Printcept India ("Printcept", "we", "us") is a sole proprietorship based in Red Hills, Hyderabad, Telangana. Under India’s Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the "Data Fiduciary" for your personal data — the ones responsible for it — and you are the "Data Principal" — the person it belongs to. This policy explains, in plain language, what we collect, why, how long we keep it, who we share it with, and how you can control it.

This privacy notice is available in any Eighth Schedule language upon written request to our Grievance Redressal Officer (Section 4).

1. Data We Collect & Why

Operational data — what we need to make and deliver your order:

Your details: your name, phone (WhatsApp) number and shipping address, plus your email address and GSTIN if you choose to give them.
Your print artwork: the files you upload, the digital proofs we prepare from them, and your approval or change requests on those proofs.
Your order: products, specifications, quantities, delivery notes and payment status. Payments are handled entirely by Razorpay — we never see or store your card, UPI or bank details, only whether a payment succeeded and its reference.
Messages: support conversations, one-time sign-in codes, and order and dispatch updates sent over WhatsApp, email or SMS.

Why — a specified purpose: we process operational data strictly for the purpose you provide it for: processing your order, verifying proofs with you, producing and dispatching your prints, keeping you updated, and issuing GST invoices (through Zoho Books). This is the “specified purpose” basis in Section 7(a) of the DPDP Act. We do not use it for anything else, and we never sell or rent it.

Optional data — only with your affirmative consent: site analytics through Google Analytics 4 (which pages are used, from what kind of device) and advertising measurement through the Meta Pixel. Neither loads until you switch it on, and both are off by default (see Section 6).

2. Artwork & Data Retention

Artwork and proofs are kept in private storage, so we can run re-orders and keep a record of exactly what you approved. They are never publicly accessible: only our signed-in team can open them, and your proof link shows you yours through a link that expires shortly after.
How long: your print artwork and other uploaded files are held in active storage for 7 to 14 days after your order is dispatched, so we can verify the job and run reprints. After 14 days they are kept only as our server capacity allows, up to a maximum of 3 years, after which they are permanently deleted automatically. Please keep your own backups of your designs. You can also ask us to delete them sooner via /data-rights-request. Once deleted, a reprint needs the files again.
Invoices and order records: official GST tax invoices are generated in Zoho Books, our accounting system, and kept there for as long as Indian tax and GST law requires (up to 8 years). The order records on this website are operational estimate and order slips, not tax invoices; we keep them while your account is active and for up to 8 years afterward, to match the invoices they relate to. A deletion request cannot remove what the law obliges us to keep, but we stop using it for anything else.
Consent records (Section 6) are kept so we can show that we asked, and which version of this policy you were shown.

3. Your Rights Under the DPDP Act

Right to Access (Section 11): ask for a summary of the personal data we hold about you and of who we have shared it with.
Right to Correction (Section 12): ask us to correct, complete or update anything that is inaccurate, incomplete or out of date.
Right to Erasure (Section 12): ask us to delete your personal data, including your artwork, subject to what the law requires us to keep (Section 2).
Right to Nominate (Section 14): name someone to exercise these rights on your behalf in the event of your death or incapacity.
Withdraw consent for analytics or advertising at any time, as easily as you gave it (Section 6).
Grievance redressal (Section 13): complain to our Grievance Redressal Officer (Section 4), and then to the Data Protection Board of India if we do not resolve it.

To use any of these, fill out our Data Rights Request form, or email orders@printcept.in with your registered name and phone number. We verify your identity against the phone number or email on your order before acting, and respond within 30 days.

4. Grievance Redressal Officer

If you have a complaint about how your personal data has been handled, contact our Grievance Redressal Officer, or use the Data Rights Request form:

Designation: Grievance Redressal Officer, Printcept India
Address: Printcept India, Red Hills, Lakdikapul, Hyderabad, Telangana — 500004
Email: orders@printcept.in
Turnaround: Acknowledged within 48 hours; resolved within 30 days as prescribed by law.

If you remain unsatisfied with our resolution, you may approach the Data Protection Board of India.

5. Who We Share It With

We never sell or rent your data. A few trusted services help us run the business, and each only gets what it needs to do its job:

Supabase — stores your account, order and artwork data (our database, file storage and login provider, including Google Sign-In).
Amazon Web Services (AWS) — hosts this website, so it handles the technical data every visit sends, such as your IP address.
Razorpay — handles payments.
Zoho Books — issues our GST tax invoices, so it receives your billing name, address and GSTIN.
Delhivery — our courier, so they get your name, address and phone to deliver your order.
Meta (WhatsApp) — sends your sign-in codes and order/status messages; also runs the Meta Pixel for ads, only if you switch it on.
Google Analytics — tells us how the site is used, only if you switch it on.
Make.com — forwards order confirmations to our team’s inbox.
Fast2SMS — sends order updates by SMS, where SMS updates are switched on.
Trade print partners — when part of a job is produced outside our workshop, the partner receives the artwork file (through a link that expires) and the job specifications only, never your name, phone number or address. Finished work comes back to our workshop before it reaches you.

One thing worth knowing: our database (Supabase) runs on servers in Tokyo, Japan, not India. This is allowed under the DPDP Act’s cross-border transfer rules, and your data still only goes to the services listed above, for the purposes listed above — nowhere else.

6. Cookies, Device Storage & Your Choices

Essential operations (always on): your cart, your sign-in session, the delivery details from your last order (kept on your device to prefill checkout), and your cookie choice itself. The store cannot work without these, so they need no consent.
Performance & Analytics (off by default): Google Analytics 4.
Marketing & Retargeting (off by default): the Meta Pixel.

Choose or change these at any time from Cookie & Privacy Choices in the footer of every page. Switching one off stops it at once. We keep a simple record of each choice (a random ID, what you chose, which page, and which version of this policy was shown — never your name or IP address) so we can show we asked for consent if a regulator ever wants proof.

7. How We Keep It Safe

Your data is stored on Supabase with encrypted connections and access-controlled database rules, and sign-in is handled through Google Authentication or a phone-based login — we don’t run our own separate password system. Payments are tokenized through Razorpay and never touch our servers.

If a personal data breach ever happens, we follow Rule 7 of the DPDP Rules, 2025: we tell every affected user without delay, in plain language, what happened, its likely impact, what we have done and what you can do; we send the Data Protection Board of India a preliminary intimation without delay; and we file a detailed report with the Board within 72 hours.

8. Children’s Privacy

Printcept is meant for users 18 and older. We don’t knowingly collect data from children, and we don’t show them targeted ads or track them. If you’re a parent and think your child has given us their data, email us and we’ll delete it.

9. Other Websites

Our site sometimes links out to other websites. We’re not responsible for how they handle your data, so it’s worth checking their own privacy policy separately.

10. Changes to This Policy

If we update this policy, we’ll post the change here with a new "Last updated" date at the top.

11. Contact Us & Jurisdiction

Questions about this Privacy Policy can be sent to orders@printcept.in. This policy is governed by the laws of India, and disputes are subject to the exclusive jurisdiction of the courts in Hyderabad, Telangana.