Who we are
This policy explains how Kokora Spices ("we", "us", "our") handles your personal data when you use kokoraspices.com: what we collect, why, who else sees it, how long we keep it, and the choices you have.
The shop is run by Rue De Brew Private Limited.
Our registered address is KHASRA NO- 220,GALI NO. 64 DAULTABAD INDUSTRIAL AREA, NEAR DWARKA EXPRESSWAY GURUGRAM HARYANA - 122006, INDIA.
Questions about your data: write to us at info@kokoraspices.com.
When you place an order
We ask only for what we need to deliver your order and give you a GST invoice:
- your name, email address and mobile number;
- the delivery address;
- what you ordered, the amounts, and how you chose to pay;
- how you found us, if your browser kept it (see Cookies below).
We use these to pack and deliver your order, email you about it, answer your questions, handle cancellations, returns and refunds, and keep the accounts and tax records the law requires.
To protect the shop from misuse (for example, one person holding many unpaid orders), we keep a scrambled code made from your IP address with each order, never the address itself.
If you create an account
You need an account to place an order. For it we keep your name, email address, your mobile number if you add one, the addresses you save and your orders, and your password only in a scrambled form (a hash) that cannot be turned back into the password.
Each time you sign in, we keep a record of that session: when it started and ends, and the IP address and browser it came from. We use it to keep you signed in and to spot misuse of your account. A session ends after 30 days at most, or when you sign out, which deletes its record.
Paying online: Razorpay
Online payments are handled by Razorpay. Your card, UPI or bank details go straight to Razorpay and never reach us: we never see or store your card number. Razorpay tells us whether the payment went through, the method used and a payment reference, which we keep with your order and use for any refund.
Razorpay handles your payment details under its own privacy policy (opens in a new tab).
Delivery: Shiprocket
We book deliveries through Shiprocket, which hands each parcel to a courier. To deliver your order they receive your name, mobile number and delivery address, and the parcel's contents, weight and value (and the amount to collect, for cash on delivery). The courier's tracking updates come back to us and appear on your order page.
Emails: Resend
We email you only about your orders (confirmation, dispatch, delivery, cancellations and refunds) and your account (confirming your email address, resetting your password). These emails are sent from our own address through Resend's email service, which receives your email address and the message in order to deliver it.
Counting visits, without cookies
To know how the shop is doing, we count visits ourselves. This uses no cookies, and nothing is sent to advertising or analytics companies. For this counting, your IP address is never stored.
For each page you view we record the page's address, the website that sent you (its name only), any campaign tags in the link you followed (such as utm_source), whether you are on a phone, tablet or computer, and a random number your browser tab makes up for that visit (kept in the tab, not in a cookie, and replaced after 30 minutes without activity). We also count when something is added to the bag.
To count how many different people visit in a day without knowing who they are, we mix your IP address and browser details with a random key that changes every day, and keep only the scrambled result. Each daily key is deleted once its day ends (India time), so the result cannot be traced back to you or linked across days.
These visit records are deleted after 400 days.
Cookies and your browser's storage
- Sign-in cookies (their names start with kokora-shop), only if you sign in to an account: they keep you signed in, and other websites cannot read them.
- kokora_src, for 30 days: how you first found us (the campaign tags in the link, the website you came from and the first page you opened). If you place an order, this is saved with it so we can tell which of our campaigns work.
- Your bag is kept in your browser's own storage (not a cookie) on your device until you place your order or empty it.
- The contact and delivery details you type at checkout are kept in your browser's own storage on your device too, so you don't have to type them again — never your password or anything about payment, and never sent to us until you place an order. They are removed after 30 days without a change, when you sign out, or when you choose "Forget these details" at checkout.
- Razorpay's payment window may set its own cookies when you pay online.
There are no advertising or tracking cookies, so there is no cookie banner.
Who else sees your data
Besides Razorpay, Shiprocket and its couriers, and Resend:
- our team, through our order system, only as far as their work needs (for example, whoever packs your parcel sees the delivery address);
- our hosting: the shop runs on a DigitalOcean server in Bangalore, India; encrypted backups are stored in Cloudflare's R2 storage, which we ask to keep them in the Asia-Pacific region;
- authorities such as tax officers or the police, when the law requires us to share it.
We never sell or rent your personal data.
How long we keep it
- Orders and invoices: as long as tax and accounting law requires (usually eight years), even if you close your account.
- Your account and saved addresses: until you ask us to erase your account.
- Sign-in records (when, and the IP address and browser): deleted when you sign out or your account is erased; a session stops working after 30 days.
- Visit records: 400 days. The daily keys behind visitor counts: until their day ends.
- How you found us (kokora_src): 30 days in your browser, or with your order if you place one.
Your rights: a copy, corrections, deletion and more
You can ask us for a copy of the personal data we hold about you, to correct it, or to delete it. Write to info@kokoraspices.com from the email address you used with us, so we know the request is yours. We reply within 30 days.
When you ask us to delete your data, we erase your account: your name and email address are removed from it, and your saved addresses and sign-in records are deleted, so the account can no longer be used. Your orders and invoices, with the name, contact details and address on them, are kept for as long as tax law requires, and used for nothing else.
You can withdraw your consent to our use of your personal data at any time, as easily as you gave it: write to info@kokoraspices.com. We then stop using it, except where the law requires us to keep it (such as order and tax records). Withdrawing doesn't affect what we did before.
You can also nominate someone to exercise these rights for you if you die or become unable to (for example, through illness): write to info@kokoraspices.com with their name and how to reach them.
You can change your saved addresses yourself at any time, on your account page.
Keeping it safe
The whole shop uses an encrypted connection (https), passwords are stored only in scrambled form, only our team can see orders, and backups are encrypted. If something ever put your data at risk, we would tell you and the authorities as the law requires.
Children
The shop is meant for adults. If you are under 18, please ask a parent or guardian to order for you.
Questions and complaints
Write to info@kokoraspices.com about anything in this policy or about your data.
If we have not resolved your concern, contact our Grievance Officer, Mr. Rahul, at info@kokoraspices.com.
If you are still not satisfied after that, you can complain to the Data Protection Board of India.
If we change this policy, we will update this page and the date at the top.