This notice explains, in plain language, what personal data we collect when you use 3deality.in, what we use it for, who else handles it, how long we keep it, and how you can see, correct or delete it. It is written for the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. If anything here is unclear, ask us at [email protected].

We do not sell your data, and we don't use it for advertising profiles or cross-site tracking.

1. Who we are

"3Deality" is the brand name of Shiv Shakti Properties, the registered business in India that runs this website. We decide why and how your personal data is used, which makes us the "Data Fiduciary" under the DPDP Act. For anything about your data, write to our grievance officer (section 7).

2. What we collect, and why

The basis for each use is one of two things the law allows: your consent, which you can withdraw at any time (section 6), or a legitimate use, meaning you gave us the data yourself for that purpose (for example, an address so we can deliver your order) or a law requires us to keep it.

Your account

What we collect: Your email address and, if you add them, your name, phone, billing address and GST number. If you sign up with a password we store only a secure hash of it. If you sign in with Google we receive your name, email and profile picture from Google, never your Google password. Optional: your date of birth (used only for the birthday-week reward) and a display name for reviews. Your wallet balance, cashback and referral history.
Why: To let you sign in, see your orders, check out faster and receive your rewards.
Basis: Your consent, given when you create the account. Deleting the account withdraws it.
Who else handles it: Google (only if you use Sign in with Google), Resend (verification and account emails), Hostinger (our servers).
How long we keep it: While your account is open. After it is deleted, only the order and invoice records below remain.

Checkout and delivery

What we collect: Email, name, phone, billing and shipping address, GST number (optional), what you ordered, and any order note or gift message. When you type your address, Google Maps may suggest completions, so the text you type goes to Google. When you enter a pincode, your browser looks up its city and state on api.postalpincode.in, a free public pincode directory, which receives that pincode and your IP address.
Why: To make, pack, ship and invoice your order, and to email you about it (confirmation, dispatch, delivery, refunds).
Basis: Legitimate use: you give us these details to buy from us, and GST law requires an invoice.
Who else handles it: Couriers and shipping aggregators (BlueDart, Delhivery, and Shipmozo and the couriers it books for us, such as Xpressbees) receive your name, address, phone and parcel weight. Resend sends the order emails. Our chartered accountant sees invoices to file our GST returns, and those returns carry invoice details to the tax authorities as the law requires (for a business customer, its GST number).
How long we keep it: Order and invoice records: 8 years, as Indian tax law (GST) requires, even if you delete your account.

Payments

What we collect: To open the payment page we give HDFC SmartGateway your order amount, name, email and phone. From HDFC we receive whether the payment went through, a transaction reference and the payment type (UPI, card or NetBanking). We never see your card number, CVV, UPI PIN or banking password: you enter those on HDFC's page, not ours.
Why: To take payment, check that it really went through, and send refunds.
Basis: Legitimate use: paying for the order you placed.
Who else handles it: HDFC Bank (SmartGateway).
How long we keep it: With the order records: 8 years.

Uploaded 3D files and personalised designs

What we collect: 3D model files you upload for a custom print quote, and the text, font and colours you choose for a design-your-own product.
Why: To quote, prepare and print your part. We never share, resell or reuse your designs.
Basis: Legitimate use: you upload them to get a quote or an order.
Who else handles it: Cloudflare R2 file storage, at an unlisted address that only we and you hold. Files are processed on our own servers.
How long we keep it: Deleted automatically: within 24 hours if never added to a cart, otherwise 30 days after upload (whether or not you order). If you copy a share link for a design, a preview picture of it is kept for 6 months so the link keeps working, and anyone with that link can see it.

Photos for a lithophane lamp

What we collect: The photos you upload. Your browser resizes and re-saves them before they reach us, which removes location and camera details.
Why: To make your lamp, and to reprint it if something goes wrong. Never shared.
Basis: Legitimate use: you give them to us to make your lamp.
Who else handles it: Cloudflare R2 file storage, at an unlisted address that only we and you hold.
How long we keep it: 90 days after your order, in case the lamp needs a reprint, then deleted automatically. Photos that never become part of an order are deleted within 30 days.

