Privacy Policy

Under the DPDP Act 2023, the Data Fiduciary — the entity that determines the purpose and means of processing your personal data — is:

We operate on a minimal data footprint principle. We collect only what is strictly necessary for your order:

We do not collect: Aadhaar numbers, PAN, date of birth, biometric data, or any data categorised as Sensitive Personal Data under Indian law.

To operate Hasticks, we work with the following third-party service providers who may process your personal data on our behalf. Each is contractually bound to handle your data only for the specified purpose:

• Clerk (clerk.com)

  Authentication & Identity Management

  Email address, phone number, OAuth tokens

  View their Privacy Policy →

• Razorpay (razorpay.com)

  Payment Processing

  Payment amount, currency, contact info for payment prefill. Hasticks does NOT receive or store your card/bank details.

  View their Privacy Policy →

• Supabase (supabase.com)

  Database & File Storage (hosted in EU/US region)

  Order details, uploaded images, customer name/address

  View their Privacy Policy →

• India Post / Shiprocket

  Physical Delivery

  Recipient name, delivery address, phone number (for delivery communication)

  View their Privacy Policy →

We do not sell, rent, or share your personal data with any third-party marketing or advertising agencies.

• Uploaded photos/artwork: Permanently deleted from our servers within 30 days of order fulfilment (or immediately upon confirmed print completion, whichever is sooner).
• Order records (name, address, amount, GSTIN): Retained for 7 years as required by the GST Act 2017 for tax audit purposes.
• Account data (Clerk): Retained for as long as your account is active. Deleted upon account deletion request.
• Marketing consent records: Retained until you withdraw consent.

In compliance with Section 6 of the DPDP Act 2023, Hasticks will only process your personal data after obtaining your free, specific, informed, and unambiguous consent. This consent is obtained via an explicit, unchecked checkbox at checkout — you must actively tick it to proceed.

What you are consenting to: The collection and use of your name, phone, email, and address for the sole purpose of fulfilling your order.

Marketing consent is separate and optional. A separate unchecked checkbox allows you to opt into promotional communications. Declining this has no impact on your order.

Withdrawing consent: You may withdraw your consent for marketing communications at any time by emailing hasticks.co@gmail.com. Note that withdrawing consent for core order processing after payment is placed does not affect the legality of processing already carried out.

As a Data Principal (the individual whose data we process), you have the following rights under the Digital Personal Data Protection Act 2023:

• Right of Access (§12)

  Request a summary of your personal data we hold and how it is processed.

• Right to Correction (§12)

  Request correction of inaccurate or incomplete personal data.

• Right to Erasure / Deletion (§12)

  Request deletion of your personal data once the transaction is complete and the dispute window (30 days) has closed. Tax-record data retained under legal obligation cannot be deleted before the 7-year GST retention period expires.

• Right to Grievance Redressal (§13)

  File a complaint with our Grievance Officer (details below) if you believe your data rights have been violated.

• Right to Nominate (§14)

  Nominate another individual to exercise your data rights in the event of your death or incapacity.

To exercise any of these rights, email us at hasticks.co@gmail.com with the subject line "DPDP Data Request — [Your Name]". We will respond within 30 days.

Hasticks uses essential cookies only (session management, authentication state via Clerk). We do not use third-party advertising cookies, behavioural tracking pixels, or retargeting scripts. Our service worker (PWA) caches assets locally on your device for performance; no personal data is stored in this cache.

We implement industry-standard security measures to protect your personal data:

• HTTPS/TLS encryption for all data in transit
• Supabase Row-Level Security (RLS) policies ensuring users can only access their own data
• Razorpay PCI-DSS Level 1 compliance for payment data
• Clerk-managed authentication with secure session handling

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, Hasticks will notify you without undue delay and report to the Data Protection Board of India as required by the DPDP Act 2023.

Hasticks does not knowingly collect personal data from individuals under the age of 18. Our platform requires account registration via Clerk, which includes age verification. If you believe a minor has provided personal data without parental consent, please contact us immediately at hasticks.co@gmail.com and we will delete the data promptly.

If your concern is not resolved by our Grievance Officer, you may approach the Data Protection Board of India (once operationalised under the DPDP Act 2023) or the National Consumer Disputes Redressal Commission at consumerhelpline.gov.in.

We may update this Privacy Policy periodically to reflect changes in law or our practices. Material changes will be communicated via email to registered users at least 15 days prior to taking effect. The "Last updated" date at the top of this page always reflects the current version.