privacypolicy.

01Who we are

AFTRS Wellness is a brand of Aftrswellness Pvt. Ltd., a company incorporated in India. We are the "data fiduciary" for the personal data described in this policy, which means we decide why and how it is processed.

02What this policy covers

This policy applies to personal data we collect through:

• the AFTRS Wellness website and any sub-pages, including the launch waitlist and ritual-builder quiz;
• our online store, once ordering opens;
• email, phone, WhatsApp and social-media conversations you have with us;
• customer-support requests, reviews and surveys.

It does not cover third-party websites or services that we link to, such as Instagram or a payment gateway's own checkout page. Those services have their own privacy policies.

This policy is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023.

03Data we collect

Data you give us

Data collected automatically

• Device and connection data: IP address, browser type, operating system, screen size, language, referring page.
• Usage data: pages viewed, time on page, links clicked, approximate location derived from IP (city level).
• Cookies and similar identifiers as described in section 06.

Data from other sources

• Delivery status and proof of delivery from our logistics partners.
• Payment confirmation and fraud signals from our payment gateway.
• Public profile information if you message us on Instagram or another social platform.

04How we use your data

• To run the waitlist: to tell you when we launch, send early-access links and founding-batch pricing.
• To fulfil orders: to process payment, pack and ship your order, send tracking updates and invoices, and handle returns or replacements.
• To support you: to answer questions, resolve complaints and keep a record of our conversation.
• To improve the product and site: to understand which flavours and rituals people want, fix bugs, and make the site faster.
• To send marketing you have agreed to: new sachets, subscriber-only bundles and occasional letters. You can opt out at any time (section 11).
• To keep things safe: to detect fraud, abuse or security incidents.
• To meet legal duties: tax and accounting records, consumer-protection obligations, responses to lawful requests from authorities.

We do not sell your personal data. We do not use it for automated decisions that have legal or similarly significant effects on you.

05Consent and legal basis

Under the Digital Personal Data Protection Act, 2023, we process your personal data on the basis of:

• Your consent, which you give when you submit the waitlist form, tick a marketing box or take the quiz. You can withdraw consent at any time; withdrawal does not affect processing that already happened.
• Legitimate uses permitted by law, such as processing data you voluntarily provide to complete a purchase you have asked for, and complying with legal obligations.

Where we ask for consent, we will tell you what we are collecting and why, in plain language, before you submit.

06Cookies and analytics

Cookies are small text files stored on your device. We use them as follows:

You can block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the site, such as checkout, from working. Where the law requires it, we will show a cookie banner and non-essential cookies will stay off until you accept them.

07Who we share data with

We share personal data only with the people and companies we need to run AFTRS, and only the data they need:

• Payment gateways (RBI-regulated) to process your payment and prevent fraud.
• Logistics and courier partners to deliver your order. They receive your name, address, phone number and order reference.
• Email and SMS providers to send order updates and, with your consent, marketing.
• Website hosting, analytics and customer-support tools that store or process data on our behalf.
• Professional advisers such as accountants, auditors and lawyers, under confidentiality.
• Authorities and courts where the law requires it or to protect our rights, our customers or the public.
• A buyer or successor if AFTRS is sold, merged or restructured. We will tell you before your data becomes subject to a different privacy policy.

Every service provider is bound by a written contract to process data only on our instructions and to protect it. We do not allow them to use your data for their own marketing.

08How long we keep data

When data is no longer needed we delete it or anonymise it so it can no longer identify you.

09Security

We use reasonable security practices and procedures appropriate to the sensitivity of the data, including:

• HTTPS encryption for all traffic between your browser and our site;
• encryption of stored personal data by our hosting and database providers;
• access to customer data limited to staff who need it, protected by strong passwords and two-factor authentication;
• no storage of full payment-card data on our systems;
• regular review of the third-party tools we use.

No system is perfectly secure. If we become aware of a personal-data breach that is likely to affect you, we will notify you and the Data Protection Board of India as required by law.

10Your rights

You have the right to:

• Access a summary of the personal data we hold about you and how we have used it.
• Correct data that is inaccurate or incomplete, and update it.
• Erase your data, unless we must keep it to meet a legal obligation (for example, invoices).
• Withdraw consent at any time, as easily as you gave it.
• Nominate another person to exercise these rights on your behalf if you are unable to.
• Raise a grievance with our grievance officer (section 16) and, if you are not satisfied with our response, with the Data Protection Board of India.

To exercise a right, email Aftrswellness@gmail.com from the address we hold for you, or write to the postal address above. We may ask you to verify your identity. We will respond within 30 days, or sooner where the law requires.

11Marketing messages

We send marketing emails, and in some cases SMS or WhatsApp messages, only if you have joined the waitlist or ticked a marketing box at checkout. Every email includes a one-click unsubscribe link. To stop SMS or WhatsApp messages, reply STOP or write to us. Unsubscribing from marketing does not stop transactional messages such as order confirmations and delivery updates.

12Children

Our products and website are intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

13Third-party links

Our site links to third-party services such as Instagram, YouTube and payment gateways. We do not control those services and are not responsible for their privacy practices. Read their policies before sharing data with them.

14Where data is stored

We aim to store personal data on servers located in India. Some of our service providers (for example, email or analytics tools) may process data on servers outside India. Where that happens, we ensure the transfer is permitted under Indian law and that the provider is contractually bound to protect your data to a standard at least as high as this policy.

15Changes to this policy

We may update this policy as our products, tools or the law change. The "Last updated" date at the top will change accordingly. If a change materially affects how we use your data, we will tell you by email or a notice on the site before it takes effect. Continued use of the site after that date means you accept the updated policy.

16Grievance officer and contact

In accordance with the Information Technology Act, 2000 and the rules made under it, and the Digital Personal Data Protection Act, 2023, the contact details of our Grievance Officer are:

We acknowledge grievances within 48 hours and aim to resolve them within 30 days of receipt.