Who is responsible
Vervaine, the clothing brand based in Pune, India, decides how personal data is used for this website. Contact the Vervaine privacy team at hello@vervaine.in for a privacy question, rights request or grievance. Include enough information to locate your account or order, but never send a password, sign-in code, card details or UPI PIN.
What we collect and why
| Information | Purpose |
|---|---|
| Email, verified account ID, provider, session information and optional name | Create and secure your account, verify sign-in, show your profile and provide support. Google or Apple may share your email, name and provider identifier when available. We never receive their passwords. |
| Recipient name, phone, address, products, sizes, colours, quantities, totals, payment references and order status | Process orders, reconcile UPI payments, deliver purchases, manage cancellations, refunds, support, fraud prevention and required transaction records. A recipient address is used for that order; saving it to your profile is optional. |
| Waitlist name, email, optional WhatsApp number and clothing preferences; permission and unsubscribe time | Send launch emails you request and understand collection preferences. A phone number alone does not authorise a WhatsApp campaign. Signing in does not subscribe you to marketing. |
| Optional browser notification subscription and random account alias | Send alerts after you opt in. Account notifications use a general message; order details require sign-in. |
| Feedback, optional contact email and reply permission; fit proof links, notes and review outcome | Reply to feedback, improve the collection and review Circle submissions. Proof links are private and not published automatically. Remove other people's personal information before submitting. |
| Franchise application details when submitted | Assess and respond to the application. This is separate from a shopping account and may need a separate erasure request. |
| Network/IP, browser/device, request/error records, consent and security events | Deliver pages, limit abuse, investigate incidents and record privacy choices. Hosting, authentication and delivery providers also keep operational logs. |
Permissions and your choices
The sign-in screen asks you to read this notice and agree to account processing. Optional launch emails and browser alerts have separate choices. You can decline optional permissions and still browse or order. Essential sign-in, order and security messages are necessary to provide the service you request.
Account → Privacy & data lets you download available account data, withdraw optional email and account notification permissions, and delete your account. You can also use the unsubscribe link in launch emails, block browser notifications, or contact us. We verify requests before releasing or changing personal information. We do not sell your personal information or use it for behavioural advertising.
Protecting your account
Account endpoints check the signed-in identity and a live session on the server. Public visitors cannot read private account tables. Customer records are restricted to the relevant account and authorised service or staff roles. Data travels over HTTPS. Deletion requires a recent sign-in and explicit confirmation. Service secrets are not placed in the public website.
No website can promise that a breach will never happen. Sign out on shared devices and keep codes private. We never need your Google or Apple password, UPI PIN or bank password.
Services that process information for us
Vercel hosts the website, Supabase provides accounts and the database, Resend sends sign-in and transactional emails, and OneSignal provides optional notifications. Shopify may process purchases through its checkout or linked account. Authorised staff and delivery partners receive details needed for support and fulfilment. UPI payments take place in your chosen app; we receive the reference you submit for reconciliation.
External fonts, the 3D library and other resources may share basic connection information with their hosts when loaded. Providers may process data outside India. Processing is for the purposes stated here and subject to applicable transfer restrictions; contact us for information about your data.
Browser storage and autofill
The bag, saved pieces, notification settings and privacy choices use browser storage. A sign-in session is kept for the current browser session unless you choose “Keep me signed in”. Clearing storage or signing out removes the local session. Name, email and address autofill is controlled by your browser; we do not save form details in advertising cookies. The fit builder works without an account.
Retention and deletion
We keep account information while it is used. Deleting your account removes sign-in access, profile, saved address, Circle submissions, the associated waitlist entry and identifiable feedback from the active database. Provider notification identity cleanup is queued. A new account does not automatically recover orders hidden by a previous deletion.
Deletion does not cancel an order or refund a payment. Necessary order, payment, delivery, dispute, security and legal records are retained with restricted access for their required purpose and applicable retention period. Minimal privacy audit records are kept for one year. Provider logs, delivered email inboxes and backups follow their retention cycles; they are not used to recreate an active profile. Contact us for records outside the account download or a specific retention question. We review retention and erase or anonymise records once no longer needed and law permits.
Your Google or Apple account is not deleted. You can separately remove Vervaine's access in that provider's account settings.
Rights, requests and grievances
Edit your name and saved address in your account. Contact hello@vervaine.in for other access, correction, completion, erasure, sharing details or to nominate a person to exercise applicable rights. Use “Privacy request” or “Privacy grievance” in the subject. We may require proportionate identity verification; do not send identity documents unless needed and a secure method is agreed.
We aim to answer grievances within 30 days and communicate the outcome within 90 days. After our grievance process, you may pursue remedies under applicable law, including approaching the Data Protection Board of India when that process applies. We will explain any lawful reason we cannot erase a record.
Children and guardians
Accounts and checkout are intended for adults aged 18 or older. We do not offer child accounts or knowingly target children with tracking or advertising. A parent or guardian should use their own account for purchases. Contact us if a child's data was submitted without appropriate authority so we can restrict and address it. Contact our privacy team for verification when a lawful guardian acts for another person.
If a breach affects you
When we become aware that a breach affects your personal data, we will notify you without delay through your registered contact details or account. The notice will explain what happened, possible effects, protective measures, steps you can take and a contact for help. We will make required reports to the appropriate authority and provide updates as facts become available.
Notice updates
We publish material changes here and seek fresh permission where needed for new uses. India's Digital Personal Data Protection Act, 2023 and final 2025 Rules have phased commencement. This notice describes our service controls and choices; legal rights and duties apply according to their commencement dates.