Reviews and questions

What we collect: For a review: your rating, text, photos and the name shown with it (your display name, or your first name and last initial). Your email stays private and is used only to confirm you bought the item. For a question: the name you give, your question and, if you add it, an email so we can reach you.
Why: To help other shoppers decide.
Basis: Your consent: you choose to post. Ask us and we remove it.
Who else handles it: Published on our product pages. Reviews can also appear in Google Search through our product review feed.
How long we keep it: Until you ask us to remove it, or we take it down.

Newsletter and reminder emails

What we collect: Your email address, when and where you subscribed, and when you confirmed. Subscribing takes two steps: you enter your email, then click the link we send. Nothing is sent until you click.
Why: The newsletter: new designs, member perks and occasional offers. We may also email reminders about your own cart or wishlist, your birthday-week reward, or a review of an order we delivered.
Basis: Newsletter: your consent. Reminders: the email address you gave us for your order or account. Every one of these emails has an unsubscribe link, and one click stops them all.
Who else handles it: Resend (sends the emails).
How long we keep it: Until you unsubscribe. After that we keep only a note that you opted out, so we never email you marketing again. Order and account emails still reach you.

WhatsApp order updates

What we collect: The phone number you gave at checkout, and the messages about your order. If you message us on WhatsApp, that conversation.
Why: When WhatsApp updates are switched on for our store, to send order confirmed, shipped and delivered messages. To answer you when you write to us.
Basis: Legitimate use: updates about the order you placed, and chats you start. Tell us and we stop the updates; order emails continue.
Who else handles it: Meta (WhatsApp Business Platform).
How long we keep it: Support conversations: usually 2 years.

Contact form and support

What we collect: Your name, email, phone (optional) and message, and any email or WhatsApp message you send us.
Why: To answer you.
Basis: Legitimate use: you wrote to us for a reply.
Who else handles it: Resend delivers contact form messages to our inbox. Hostinger hosts our mailbox.
How long we keep it: Usually 2 years, for reference.

Site security and statistics

What we collect: Your IP address, browser and device type, and the pages you request (server logs). On the sign-in page, Google reCAPTCHA checks you are a person, and Google receives device and browsing signals for that check. Cloudflare Web Analytics counts page views and loading speed without cookies and without building a profile of you; we only see totals.
Why: To keep the site running, stop bots and abuse, and find slow pages.
Basis: Legitimate use: part of serving the pages you ask for and keeping them safe.
Who else handles it: Cloudflare (network, security and statistics), Google (reCAPTCHA), Hostinger (our servers).
How long we keep it: Server logs: up to 30 days on the server, plus the backups described below.

Backups. So we can recover from a failure, we keep encrypted copies of our databases and server logs in private storage: daily copies for 30 days, monthly copies for 3 years, and one copy a year, which we currently keep with no set end date. Data deleted from the live site can remain in these copies until they expire. We only restore from them to recover from a failure.

3. Who handles your data for us

These providers process personal data on our behalf, each only for the job described in section 2. Some of them store or process data outside India.

Hostinger: the servers that run this website, and our business mailbox.
Cloudflare: network, security and bot protection (sees your IP address on every request), R2 file storage for uploads and backups, and Web Analytics.
Resend: sends our emails.
Google: Sign in with Google, reCAPTCHA, Maps (address suggestions and the reviews on our homepage), website fonts (your browser downloads them from Google, which sees your IP address), and Google Customer Reviews if you opt in after an order (Google then receives your email, order number, country and expected delivery date to send you a short survey).
HDFC Bank: SmartGateway payments.
BlueDart, Delhivery and Shipmozo (and the couriers Shipmozo books for us): delivery.
Meta: WhatsApp messages.
postalpincode.in: the public pincode directory your browser asks for the city and state when you type a pincode at checkout (it sees the pincode and your IP address).

