Privacy Policy

1. Who We Are

Mahamaya is a handcrafted incense (agarbatti) and dhoop cone brand based in Samastipur, Bihar, India, selling direct-to-consumer, to wholesale/distributor partners, and for corporate/festive gifting, with exports to customers worldwide. You can reach us at mahamayaproject01@gmail.com or +91 75492 73701 (WhatsApp).

2. Information We Collect

We keep the information we collect to the minimum needed to respond to you. Currently, the site does not support online checkout or payment — all orders are arranged directly via enquiry, so we do not collect or store any payment card details.

• Contact form data: your name, email address, the type of enquiry you select (general, D2C, gifting/corporate, or wholesale/export), your message, and the language the site was set to when you submitted the form.
• Preferences stored on your device: a currency preference saved in your browser's local storage, and a language preference saved in a cookie named NEXT_LOCALE.
• Standard technical information collected automatically by our hosting provider (Vercel) as part of normal web server operation, such as IP address and browser type, for security and reliability purposes.
• Newsletter signup data, if you choose to subscribe: your email address, the language you signed up in, and a record of when and to what you consented.

3. How We Use Your Information

• To respond to your enquiry and communicate with you about products, pricing, and orders arranged via enquiry.
• To arrange D2C, gifting/corporate, or wholesale/export orders that you request.
• To remember your language and currency preference on future visits.
• To maintain the security and proper functioning of the website.
• To comply with our legal obligations, for example tax and export record-keeping.

4. Legal Basis for Processing

For visitors in the European Economic Area and United Kingdom, we process your personal data on the following legal bases under the General Data Protection Regulation (GDPR): your consent (when you voluntarily submit the contact form), our legitimate interest in responding to enquiries and operating a functioning website, and, where an order is being arranged with you, the steps necessary to perform a contract at your request.

5. Who We Share Your Information With

We do not sell your personal information. We share it only with the service providers ("processors") that help us run the website and respond to enquiries:

• Formspree — processes and delivers contact form submissions to us.
• Google Sheets — used internally to log and track enquiries.
• Telegram — used to send our team an internal notification when a new enquiry arrives.
• Vercel — hosts this website.
• Cloudinary — hosts and serves our product and lifestyle images; it does not receive your personal information.
• Brevo — holds our newsletter list and delivers the confirmation email, the newsletter, and unsubscribes.
• We may also disclose information where required by law, such as to comply with a customs, tax, or export regulation, or a valid legal request.

6. Cookies & Local Storage

We currently use only functional cookies and browser storage necessary for the site to work as intended — we do not use advertising cookies, analytics trackers, or third-party marketing pixels.

• NEXT_LOCALE cookie — remembers which language you've selected.
• Currency preference — saved in your browser's local storage so the site can display prices in your preferred currency; this stays on your device and is not sent to our servers.

7. Marketing Emails & Newsletter

If you ask to receive our newsletter, we collect your email address, the language you signed up in, and a timestamped record of the consent you gave. We add you to the list only after you confirm by clicking the link in a confirmation email we send you (double opt-in). An address that is never confirmed is never mailed.

• Legal basis: your consent. You can withdraw it at any time, and withdrawal does not affect anything we sent before you withdrew it.
• Every newsletter carries a one-click unsubscribe link, and you can unsubscribe at any time from the /unsubscribe page on this site or by emailing us.
• We use Brevo, an email service provider, to hold the list and to send the confirmation email, the newsletter, and to process unsubscribes and bounces on our behalf.
• We never sell, rent, or share the newsletter list. We also do not use enquiry-form addresses for marketing — sending us an enquiry is not a newsletter subscription.

8. Data Retention

We keep enquiry information for as long as reasonably necessary to respond to you, arrange any order you request, and maintain business and tax records, after which it is deleted or anonymised. You may request earlier deletion at any time — see Section 13.

9. Your Rights

If you are located in the European Economic Area or United Kingdom, under the GDPR you have the right to access, correct, delete, restrict, or object to our processing of your personal data, the right to data portability, the right to withdraw consent at any time, and the right to lodge a complaint with your local data protection supervisory authority.

If you are located in India, under the Digital Personal Data Protection Act, 2023 (DPDP Act) you have the right to access a summary of your personal data and processing activities, the right to correction and erasure of your personal data, the right to grievance redressal, and the right to nominate another person to exercise these rights on your behalf in the event of death or incapacity.

To exercise any of these rights, contact us using the details in Section 13 — we will respond within a reasonable time and in line with applicable law.

10. Children's Privacy

This website is intended for adults and businesses. We do not knowingly collect personal information from children, and if we become aware that we have inadvertently done so, we will delete it promptly.

11. International Data Transfers

Because we use service providers such as Formspree, Google, Telegram, Vercel, and Cloudinary, your information may be processed on servers located outside India, including in the United States or European Union. These providers maintain their own safeguards for handling personal data; where required, we rely on standard contractual or equivalent safeguards for such transfers.

12. Security

We take reasonable technical and organisational measures to protect the information you share with us. However, no method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security.

13. Contact Us & Requesting Deletion

For any privacy question, or to request access to, correction of, or deletion of your personal information, contact us at mahamayaproject01@gmail.com or on WhatsApp at +91 75492 73701. Please include enough detail (such as your name and the email used) for us to locate your information.

14. Changes to This Policy

We may update this Privacy Policy from time to time as our website or practices change. The "Last updated" date at the top of this page reflects the most recent revision. We encourage you to review this page periodically.