How we handle your data

Sculptvichaar is operated by SARCARE MARKETING PRIVATE LIMITED, a company registered in India with its registered office at H. NO. 21, Bhogal Lane, New Delhi, South Delhi, Delhi, 110014.

GSTIN: 07ABGCS4755E1Z8. For any questions about this policy or your personal data, contact our Grievance Officer (see Section 10).

2.1 Data you provide directly

2.2 Data collected automatically

We do not sell your personal data. We share it only with service providers who help us operate the platform, and only to the extent necessary for the purpose described above.

After the retention period, data is permanently deleted or anonymised so it can no longer identify you.

Under the Digital Personal Data Protection Act, 2023, you have the following rights regarding your personal data:

We will respond to all requests within 72 hours of receipt. There is no fee for making a request, unless the request is manifestly unfounded or excessive.

Where we process your data on the basis of consent (e.g., marketing emails, analytics cookies, AI chat), you can withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

How to withdraw consent

• Marketing emails: Click the unsubscribe link at the bottom of any marketing email.
• Analytics & advertising cookies: Use the cookie settings panel (link in the footer) or clear your browser cookies.
• AI chat assistant: Simply stop using the chat widget. You can also request deletion of past conversations.
• All other consent: Email our Grievance Officer and we will process your request.

We take the following measures to protect your personal data:

• Passwords are hashed using bcrypt before storage — we never store plain-text passwords.
• Session tokens are stored in HTTP-only cookies, not accessible to JavaScript.
• All data in transit is encrypted via HTTPS/TLS.
• Payment data is handled entirely by Razorpay (PCI DSS compliant) — we never touch card details.
• Cloudinary image storage uses encrypted connections and access controls.
• Database access is restricted to authenticated application servers; no direct public database access.
• Admin access is role-based (Owner, Manager, Editor) with session-based authentication.
• We maintain an audit log of all admin actions on the platform.

Some of our service providers process data outside India. This may involve transferring your personal data to servers located in other countries. We disclose this below as required by the DPDP Act, 2023:

Your primary data (account, orders, commissions, cart) is stored on Railway (PostgreSQL) and Redis (via Railway)within Railway's infrastructure. We ensure that all cross-border transfers are made under appropriate contractual safeguards with each provider.

Under Section 13 of the DPDP Act, 2023, and the Information Technology (Intermediary Guidelines) Rules, 2021, we have appointed a Grievance Officer to address complaints regarding personal data and platform use.

We use cookies and similar technologies (localStorage, IndexedDB, analytics pixels) for the following purposes:

For full details, see our Cookie Policy. You can manage your cookie preferences at any time using the cookie settings link in the footer.

Our platform is intended for adults who can form legally binding contracts under the Indian Contract Act, 1872. We do not knowingly collect personal data from children under 18 years of age.

If you believe a minor has provided us with personal data, please contact our Grievance Officer immediately. We will take steps to delete such data and, where applicable, obtain verifiable parental consent or discontinue processing.

In the event of a personal data breach that is likely to cause harm to our users, we will:

1. Notify the Data Protection Board of India within 72 hours of becoming aware of the breach.
2. Notify affected users with a clear description of the breach, the likely impact, and the steps being taken to mitigate it.
3. Take immediate corrective action to contain the breach and prevent recurrence.

We may update this privacy policy from time to time. When we make material changes that affect existing consent or introduce new processing activities, we will:

• Notify you via email (if you have an account) at least 30 days before the change takes effect.
• Display a website banner informing visitors of the updated policy.
• Update the Last updated date at the top of this page.

Your continued use of the platform after the effective date constitutes acceptance of the updated policy.

If you have any questions about this privacy policy or how we handle your personal data, you can reach us at: