Skip to content
Story Roots

Story Roots — Privacy Policy

Last updated: 17 September 2026

1. Who we are

This website, storyroots.co (the "Website"), and the Story Roots brand are operated by Kuldhar Global Ventures LLP ("Story Roots", "we", "us", "our"), Office 1206, SS Omnia, Sector-86, Gurugram, Haryana – 122004, India. We are the data fiduciary responsible for personal data collected through the Website. Questions: support@storyroots.co.

2. Scope & your consent

This Policy explains what personal data we collect, why, how we use and protect it, and your rights. By using the Website or providing us your personal data, you consent to the practices described here. You may withdraw consent at any time (see §10) — withdrawal does not affect processing already carried out.

3. What personal data we collect

When you place an order on the Website, at checkout we collect your name, mobile number, and delivery address (street address, city, state and PIN code). You may also give us an email address (so we can send you a receipt) and a delivery note. We store this with the items you ordered and the amounts, so that we can fulfil and deliver the order.

If you create an account, we collect your email address — we use it to send you a sign-in link, as we do not use passwords. If you choose to save your details for faster checkout, we store the name, phone number and address you save, and your order history is linked to your account.

When you contact us or order over WhatsApp, we collect your name, email and message, or your phone number and the content of your messages. Conversations on WhatsApp also happen on WhatsApp's own platform and are subject to WhatsApp's/Meta's privacy terms, not only ours.

If you join the Common Table Club or ask for updates, we collect your email address.

Information collected automatically: our hosting provider records basic technical information such as your IP address, device and browser type, and the pages requested, in ordinary server logs used for security and reliability. The Website also uses the Meta Pixel (see §7), which collects information about your visit — the pages and products you view, actions such as adding an item to your cart, beginning checkout and completing a purchase, the items and amounts involved, and technical details like your IP address and browser — and shares it with Meta Platforms so that we can measure our advertising. It also uses Google Analytics (see §7), which collects the same kinds of information about your visit and shares it with Google so that we can understand how the Website is used. The Website additionally stores a small amount of data in your own browser — the contents of your cart, and, if you have signed in, your sign-in token. That cart and sign-in data stays on your device; it is not sent to third parties.

What we do NOT collect: we do not ask for, collect or store your payment credentials — card numbers, UPI IDs, netbanking logins, CVVs or PINs — at any point. Payments are processed by Razorpay Software Private Limited ("Razorpay"), a PCI-DSS-compliant payment gateway. You enter those details on Razorpay's own systems — whether on a payment link we send you or a payment page provided by Razorpay — and they never reach us. What we receive back is confirmation that a payment succeeded or failed, and a reference number for it. We also do not knowingly collect sensitive personal data or children's data (see §11).

4. Why we use it

To accept, confirm, fulfil and deliver your orders, and to contact you about them; to arrange payment, refunds and returns; to maintain your account and order history if you create one; to respond to your queries; to send you updates/newsletters where you have opted in; to operate, secure and improve the Website; and to comply with law.

5. Legal basis

We process your personal data on the basis of your consent under the DPDP Act. Where we rely on any other lawful ground (e.g. legal obligation), we will act consistently with applicable law.

6. Sharing and disclosure

We share personal data only as needed with service providers/data processors who work on our behalf, under confidentiality and data-protection obligations. As of the date above these are:

  • Vercel — hosting for the Website and its order-handling code.
  • Supabase — the database in which your order and account details are stored, on servers located in India (Mumbai).
  • Razorpay — our payment gateway. It receives the name, contact details and amount needed to process your payment or refund, and it — not us — handles your card/UPI/netbanking credentials.
  • Courier partners — given your name, delivery address and phone number so they can deliver your order.
  • Meta Platforms — where we confirm your order with you on WhatsApp, and for advertising measurement (see §7): the Meta Pixel on the Website, and our own systems alongside it, share information about your visit (including the products you view, add to your cart and purchase) with Meta, and when you complete a purchase we also report it to Meta from our systems, together with your name, email address, phone number and delivery city, state and PIN code in hashed (scrambled, one-way) form so Meta can match the purchase to an ad it showed you.
  • Google — provider of Google Analytics (see §7): it receives information about how you use the Website — the pages and products you view, cart and checkout actions and purchases, the items and amounts involved, and technical details like your IP address and browser. We do not send Google your name, email address, phone number or delivery details in any form.

We also share personal data with authorities where required by law or to protect our rights, and in a business transfer (merger/acquisition). We do not sell your personal data. Other than the Meta Pixel described in §7, we do not share your data for advertising.

7. Cookies and analytics

The Website uses the Meta Pixel, an advertising-measurement tool provided by Meta Platforms. It sets cookies in your browser (such as _fbp) and sends Meta information about how you use the Website — the pages and products you view, actions such as adding an item to your cart, beginning checkout and making a purchase, the items and amounts involved, and technical details like your IP address and browser. The same measurements are also passed through our own servers to Meta, so that the measurement still works when a browser blocks the Pixel; each action carries a shared identifier so Meta counts it once, however it arrives. When a purchase is confirmed, we also report it to Meta directly from our servers with the same order details, along with your name, email address, phone number and delivery city, state and PIN code in hashed form — a one-way scrambling that lets Meta match the purchase against its own records without receiving any of them in readable form. We use all of this to measure whether our advertising works. Meta processes this data under its own privacy policy, and may connect it to your Facebook or Instagram account if you have one; you can manage this in Meta's own settings (Ads Preferences and "Your activity off Meta technologies") and limit tracking cookies through your browser settings. The Pixel does not run on your account or order-status pages.

The Website also uses Google Analytics, a usage-measurement tool provided by Google. It sets cookies in your browser (such as _ga) and sends Google the same kinds of information from your browser — the pages and products you view, cart and checkout actions and purchases, the items and amounts involved, and technical details like your IP address and browser. Unlike the purchase reporting to Meta above, we do not send Google your name, email address, phone number or delivery details in any form, hashed or otherwise; a purchase is reported with its Razorpay reference number, not your identity. We use it to understand how the Website is used. Google processes this data under its own privacy policy, and you can limit its cookies through your browser settings. Like the Pixel, Google Analytics does not run on your account or order-status pages.

Beyond that, the Website keeps your cart, and your sign-in token if you have an account, in your browser's own local storage so that the site works — this stays on your device and is not shared with anyone. You can clear it through your browser settings at any time; doing so will empty your cart and sign you out. We use no other third-party analytics or tracking service.

8. Data retention

We keep personal data only as long as necessary for the purposes above or as required by law, after which we delete or anonymise it. Order records are kept for as long as we are required to keep them under tax, accounting and company law, even if you close your account.

9. Security

We maintain reasonable security safeguards (such as access controls and encryption in transit) in line with the DPDP Rules, 2025. No method of transmission or storage is completely secure; we cannot guarantee absolute security. In the event of a personal-data breach, we will notify affected individuals and the Data Protection Board of India as required under applicable law.

10. Your rights

Subject to applicable law, you may: access your personal data; correct or complete it; request erasure; withdraw consent; nominate another person to exercise your rights; and raise a grievance. To exercise any right, email our Grievance Officer (§14). We may need to verify your identity before acting on a request.

11. Children

The Website is not directed at children. We do not knowingly collect personal data of anyone under 18 without verifiable parental/guardian consent as required by the DPDP Act and Rules. If you believe a child has provided us data, contact us and we will delete it.

12. Cross-border transfers

Your order and account data is stored on servers in India (Mumbai). Some of our service providers are established outside India and may process technical and usage data (such as server logs, and the visit data collected by the Meta Pixel and Google Analytics) outside India; such transfers are made in accordance with applicable law, including any restrictions notified under the DPDP Act.

13. Third-party links

The Website may link to third-party sites and services (including WhatsApp). We are not responsible for their content or privacy practices; review their policies separately.

14. Grievance Officer

In accordance with the DPDP Act, the Information Technology Act, 2000 and the Consumer Protection (E-Commerce) Rules, 2020, our Grievance Officer is:

Sushant Dhar, Grievance Officer

Kuldhar Global Ventures LLP, Office 1206, SS Omnia, Sector-86, Gurugram, Haryana – 122004

Email: info@kuldhar.com

Phone: +91 88001 92188

We will acknowledge your complaint within a reasonable time and endeavour to resolve it within the timelines prescribed under applicable law.

15. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date will change accordingly, and continued use of the Website means you accept the revised Policy.

16. Governing law

This Policy is governed by the laws of India.