Privacy Policy

01Introduction & Our Role

This Privacy Policy explains how AP Astro Private Limited, operating Apastro.store ("Apastro", "we", "us" or "our"), collects, uses, discloses, retains and safeguards your personal data when you access or transact on the Platform. We act as a Data Fiduciary in respect of such data.

This Policy is issued in compliance with the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000, and the rules framed thereunder. By using the Platform, you (the "Data Principal") consent to the practices described herein.

02Personal Data We Collect

We collect only such personal data as is necessary for the purposes set out in this Policy:

• Identity & contact data: name, email address, telephone/mobile number and delivery/billing address.
• Order & transaction data: products purchased, order history, invoices and communications relating to your orders.
• Payment data: payment is processed by our gateway partner, Razorpay Software Pvt. Ltd. We do not store your full card number, CVV or banking credentials on our servers; we receive only a transaction reference and payment status.
• Technical & usage data: IP address, device and browser type, operating system, and interactions with the Platform, collected through cookies and similar technologies.
• Voluntary data: information you choose to provide, such as reviews, feedback, support queries, or details shared for a personalised recommendation.

03Purposes of Processing

Your personal data is processed for the following specified, lawful purposes:

• To create and administer your account and authenticate access.
• To process, fulfil, dispatch and deliver your orders, and to handle returns and refunds.
• To communicate order updates, service notifications and respond to your enquiries.
• To process payments and prevent, detect and investigate fraudulent or unlawful activity.
• To improve our products, services and user experience, and—where you have consented—to send you promotional offers and updates.
• To comply with applicable legal, regulatory, taxation and accounting obligations.

04Legal Basis & Consent

We process your personal data on the basis of the consent you provide at the point of collection, or for legitimate uses permitted under the DPDP Act. Your consent is sought through clear, affirmative action; we do not rely on pre-ticked boxes or assumed consent for non-essential processing.

You may withdraw your consent at any time by writing to support@apastro.store. Withdrawal will not affect the lawfulness of processing carried out prior to such withdrawal, nor our ability to complete the supply of goods already ordered or to meet legal obligations.

05Disclosure & Sharing of Data

We do not sell, rent or trade your personal data. We disclose it only to the limited extent necessary, to the following categories of recipients (acting as Data Processors under contractual safeguards):

• Logistics & courier partners, to effect delivery of your orders.
• Payment gateway (Razorpay Software Pvt. Ltd.), to process and confirm transactions securely.
• Technology & infrastructure providers (including cloud hosting and media-storage services) engaged to operate the Platform.
• Professional advisors and authorities, where disclosure is required by law, court order, or a lawful governmental request, or to protect our rights and the safety of our users.

All such recipients are bound by obligations of confidentiality and data protection consistent with this Policy and applicable law.

06Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy legal, tax, accounting and dispute-resolution requirements. Transaction and invoicing records are ordinarily retained for the period mandated under applicable taxation and commercial laws. Upon expiry of the applicable retention period, or upon a valid erasure request where no overriding legal obligation subsists, your personal data shall be securely deleted or anonymised.

07Data Security

We implement reasonable technical and organisational security measures designed to protect your personal data against unauthorised access, alteration, disclosure or destruction. These include encryption in transit, access controls and access logging, secure hosting environments, and routine review of our safeguards. While we strive to protect your data, no method of transmission or storage over the internet is entirely secure, and we cannot guarantee absolute security.

In the event of a personal data breach, we shall act in accordance with our obligations under the DPDP Act and Rules, including timely intimation to affected Data Principals and to the Data Protection Board of India where required.

08Your Rights as a Data Principal

Subject to the DPDP Act, you have the right to:

• Access a summary of the personal data we process about you and the processing activities undertaken.
• Correction, completion and updating of inaccurate or incomplete data.
• Erasure of your personal data where it is no longer necessary and no legal obligation requires its retention.
• Withdraw consent previously granted, as described above.
• Grievance redressal in respect of our handling of your data.
• Nominate an individual to exercise your rights in the event of death or incapacity.

To exercise any of these rights, please contact us using the details in the Grievance & Contact section below. We may take reasonable steps to verify your identity before acting on a request.

09Cookies & Tracking Technologies

The Platform uses cookies and similar technologies to enable core functionality, remember your preferences, maintain your cart and session, and analyse usage to improve our services. You may manage or disable cookies through your browser settings; however, certain features of the Platform may not function correctly if cookies are disabled.

10Children's Data

The Platform is intended for use by persons aged eighteen (18) years and above. We do not knowingly collect personal data of children without verifiable consent of a parent or lawful guardian, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child's data has been provided to us, please contact us so that we may take appropriate action.

11Changes to this Policy

We may amend this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The revised version will be posted on this page with an updated "Last updated" date, and, where required, we will notify you of material changes. Your continued use of the Platform following any amendment constitutes acceptance of the updated Policy.

12Grievance & Contact

For any privacy-related query, request or complaint, you may contact our data protection contact, Vivek, at support@apastro.store.

If your concern remains unresolved to your satisfaction, you may escalate the matter to the Data Protection Board of India established under the DPDP Act, 2023, in accordance with the procedure prescribed under the Act and Rules.