PRIVACY POLICY — 4FLAUNT Effective from: 11 August 2026
FANCY CREATION operates 4Flaunt (https://4flaunt.com/), an online store for eyewear, and related accessories. This document explains what personal data we collect from you, why we collect it, how long we keep it, who we share it with, and — most importantly — what control you have over it.
This policy is written to meet the requirements of India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, alongside the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Sensitive Personal Data) Rules, 2011.
We've tried to write this in plain language wherever the law allows. Where a legal term is unavoidable, it's defined below.
PART A — KEY TERMS USED IN THIS POLICY
| Term | What it means here |
|---|---|
| "You" / "Data Principal" | Anyone whose personal data we process — customers, site visitors, and account holders |
| "We" / "Company" / "Data Fiduciary" | FANCY CREATION, the entity that decides why and how your data is used |
| "Personal Data" | Any information that can identify you, directly or indirectly |
| "Processing" | Anything done with your data — collecting, storing, using, sharing, deleting, etc. |
| "Consent" | Your freely given, specific, informed "yes" — never assumed, never bundled |
| "Processor" / "Third Party" | A vendor we use who handles data on our instructions (e.g., a courier or payment gateway) |
| "Grievance Officer" | The person you can contact with a complaint about how your data is handled |
| "Board" | The Data Protection Board of India, the regulator for the DPDP Act |
| "Platform" | 4flaunt.com and any associated app or storefront |
This policy applies to anyone who browses, creates an account on, or buys from 4Flaunt, regardless of the device used. It does not apply to anonymised data that can't be traced back to you, or to third-party sites we merely link to.
PART B — WHAT WE COLLECT AND WHY
We only collect what's needed for a specific purpose, and we tell you what that purpose is before or at the point of collection.
B.1 Information you give us directly
| What | Examples | When |
|---|---|---|
| Contact details | Name, email, phone number, shipping/billing address | Checkout, account signup |
| Account information | Username, password (stored hashed), date of birth if provided | Registration |
| Order details | Products purchased, order value, payment mode, delivery preferences | At checkout |
| Support interactions | Messages, complaint details, chat history | When you contact us |
| Content you post | Reviews, ratings, photos/videos submitted with reviews | Optional, at your discretion |
| Marketing preferences | Newsletter opt-in, promo code usage | Optional signup forms |
B.2 Information collected automatically
| What | Examples |
|---|---|
| Device & browser data | IP address, browser type, OS, screen size |
| Site behaviour | Pages viewed, time on page, items added to cart/wishlist, click patterns |
| Approximate location | Derived from IP address, for delivery estimates and currency/language |
B.3 Information from third parties
If you log in via Google or Facebook, we receive the basic profile details (name, email) those platforms share with us under your permissions there.
B.4 What we deliberately don't collect
We do not ask for or store full card numbers, CVVs, card PINs, biometric data, or government ID numbers (Aadhaar, PAN) unless a specific legal requirement forces us to, and even then only with your explicit consent.
PART C — WHY WE PROCESS YOUR DATA (AND ON WHAT LEGAL BASIS)
Under the DPDP Act, we can only process your data if we have a valid ground to do so. Here's how each purpose maps to a ground:
| We use your data to... | Using this data | Because of... |
|---|---|---|
| Fulfil and ship your order | Contact + order + payment data | It's necessary to complete the contract you entered into with us |
| Let you log in and manage your account | Account credentials + contact data | Contractual necessity / your consent at signup |
| Send order confirmations, shipping updates | Contact + order data | Necessary to deliver the service you asked for |
| Recommend products, personalise your browsing | Usage + device data | Your cookie consent |
| Send marketing emails/SMS/WhatsApp | Contact + marketing preference data | Your explicit, separate opt-in |
| Investigate fraud or abuse | Device + transaction data | Legitimate use recognised under Section 7 of the DPDP Act |
| Meet tax, invoicing, and audit obligations | Order + payment data | Legal obligation |
| Handle your support ticket or complaint | Contact + order + support data | Necessary to resolve the issue you raised |
We never repurpose data for something outside this list without asking you first.
PART D — HOW WE HANDLE CONSENT
This is the part of the law we take most seriously, so here's how it works in practice:
- Nothing is pre-checked. Every consent checkbox — cookies, marketing emails, anything optional — starts unticked. You have to actively tick it.
- Consent is never bundled. Agreeing to receive order updates does not mean you've agreed to marketing emails. Each purpose gets its own ask.
- We keep a record. Every time you give (or withdraw) consent, we log the timestamp, what exactly you agreed to, and which version of our notice you saw. If a regulator ever asks us to prove consent, we can.
- Withdrawing is as easy as giving. Unsubscribe links, an account privacy toggle, or a direct email to us — any of these works. Withdrawing marketing consent won't affect your ability to place orders; withdrawing consent tied to order fulfilment might limit what we can process for that order.
- We won't penalise you for saying no. Declining optional data collection never blocks you from using core store features.
PART E — COOKIES
We use cookies for three broad reasons: making the site work (cart, login sessions), understanding how people use the site (analytics), and showing you relevant ads (marketing/retargeting).
- Cookies strictly required for the store to function load automatically — there's no way to browse or check out without them.
- Everything else — analytics, ad pixels — stays switched off until you actively accept it through our cookie banner.
- You can change your mind anytime via the cookie settings link, usually in the site footer.
