Privacy policy
Last updated 22 October 2026
This explains what we collect when you shop at ITLU Studios, why we need it, and how you stay in control of it. We collect as little as we can and we never sell it.
Who we are
ITLU Studios is a sole proprietorship owned by the owner, based in Hyderabad, Telangana, India. For your personal data we are the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 (DPDP Act). Address: Hyderabad, Telangana, India.
What we collect
| What | Why we need it |
|---|---|
| Mobile number | To sign you in with a one-time code, and to tell you about your orders. |
| Name and, if you add one, email | For your orders, invoices and replies to you. |
| Delivery addresses | To deliver your orders. Saved only if you save them. |
| Orders and payments | What you bought, the amount and whether it was paid. Card, UPI and bank details go straight to our payment gateway; we never see or store them. |
| Saved pieces and alerts | Your wishlist, and delivery alerts if you allow notifications. |
| Messages to us | What you send us by email or WhatsApp, including unboxing videos for a damage claim. |
| Technical data | Your IP address and browser, kept briefly in server logs to keep the shop secure and stop abuse. |
We do not collect sensitive data such as health or financial account details, and we do not knowingly collect data about anyone under 18.
Why we are allowed to use it
- Your consent, given when you sign in, for your account and for anything optional such as offers on WhatsApp. You can withdraw it at any time.
- To fulfil an order you placed: delivery, payment, invoice and after-sales help.
- Because the law requires it: keeping invoices and tax records, and answering lawful requests from authorities.
Marketing messages are only sent if you tick the box for them. Every message lets you stop, and you can switch them off in your account.
Who we share it with
Only the companies we need to run the shop, and only what each one needs. They act on our instructions and may not use it for anything else.
- our payment gateway, to take payments and make refunds.
- our courier partners, your name, phone and address to deliver your parcel.
- our SMS and WhatsApp provider, your number to send the sign-in code and order updates.
- Hosting and storage (Cloudflare and Railway), which run our servers and database. Some of these servers may be outside India; transfers follow the DPDP Act.
- Government authorities, only when the law requires it.
We never sell or rent your personal data.
Cookies and storage
We use one cookie to keep you signed in, and your browser's storage to remember your bag and small preferences. These are needed for the shop to work. If we add analytics (Google Analytics or the Meta pixel), they load only after you choose "Allow measuring", and you can change your choice from cookie settings.
How long we keep it
- Your account, addresses and wishlist: until you delete your account.
- Orders and invoices: for eight years, as GST and income-tax law require. After you delete your account they are kept unlinked from it.
- Sign-in codes: they expire within minutes and work only once.
- Messages and claim videos: for as long as the claim needs, then up to one year.
Your rights
Under the DPDP Act you can:
- See your data: download everything we hold from your account (Profile, "Download my data").
- Correct it: edit your name, email and addresses in your account, or ask us.
- Erase it: delete your account from your Profile. It takes effect at once, apart from the order records the law makes us keep.
- Withdraw consent for marketing at any time, as easily as you gave it.
- Nominate someone to act for you if you die or become unable to.
- Complain: to our Grievance Officer first, and, if you are not satisfied, to the Data Protection Board of India.
How we keep it safe
- Everything travels over encrypted HTTPS; there are no passwords for customers to leak.
- Sign-in codes are limited in how often they can be asked for and tried.
- Only the owner and named staff can open the admin, each with their own login.
- Payment details never reach our servers.
If a breach ever affects your data, we will tell you and the Data Protection Board without delay, explain what happened and what you can do, as the DPDP Rules require.
Changes
If we change this policy in a way that matters, we will ask you to accept it again the next time you sign in. The date at the top shows the latest version.
Contact
Questions about your data: write to care@itlu.local. See the Grievance page for timelines.