Privacy Policy

Account & contact details — your name, email address, phone number, and password (stored only as a one-way hash, never in plain text) when you register or check out.

Order & delivery details — shipping and billing addresses, the items you order, the configuration you choose (metal, gemstone, size, and any engraving text), and your order history.

Payment information — we never receive or store your card number, CVV, UPI PIN, or bank details. Payment is collected directly by our payment processor (Razorpay for India-based payments; Stripe, once activated, for other regions), and we retain only a processor-issued reference token and, if you choose to save a method for future use, its card brand, last four digits, and expiry date.

Wishlist and preferences — items you save to your wishlist and your marketing communication preference.

Technical information — your IP address and approximate location (used to default the currency displayed and your shipping country, and to help detect fraud), browser and device information, and the cookies described in Cookies & tracking technologies below.

Communications — anything you send us through the Contact page or customer support, including for an order enquiry or a return.

We do not currently use any third-party advertising or analytics tracker on this site. If that changes, we will update this policy and, where required, ask for your consent before any non-essential tracking runs.

To create and maintain your account, process and fulfil your order, and communicate with you about it — including contacting you before a made-to-order piece goes into production if we find a pricing or description error.

To provide the account features you use directly — order history, saved addresses, saved payment method references, and your wishlist.

To detect and prevent fraud, independently verify the amount charged rather than trusting anything submitted from your browser, and protect the security of the site.

To meet our legal, tax, and accounting obligations, and to respond to lawful requests from regulators or courts.

To send you marketing communications only if you've opted in — you can opt out at any time from your account preferences or the unsubscribe link in any such email.

Where the EU/UK GDPR applies to you, our legal basis is: performance of our contract with you (accounts, orders, fulfilment), our legitimate interests (fraud prevention, site security, and service improvement, balanced against your rights), a legal obligation (tax and accounting records), or your consent (marketing, and any future non-essential cookies).

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

We use a small number of cookies that are strictly necessary for the site to work — to keep you signed in, to remember a guest cart before you create an account, and to protect your session. These don't require consent under applicable law because the site can't function without them, and no other cookie, pixel, or tracking script is active on this site today.

Your selected display currency is remembered in your browser's local storage, not a cookie, and is used only to show prices in a currency you recognise — it doesn't identify you.

If we introduce analytics or marketing technologies in future, we'll update this section and, wherever consent is legally required (in particular for visitors in the EEA and UK), ask for it before anything non-essential runs.

We share personal information only with service providers who process it on our behalf, under contract, and only to the extent needed to provide the site and fulfil your order — never for their own marketing purposes, and never sold.

Payment processors — Razorpay, and Stripe once activated — to collect payment and process refunds.

The cloud infrastructure providers who host our database, session/cart storage, and product imagery on our behalf, under their own security and confidentiality commitments.

Shipping carriers, to deliver your order and provide tracking, once your order ships.

Our own staff, on a role-restricted, logged basis — Support staff can look up your order or account to help you; only Admin-role staff can edit account details or process a deletion request, and every such action is recorded in an internal audit log.

Professional advisers, and law enforcement or regulators where we are legally compelled to disclose information or need to establish, exercise, or defend a legal claim.

If Aurèna Jewels is ever acquired, merged, or its assets transferred, customer information may transfer as part of that transaction, subject to the same protections described here.

Aurèna Jewels is based in India, and some of the providers above may store or process your information outside your own country, including in the United States and other jurisdictions where they operate.

Where we transfer personal data out of the European Economic Area or the United Kingdom, we do so using a recognised legal safeguard, such as the European Commission's or UK's Standard Contractual Clauses, with the provider concerned.

Where we transfer personal data out of India, we do so consistently with the Digital Personal Data Protection Act, 2023, which permits transfers to any country except one the Central Government has specifically restricted — no such restriction currently applies to any provider we use.

Payment transaction data relating to Indian payment instruments is retained within India by our payment processor, consistent with the Reserve Bank of India's data-localisation requirements for payment system data.

We keep your account and order information for as long as your account is active, and for as long afterwards as needed to meet our legal and tax obligations — Indian law generally requires financial and accounting records to be kept for several years after the relevant transaction.

If you ask us to delete your account, we scrub the personal details we no longer need — your name, email, phone, saved addresses, and saved payment method references — while keeping the order and invoice records themselves, without your personal details attached, for as long as the law requires financial records to be kept. We never delete an order's financial record itself, only the personal details linking it to you.

All traffic to and from this site is encrypted in transit. Your password is never stored in plain text, and payment details never reach our servers in raw form — only a processor-issued token.

Access to customer data by our own staff is role-restricted and logged, so every access or change to your account by our team is individually accountable.

We rely on our infrastructure providers' own encryption-at-rest and physical security commitments for data stored on their platforms.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security — but if we become aware of a breach affecting your personal information, we will notify you and the relevant regulator as required by applicable law.

If you are a data principal under India’s DPDP Act, you have the right to: obtain a summary of the personal data we hold about you and how we process it; correct, complete, update, or erase data that’s inaccurate, incomplete, or no longer needed; nominate another individual to exercise these rights on your behalf if you’re ever unable to; and raise a grievance with us, which you can escalate to the Data Protection Board of India if we don’t resolve it to your satisfaction.

To exercise any of these, contact our Customer Care / Grievance Officer at support@theaurenajewels.com. We don't charge a fee for a genuine request.

If you are in the EEA or UK, you have the right to: access the personal data we hold about you; have inaccurate data corrected; request erasure or restriction of processing; object to processing based on our legitimate interests, including direct marketing; receive a copy of the data you provided us in a portable format; and withdraw consent at any time where we rely on it, without affecting anything done before you withdrew it.

We respond to a valid request within one month, extendable by a further two months for a complex or repeated request, as the GDPR permits.

You also have the right to lodge a complaint with your local data protection supervisory authority at any time. As we grow our presence in the EU and UK, we intend to appoint a representative in each under Article 27 of the GDPR/UK GDPR; until then, please direct any EU/UK-specific enquiry to the contact details below and we will respond directly.

Wherever you're located, you can ask us at any time what personal information we hold about you, ask us to correct it, or ask us to delete your account — we'll honour a genuine request to the fullest extent required by the law that applies to you, even where this policy doesn't name your specific jurisdiction.

If you are a California resident: we do not sell or share your personal information as those terms are defined under California law.

We don't use automated decision-making or profiling that produces a legal or similarly significant effect on you. Fraud checks and price/inventory verification happen automatically, but a genuine order is never declined on that basis alone without the ability to contact us.

If you have a complaint about how we've handled your personal information or an order, contact us first at the details below. Consistent with India's Consumer Protection (E-Commerce) Rules, 2020, we aim to acknowledge your complaint within 48 hours and resolve it within one month.

If you're not satisfied with our response and you're protected under India's DPDP Act, you may escalate to the Data Protection Board of India. If you're in the EEA or UK, you may lodge a complaint with your local supervisory authority at any time, whether or not you've raised it with us first.

This site is not directed at children, and we do not knowingly collect personal information from anyone under 18 (or the age of digital consent that applies in your jurisdiction, if different) without verifiable parental or guardian consent. If we learn we've collected a child's personal information without the required consent, we'll delete it.

We'll post any change to this policy on this page and update the date above. Where a change is material, we'll take reasonable steps to bring it to your attention — for example by email or a notice on the site — before it takes effect. Continuing to use the site afterwards means you accept the updated policy.

Questions about this policy, or a request to exercise any of the rights above, can be sent to support@theaurenajewels.com or through our Contact page.