PART F — WHO ELSE SEES YOUR DATA
We're not in the business of selling your data — full stop. We do share specific slices of it with vendors who help us run the store, strictly for the purpose they're engaged for:
| Vendor type | What they get | Why |
|---|---|---|
| Payment gateway | Name, contact, masked payment details, transaction ID | To process your payment securely |
| Courier/logistics partner | Name, address, phone, order contents | To deliver your order |
| Email/SMS platform | Email, phone, message history | Transactional and (if opted in) marketing messages |
| Hosting/e-commerce platform (Shopify and its infrastructure) | Technical/usage data, order records | To run the store itself |
| Analytics/advertising tools | IP, browsing behaviour, cookies | To understand traffic and run ads, only post-consent |
| Support/helpdesk tools | Contact info, ticket history | To manage your queries |
| Auditors, legal, tax advisors | Financial and order records | Statutory compliance |
| Government/law enforcement | Whatever is legally demanded | Only under valid legal process |
We'll list the specific vendor names here (payment processor, courier partner, etc.) once confirmed — DPDP expects named disclosure, not just categories, and we intend to keep this accurate rather than generic.
Where any of our infrastructure providers process data outside India, we ensure that transfer is either to a jurisdiction not restricted by the Indian government, or backed by a contract that holds them to India-equivalent protection standards.
PART G — HOW LONG WE KEEP YOUR DATA
We don't keep data forever "just in case." Here's roughly how long different types stick around, and why:
| Data type | Kept for | Reason |
|---|---|---|
| Name, contact, address | 3 years after your last order/interaction | Standard limitation period for disputes |
| Order & transaction records | 8 years | Income Tax Act recordkeeping requirement |
| Payment data (masked) | Per RBI payment aggregator rules | Regulatory requirement |
| Support tickets | 3 years after resolution | Dispute handling |
| Marketing opt-in data | Until you unsubscribe, or 2 years of inactivity | Consent-based, expires with disuse |
| Site analytics (pseudonymised) | 12–18 months | Internal performance tracking |
| Login credentials | Until account deletion | Needed for authentication |
| Dormant accounts | 2 years inactive, with 30 days' notice before deletion | Data minimisation |
Once a retention period ends, data is either permanently deleted or irreversibly anonymised. You can also ask us to delete your data earlier — see Part H.
PART H — YOUR RIGHTS, AND HOW TO USE THEM
| Right | What it lets you do | We respond within | How to ask |
|---|---|---|---|
| Access | See what data we hold on you and why | 15 working days | Email support@4flaunt.com |
| Correction | Fix inaccurate or outdated details | 10 working days | Email us with the correction needed |
| Erasure | Ask us to delete data no longer needed | 15 working days | Email us with identity confirmation |
| Withdraw consent | Pull back permission for any consent-based processing | Immediate | Unsubscribe link or email |
| Nominate | Name someone to exercise your rights if you pass away or become incapacitated | On file | Signed nomination emailed to us |
| Grievance redressal | Raise a complaint about how a request was (or wasn't) handled | Acknowledged in 48 hrs, resolved in 7 working days | Email our Grievance Officer |
| Be informed | Know how your data is used, in plain terms | Always available | This document, kept current |
If you're unhappy with how we've resolved something, you can escalate to the Data Protection Board of India under Section 13(2) of the DPDP Act.
PART I — KEEPING YOUR DATA SAFE
We use standard, industry-accepted safeguards: encrypted connections (TLS/SSL) for data in transit, hashed and salted passwords, role-based access controls internally, multi-factor authentication for admin access, and regular security reviews of our systems. No system is completely immune to compromise, but we work to keep the risk as low as reasonably possible, and we hold our vendors to comparable standards.
PART J — IF SOMETHING GOES WRONG (DATA BREACH)
If we discover unauthorised access, loss, or exposure of your personal data, here's what happens:
- Contain it — isolate the affected system, within hours of detection.
- Assess it — figure out what data, how much, and how serious.
- Escalate internally — notify our Grievance Officer and leadership immediately.
- Report externally — notify CERT-In and, where applicable, the Data Protection Board, within the legally mandated window.
- Tell you — if the breach poses real risk to you, we notify affected users directly, explaining what happened and what to do.
- Fix it — patch the vulnerability, reset any compromised credentials.
- Document and review — keep a record of what happened and update our practices to prevent a repeat.
Not every incident triggers external notification — minor issues with no real risk (e.g., a misdirected internal email with no sensitive data) are handled internally, while anything involving financial data, identity data at scale, or genuine risk of harm gets reported as required by law.
If you ever notice something suspicious on your own account — a login you don't recognise, a phishing attempt using our name — tell us immediately at support@4flaunt.com.
PART K — CHILDREN
4Flaunt isn't designed for use by anyone under 18. We don't knowingly collect data from minors without verifiable parental or guardian consent, and we never run targeted ads or behavioural tracking aimed at children. If we ever discover we've collected a minor's data without proper consent, we delete it and try to notify the parent/guardian if we can identify them.
PART L — GENERAL
Changes to this policy: We may update this document as our practices or the law evolves. Material changes will be flagged on the site and, where relevant, emailed to registered users. The date at the top always reflects the latest version.
If we're acquired or restructured: Your data may transfer to a successor entity, but it stays governed by this policy (or its successor, with notice to you), it doesn't just become fair game.
Force majeure: Events genuinely outside our control (natural disasters, major outages, cyberattacks against infrastructure we don't control) may delay our response times for requests or breach notifications. We'll still act as fast as reasonably possible.
Governing law: This policy is governed by Indian law, and any disputes fall under the jurisdiction of the courts in New Delhi.
PART M — GET IN TOUCH
For any question about this policy, your data, or to exercise any right listed in Part H, reach out to:
Grievance Officer Name: Izhan Email: izhan@4flaunt.com Address: FANCY CREATION, G/F 1172 Farash Khana Delhi 110006 Hours: Monday–Saturday, 11 AM – 7 PM IST
By using 4Flaunt, you're agreeing to this policy. We'll keep it current — it's worth a re-read every so often.
