only the selected toggles; and “Reject all” leaves optional purposes off. Essential storage remains active with every choice. When analytics is enabled, Origyn records limited first-party page and product activity (such as page loads, product views, saves and cart additions) to show aggregate store insights. The event pipeline checks the current analytics choice for every event, honors browser Do Not Track and Global Privacy Control, and stops recording new events when the choice is withdrawn. Previously rolled-up figures are anonymous totals and cannot be linked back to an individual visitor. It stores no IP address, account name, email, phone, delivery address or raw browser user-agent. It uses a daily-rotating pseudonymous visitor value; raw events are scheduled for deletion after 90 days and aggregate daily figures after 25 months. Location analytics are not active. No external analytics vendor or advertising tracker is configured. The owner must confirm these purposes and retention periods with legal counsel before public launch. See Privacy and cookies for the current storage inventory and withdrawal controls. In production, the sign-in credential is intended to be an HttpOnly, Secure, SameSite cookie scoped to the API. The Razorpay Checkout script is requested only after a signed-in user starts checkout; no production payment credentials are configured in this work. Browser storage behavior must be retested against the final deployment and payment provider.

Security and incidents

Origyn uses password hashing, session controls, owner-scoped APIs and encryption for newly submitted seller PAN values in its current application code. Existing PAN rows need a separately rehearsed and approved migration before production use. Hosting location, backups, log retention, alerting, incident roles and provider arrangements are not verified by this notice. Do not send passwords, payment secrets, bank credentials or identity documents through ordinary messages.

Children

Account registration currently asks a person to confirm they are 18 or older. This is a self-confirmation only and does not technically verify age or reliably prevent a minor from registering. A reviewed age-assurance and parental-consent design is still required before the service is made available to minors.

Review and updates

This working notice must be checked against Origyn’s final operator, marketplace/reseller responsibilities, providers, actual retention schedule and applicable commencement dates. It does not claim that Origyn complies with any law.