Privacy

The short version

We collect what we need to send you an order and answer you afterwards. We do not sell it, we do not run advertising trackers, and you can have a copy or have it deleted by asking.

What we collect, and why

To send you an order — your name, email, phone number and delivery address. Without these there is no parcel.

To let you sign in — your email, and a six-digit code we email you. The code is stored only as a one-way hash, it expires in fifteen minutes, and it can be tried five times. There is no password, so there is no password of yours for us to lose.

To know how people find us — the page you arrived on and the website that linked you, if any. This is read from the request your browser already sends and is stored on your order. There is no advertising pixel on this site and nothing is sent to Meta, Google or anyone else.

To remind you about a bag you left — if you type your email at checkout and do not finish, we keep the bag so we can send you a link back to it. At most two reminders, ever. Every one has a one-click unsubscribe, and once you use it your address goes on a do-not-email list that is checked before anything is sent.

To show reviews — your first name and, if you upload one, your photograph of the piece.

Who else sees it

PhonePe take the payment on their own pages. We never see your card, UPI or bank details — only whether the payment succeeded, and a reference number.

Shiprocket and the courier get your name, address and phone number, because somebody has to carry the parcel to your door.

Our email provider carries the messages we send you.

That is the whole list. We do not sell your data, we do not share it for advertising, and we do not trade it with other shops.

What we do not do

• We do not run Meta Pixel, Google Analytics or any third-party tracker.
• We do not show you adverts, here or anywhere else, based on what you looked at.
• We do not email you marketing you did not ask for, beyond the abandoned-bag

reminder described above.

How long we keep it

Orders and invoices are kept as long as tax and accounting law requires. Sign-in codes are deleted within two days of expiring. An abandoned bag is given up on after a week and stops being chased. A do-not-email entry is kept forever, on purpose — it is the only way to keep honouring it.

Emails you cannot turn off

Order confirmations, shipping notices and refund receipts are part of the order rather than marketing, so unsubscribing does not stop them. You would otherwise be left with no way to know where your own parcel is.

Your rights

Write to hello@drapeandgrace.com and we will, within a reasonable time:

• send you a copy of everything we hold about you;
• correct anything that is wrong;
• delete what we are not required by law to keep;
• tell you exactly who we have shared it with.

We acknowledge every complaint within 48 hours and settle it within one month, as the Consumer Protection (E-Commerce) Rules, 2020 require.

Cookies

This site sets one cookie, for your session — it is what keeps your bag and your sign-in working between pages. It carries no advertising identifier. We do not ask you to accept cookies because there is nothing here to accept.