Privacy Notice
What personal data we collect, why, how long we keep it, who sees it, and how to control it. Plain language, no surprises.
Data fiduciary
easewrap.in is run by Phonemate India (“EaseWrap”, “we”), 8-44-24, Old CBI Down, Chinna Waltair, Visakhapatnam - 530017. Under India's Digital Personal Data Protection Act, 2023 we are the data fiduciary for the personal data described here. Questions go to support@easewrap.in.
What we collect, why, and for how long
| Data | Purpose | Basis | Kept for |
|---|---|---|---|
| Name, phone, email, delivery address and pincode; phone brand and model; what you ordered and paid | To make, pack, ship and support your order; to send order, dispatch and delivery emails; tax and accounting records | Legitimate use: you gave it for this (DPDP s. 7(a)) | 8 years from the end of the financial year of the order (tax law). Then deleted. |
| Payment reference and status from Razorpay (never card, UPI PIN or bank details) | To match the payment to the order, refunds | Legitimate use: you gave it for this (DPDP s. 7(a)) | With the order record (8 years). |
| Email from a checkout that wasn't paid | One reminder email if a checkout is left unpaid | Part of the checkout you started; every reminder has an unsubscribe link | The unpaid checkout is kept up to 90 days, then deleted. |
| Email, phone, name, city, state and pincode in hashed (scrambled) form, with IP address, browser and Meta cookie ids | To tell Meta an order happened, so we can measure our Facebook and Instagram ads | To measure our ads; you can object any time with the data-rights form, and we'll stop for your orders | Sent once per order. Meta keeps it under its own terms. |
| Name, email and password (stored hashed), or your Google name and email | Your account: order history, faster checkout | Legitimate use: you gave it for this (DPDP s. 7(a)) | Until you ask us to delete the account. |
| Email address | Newsletter: new drops and offers (only after you confirm by email) | Your consent (a tick, then a confirm link) | Until you unsubscribe. We then keep only the address, marked unsubscribed, so we never email it again. |
| Name, email, phone and message from the contact form or a data-rights request | To reply and to act on the request | Legitimate use: you gave it for this (DPDP s. 7(a)) | 1 year after the conversation ends. |
| Order id, email, phone, description, photos and unboxing video for a replacement claim | To assess and resolve the claim | Legitimate use: you gave it for this (DPDP s. 7(a)) | 1 year after the claim is closed. |
| Your name, phone model, rating, review text and photos | Shown publicly on the product page once approved | Your consent (a tick on the review form) | Until you ask us to remove it. |
| Record of each consent: what you agreed to, when, the notice version, a scrambled form of your IP address and your browser | To prove consent, as the law requires | Legal obligation | As long as we use data on that consent, and 3 years after. |
| Server and security logs: IP address, browser, pages requested | Security, fraud and abuse prevention, debugging | Legitimate use for security | At least 1 year (DPDP Rules), then deleted. |
Card numbers, UPI PINs, CVVs and net-banking credentials are entered on Razorpay's checkout, not ours. We receive only a payment reference and a success or failure status.
Our shop is meant for people aged 18 or older. If you are under 18, a parent or guardian must place the order. We don't knowingly track children or show them targeted ads; if you believe a child has given us data, write to support@easewrap.in and we'll delete it.
Who else sees it
We don't sell your data. These service providers (data processors) handle it for us, only for the purposes above:
- Razorpay (India): payments.
- Shiprocket and its courier partners (India): name, address and phone, so the parcel arrives.
- Supabase: our database and file storage. Hostinger: web hosting and server logs.
- Resend (USA): sends our emails.
- India Post pincode service: the pincode you type at checkout, to fill in city and state.
- Google (USA): sign-in, only if you choose “Continue with Google”; and Google Analytics.
- Meta (USA): the pixel; and hashed order details, to measure our ads.
- YouTube (Google): video thumbnails on the home page come from Google's servers, and the player loads from youtube-nocookie.com only when you press play.
- Government authorities and courts, where the law requires it.
Some of these providers store or process data outside India, which the DPDP Act permits except for countries the Government restricts.
What you can ask us to do
- Access: a summary of the personal data we hold about you, what we do with it, and who we shared it with.
- Correction and completion: fix anything wrong or out of date.
- Erasure: delete your data. Records the law makes us keep (invoices) stay until that period ends; we'll tell you what we kept and why.
- Withdraw consent or object as easily as you gave it: cookies by blocking them in your browser; marketing email and cart reminders from the unsubscribe link in any email; anything else, including ad measurement, from the request form. Withdrawing doesn't undo what was done before, and order emails continue while an order is open.
- Nominate someone to use these rights for you if you die or become unable to.
- Grievance redressal: complain to us, and then to the Data Protection Board of India.
Use the data-rights request form, or email support@easewrap.in. We confirm it's you before acting, reply within 48 hours and complete the request within 30 days.
How we protect it
- Encrypted connections (HTTPS) everywhere on the site; the database and file storage are encrypted at rest by our providers.
- Database access is locked down table by table: a signed-in customer sees only their own orders, and everything else is read only by our server code and the store's admin login.
- If a breach affects your data, we will tell you and the Data Protection Board without delay, with what happened and what you can do.
Grievance officer
Ganesh Garuda, Grievance Officer, Phonemate India, 8-44-24, Old CBI Down, Chinna Waltair, Visakhapatnam - 530017.
Email support@easewrap.in · Phone 9848398543
We acknowledge every complaint within 48 hours and resolve it within 30 days. If you're not satisfied, you can complain to the Data Protection Board of India once you have used this route.
We may update this notice. If a change affects what we do with data you already gave us, we'll ask again where the law requires it.
Last updated: 26 October 2026