Privacy policy

Last updated 2026-11-07

This policy explains what personal data Mystiq collects, why, who it is shared with, how long it is kept, and how to have it removed. It follows the Digital Personal Data Protection Act, 2023. By placing an order or creating an account, you consent to this use of your data. You can withdraw consent at any time, as described below.

What we collect, and why

To make and deliver your order: your name, delivery address, phone number, email, and the pieces you bought.
To issue your GST invoice: your billing address and state, which sets the place of supply.
If you sign in: your email. If you use Google, we receive the account identifier Google returns, plus any mobile number you add. We never see or store a password.
Payment: handled by Razorpay. We keep the payment reference and status, never your card or bank details.
When you write to us: your message, and any photos or unboxing videos you send for a return.

Who we share it with

Only with the partners needed to complete your order, and only what each needs:

our production and courier partners, who receive your name, delivery address and phone number to make, pack and deliver your order;
Razorpay, to take payments and refunds;
our email provider, to send order and account emails;
Cloudflare, which hosts this website and its data in secure data centres;
Meta (Facebook and Instagram), only if you allow ad cookies: see Ads below;
government authorities, when the law requires it.

We do not sell your data.

Cookies and storage

We use only what the site needs to work: a cookie that keeps you signed in, your bag saved in your browser, and a security check at checkout that blocks bots. Site analytics are aggregate and do not use cookies. Ad cookies are separate and off unless you allow them.

Ads on Facebook and Instagram

We advertise on Facebook and Instagram. A notice on the site asks whether you allow ad cookies. Only if you tap Allow, the Meta Pixel tells Meta which pages and pieces you view, what you add to your bag, when you start checkout, and when you buy. This shows us which ads work, and lets Meta show our pieces to people likely to like them.

When you buy with ad cookies allowed, we also send Meta that purchase from our server: the order number, the pieces and the amount, plus your email and phone number scrambled with a one-way code (SHA-256) so Meta can match it without reading them. Your address and payment details are never sent.

To change your answer, clear this site's cookies in your browser and the notice will ask again. You can also manage ads in your Facebook or Instagram ad settings.

How long we keep it

Name, street address and phone number are removed from an order six months after it closes. The city, state and PIN code stay so the invoice remains valid.
Payment notification records are cleared after 90 days.
Unboxing videos and photos are kept only until the return is closed, and deleted within 90 days after that.
Invoices and credit notes are kept for the period tax law requires.

How we protect it

All traffic is encrypted. Order pages open only through a private link or your signed-in account. Access to order data is limited to the people who need it to serve you.

Your rights

You can ask to see, correct or erase your personal data, or withdraw consent. Erasure removes your name, address, phone and account. We keep the financial records the law requires. Use the contact form or write to info@mystiq.co.in.

Children

This site is not meant for anyone under 18. We do not knowingly collect children's data without a parent's or guardian's consent.

Grievance officer

Jagadeesh L, Operation Head
Mystiq, No: 601, Block 1, 6th Floor, SMR Vinay Estate, Horamavu Ring Road Junction, Horamavu, Bengaluru, Bengaluru Urban 560043, Karnataka
info@mystiq.co.in

We acknowledge every complaint within 48 hours and resolve it within one month. If you are not satisfied, you may approach the Data Protection Board of India.

Changes to this policy

If we change this policy, we update the date at the top of this page.