4. Cookies and browser storage

We use no advertising or tracking cookies, so there is no cookie banner. What we store in your browser is first-party and keeps the site working:

Sign-in cookie (connect.sid): set when you sign in so the site remembers you. JavaScript cannot read it, and signing out clears it.
Cloudflare and reCAPTCHA cookies (such as __cf_bm): bot protection. The reCAPTCHA cookie is set only on the sign-in page.
cart_id: your cart, so items aren't lost between visits.
3d_checkout_address_v1: the contact details and address you typed at checkout, kept on this device only so you don't retype them. Removed after 90 days, when you sign out, or when you use "Not you? Clear saved details" at checkout.
3d_preferred_payment_method: the payment method you picked (UPI, card or NetBanking), so a retried payment opens on the same option. It lasts until you close the tab, and "Not you? Clear saved details" removes it too.
3d-ship-pincode, recently_viewed_products and 3d-recent-searches: the last pincode you checked for delivery, products you viewed and your recent searches, on this device only.
pending_referral_code and pending_affiliate_code: a referral or partner code from a link you followed, for up to 30 days.
Kept only until you close the tab: 3d_order_confirmation:<order id>, a pass that lets the tab you paid in show your new order without signing in (it stops working after 24 hours); 3d_offer_prefill_v1, the name, email and phone on an order link we sent you, used once to fill in the checkout form and then removed; 3d_post_signin_redirect, the page to bring you back to after you sign in; and maintenance_return_to, the page to return you to after a maintenance break.
Small preference flags such as theme (light or dark mode), wa_dismissed_until (you hid the WhatsApp button) and chunk-reload-at (stops the page reloading in a loop after we update the site).

You can clear all of these from your browser settings. The site still works; you will just lose your cart and need to sign in again.

5. Your rights

Under the DPDP Act you can:

Get a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
Correct, complete or update it. Most of it you can edit yourself in your account.
Have it erased once it is no longer needed for the purpose you gave it for, unless a law requires us to keep it. Order and invoice records are kept for 8 years under GST law.
Complain to us and have the complaint dealt with (section 7).
Nominate someone to use these rights for you if you die or become unable to act. Email us their name and contact details.

How to ask: if you have an account, use Request a copy of my data or Delete my account on your account page. Otherwise, email [email protected] from the address you used with us, so we know the request is yours. We respond within 90 days.

6. Withdrawing consent

Withdrawing consent is as easy as giving it:

Newsletter and reminder emails: one click on the unsubscribe link in any of them.
Your account: Delete my account on your account page.
A review or question you posted: email us and we remove it.
Anything else: email [email protected].

We then stop using your data for that purpose, unless a law requires us to keep it. Withdrawing does not undo what was done before, and without an account we can't offer account-only features such as rewards.

7. Grievance officer and complaints

Our grievance officer handles privacy questions, data requests and complaints about the site or your orders:

Soumil Arora
Email: [email protected]
WhatsApp

We respond to privacy complaints and data requests within 90 days. Complaints about an order are acknowledged within 48 hours and resolved within one month, as the Consumer Protection (E-Commerce) Rules, 2020 require.

If you are not satisfied with our answer, you can complain to the Data Protection Board of India under the DPDP Act. The law asks you to raise the complaint with us first.

8. Children

Our store is for adults. You must be 18 or older to create an account or place an order, and we don't accept anyone under 18: a date of birth showing an account holder is under 18 is refused. If you believe a child has given us personal data, write to us and we will delete it.

9. Security and data breaches

All traffic to the site is over HTTPS. Payments happen on HDFC's PCI DSS certified page, so we never hold card numbers. Passwords are stored only as hashes, our backups are encrypted, and access to our systems is limited to the few people who need it. No system is perfectly secure, but we take reasonable precautions.

If a personal data breach affects you, we will tell you without delay: what happened, what it may mean for you, what we are doing about it and what you can do to protect yourself. We will also report it to the Data Protection Board of India, as the DPDP Rules require.

10. Changes to this notice

When we change this notice in a meaningful way (a new provider, a new use of your data, a different retention period) we update the date at the top and note what changed.

Privacy Policy