Privacy Policy

What we collect

When you browse. Our servers log technical details of each request, such as the IP address, browser and the page asked for, to keep the site running and secure. If something breaks in your browser, the site sends us an error report: the error, the page's address without anything after the "?", and your browser type. It does not include your IP address or anything you typed.

When you contact us. The name, email, phone number and message you enter in the contact form. To limit spam we keep a one-way hash of your IP address with the message, not the address itself.

When you open a client account. Your name, email, phone number, designation and a password (stored only as a secure hash). If you sign in with Google, Google tells us your name and verified email address.

About your business. Your company's legal and trading names, registration type, GSTIN, PAN and other tax details, billing and shipping addresses, the people on your team, and the documents you upload to verify the business.

While you work with us. Purchase orders and the PO files you upload, development briefs and reference files, returns and their photos, enquiries and messages, call requests and the times that suit you, your notification and email preferences, and invoices and delivery details for your orders.

Why we use it

To create and secure your account; to verify your business before it can order; to quote, make, invoice and deliver what you order; to run product developments and returns with you; to answer your enquiries and calls; to send the service emails and notifications you have not switched off; to keep the records Indian tax and company law require; and to find and fix faults. We do not sell your data, and we do not use it for advertising.

We rely on your consent where we ask for it (analytics), and otherwise on the purposes you give us the data for — running your account and your orders — and on our legal obligations.

Cookies

We use one cookie of our own, ei_client_session, which keeps you signed in. It is set only when you sign in, cannot be read by scripts on the page, and is needed for the portal to work, so it is not optional.

We use Google Analytics to count visits only if you agree. Until you do, nothing from Google Analytics loads. It receives the address of each page you view — without anything after the "?" — but not your name, email or anything you type. You can change your answer at any time. If you use "Sign in with Google", Google's sign-in script runs on the sign-in page under Google's privacy policy.

Who we share it with

Only with service providers that work for us and only for the purposes above: our cloud hosting and file storage, our email-delivery provider (for account and order emails), our accounting system (for invoices), Google (only if you choose Google sign-in or accept analytics), and couriers (the delivery address and contact for an order). We may also disclose data where the law requires it. Some providers may process data outside India; where they do, we use providers bound to protect it.

How long we keep it

For as long as your account is open, and afterwards for as long as tax, accounting and company law require us to keep business records, or to resolve a dispute. Closing your account (Profile → Account → Close account) signs out everyone on your team and stops all access straight away, but it does not erase orders, invoices and other records we must keep. Contact messages and error reports are kept only as long as they are useful.

Your rights

You can see and correct most of your details yourself in your profile. You can also ask us for a summary of the personal data we hold about you, to correct or complete it, to erase what we are not required to keep, or to withdraw a consent you gave, and you can nominate someone to exercise these rights for you. Email info@estheticinsights.com; we will reply within 30 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

Security

Connections to the site are encrypted, passwords are stored only as secure hashes, sign-in attempts are rate-limited, and each client can see only its own records. No system is perfectly secure; if a breach affects your data we will tell you and the authorities as the law requires.

Children

The portal is for businesses. We do not knowingly collect data from anyone under 18; if you believe a child has given us data, write to us and we will delete it.

Changes to this policy

When we change this policy we update the date at the top, and we tell signed-in clients about significant changes before they take effect.