Privacy policy
What we know about you, and why.
This policy explains what we collect, what we do with it and what you can ask us to do about it. It follows the Digital Personal Data Protection Act, 2023, which gives you rights over your own data and gives us duties towards it.
Last updated 7 September 2026
On this page
Who we are What we collect How we use it Consent, and how to withdraw it Who else sees it Cookies How long we keep it How we protect it Children Your rights Contact us
Who we are
Mama Junction, Flat 402, Road No. 12, Banjara Hills, Hyderabad, Telangana 500034, is the data fiduciary for the personal data described here — the organisation that decides what is collected and why, and is answerable for it.
For anything in this policy, write to our Grievance Officer at care@mamajunction.com or call +91 98490 55112.
What we collect
What you give us: your name, email address, phone number, delivery and billing addresses, and what you tell us in a message, review or return request. If you create an account, your password is stored only as a cryptographic hash and cannot be read back by anyone, including us.
What your order creates: the items you bought, the amount, the delivery status and the invoice. We never see or store your full card number — that stays with our payment gateway, which sends us only a success or failure and the last four digits.
What your visit produces: pages viewed, searches run, device and browser, approximate location from your IP address, and the identifiers our analytics cookies set. Analytics run only if you accept them in Cookie preferences.
How we use it
To take, pack, deliver and invoice your order, to keep you posted about it, and to handle returns and refunds. This is the purpose you gave us the data for, and we cannot run a shop without it.
To run your account, keep your bag and saved items, and let you sign in.
To answer you when you write to us, and to keep a record of that conversation so the next person you speak to knows what happened.
To improve the shop — which pages people struggle with, which searches find nothing — using analytics you have consented to.
To send marketing email only if you asked for it, with an unsubscribe link in every one. Order and delivery emails are not marketing and continue regardless.
To meet legal obligations: tax invoices, GST records, and responding lawfully to an authority that is entitled to ask.
Consent, and how to withdraw it
We ask for consent before we set an analytics cookie and before we send marketing email, and we tell you what it is for at the moment we ask.
You can withdraw consent whenever you like — through Cookie preferences at the bottom of any page, the unsubscribe link in any marketing email, or by writing to us. Withdrawing consent stops the future processing that relied on it; it cannot undo what was already done lawfully, and it does not remove records we must keep for tax.
Who else sees it
Our courier partners get the name, address and phone number needed to deliver a parcel, and nothing else.
Our payment gateway handles the payment itself. Our email and SMS providers send the messages. Our hosting and analytics providers run the website. Each is contractually bound to use the data only for the service they provide us.
A court, tax authority or law-enforcement agency, when they are legally entitled to ask.
We do not sell personal data, and we do not share it with anyone for their own marketing. Nobody buys a list from us.
Cookies
Essential cookies keep you signed in, remember your bag and your language and currency, and protect the checkout. The shop cannot work without them, so they are always on.
Analytics cookies tell us how the shop is used. They are off until you accept them, and Cookie preferences at the bottom of any page lets you change your mind at any time.
How long we keep it
Order records and invoices: eight years from the end of the financial year, which is what Indian tax and company law require of us.
Account data: while your account is open. Ask us to close it and we delete what we are not required to keep, then keep only the invoice record.
Support conversations: three years, so a repeat problem has its history. Analytics data: twenty-six months, in aggregate.
How we protect it
The whole site runs over HTTPS. Passwords are hashed. Access to customer data is limited to the people who need it to do their job, and every access is logged.
No system is perfect. If a breach affects your data, we will tell you and the Data Protection Board of India, as the Act requires, and we will say plainly what happened and what to do about it.
Children
We sell products for children to adults. Accounts are for people aged 18 and over, and we do not knowingly collect data about a child.
If you believe a child has given us their data, write to us and we will delete it. Where the Act requires verifiable parental consent, we will not process a child’s data without it, and we never use it for tracking or targeted advertising.
Your rights
Ask us what we hold about you and how we have used it, and we will tell you.
Ask us to correct anything wrong, complete anything missing, or update anything stale.
Ask us to erase what we no longer need for the purpose you gave it for, or where you have withdrawn consent — except the records tax law makes us keep.
Nominate someone to exercise these rights on your behalf if you die or become incapable of doing so yourself, which the Act specifically allows.
Raise a grievance with us and get an answer. Write to care@mamajunction.com and we will respond within 30 days.
Contact us
Grievance Officer, Mama Junction, Flat 402, Road No. 12, Banjara Hills, Hyderabad, Telangana 500034. Email care@mamajunction.com, phone +91 98490 55112, Monday to Saturday, 10am to 6pm IST.
If we have not dealt with your grievance properly, you may complain to the Data Protection Board of India.
We update this policy when what we do with data changes. The date at the top says when we last did.