Privacy Policy

Last updated: 9 October 2026

At Lax & Me Venture, your trust matters to us. This policy explains what personal data we collect, why, how long we keep it, who we share it with and the rights you have over it. It is published under the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

Lax & Me Venture, Building No. IX-282B, Angamaly Manjapara Road, Angamaly, Ernakulam, Kerala, India, is the Data Fiduciary for the personal data described here. You are the Data Principal.

Data we collect

• Identity and contact data — your name, email address, phone number, and billing and shipping addresses.
• Order data — the items you buy, order and invoice history, delivery status, returns and correspondence with our care team.
• Payment data — the outcome of a transaction and a gateway reference. Card numbers, CVV, UPI PINs and net-banking credentials are handled entirely by our payment gateway and never reach our systems.
• Account and authentication data — your sign-in identifiers and one-time password verification status.
• Usage data — pages viewed, items saved, searches made, device and browser type, and approximate location inferred from your IP address.

We do not knowingly collect data from children under 18, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children, as required by section 9 of the DPDP Act.

Why we use it, and on what basis

• To perform your order — processing payment, arranging delivery, handling returns and refunds, and providing customer care. Without this data we cannot fulfil an order.
• To meet legal obligations — tax invoicing, GST records, and retention required under Indian law.
• To keep the store secure — preventing fraud, abuse and unauthorised access.
• With your consent — marketing emails and any optional feature you switch on. You can withdraw consent at any time, as easily as you gave it.
• Analytics and advertising cookies — on by default, as set out in our Terms of Service, until you turn them off in Cookie preferences.

Who we share it with

We never sell your personal data. We share it only with processors who help us run the store, under contract and only to the extent needed: our payment gateway, logistics and courier partners, our authentication and OTP provider, email and hosting providers, and — unless you have turned them off — analytics and advertising partners such as Google and Meta. We also disclose data where required by law, a court order, or a lawful request from a government agency.

Where your data is processed

Data is stored on servers operated by our hosting and infrastructure providers, which may be located outside India. Any transfer is made under contractual safeguards and in accordance with section 16 of the DPDP Act and any restrictions notified by the Central Government.

How long we keep it

We keep order, invoice and tax records for the period required by Indian tax and company law (generally eight years). Account data is kept while your account is active. Where data is no longer needed for the purpose it was collected for, and no law requires us to retain it, we erase it or anonymise it.

Your rights

As a Data Principal under the DPDP Act you may:

• Access a summary of the personal data we hold about you and how it is processed.
• Have inaccurate or incomplete data corrected, updated or completed.
• Have data erased where it is no longer necessary and no law requires us to keep it.
• Withdraw consent for any processing that relies on it, at any time.
• Nominate another individual to exercise these rights if you die or become incapacitated.
• Have your grievance heard through the process below.

To exercise any of these, email hello@samsarah.in. We may need to verify your identity first. We respond within 30 days.

Please give us accurate data and do not impersonate anyone: under section 15 of the DPDP Act, Data Principals have duties too, including not raising false or frivolous grievances.

Marketing

Marketing emails are sent only if you opted in, and every one carries an unsubscribe link. Transactional messages about an order you placed — confirmations, dispatch and delivery updates — are not marketing and are sent regardless.

Cookies

We use cookies and similar storage to keep your bag intact, hold your session, remember your preferences and — unless you turn it off — measure and advertise. The full list and the categories you control are in our Cookie Policy; you can change your mind at any time via Cookie preferences.

Security

We apply reasonable security safeguards — encryption in transit, access controls, and restricting staff access to what their role requires — to protect your data against breach. No system is perfectly secure, but if a personal data breach occurs we will notify the Data Protection Board of India and every affected Data Principal, as required by the DPDP Act.

Changes to this policy

We may update this policy. Material changes will be reflected in the “last updated” date above, and where the change affects processing you consented to, we will ask you again.

Grievances

Contact our Grievance Officer at hello@samsarah.in or +91 90610 50777; full details and timelines are at Grievance Redressal. If we do not resolve your complaint to your satisfaction, you may complain to the Data Protection Board of India.

General questions? Email hello@samsarah.in or write to us at Building No. IX-282B, Angamaly Manjapara Road, Angamaly, Ernakulam, Kerala, India.