Privacy Policy
Last updated: October 30, 2026
This Privacy Policy describes how Celestia Enterprise ("we", "us", or "our") collects, uses, stores, and protects your personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
1. Data We Collect
We collect only the personal data necessary to provide our e-commerce services:
- Name — for order identification and shipping
- Mobile number — for account creation, order updates, and delivery coordination
- Email address — for order confirmations, invoices, and account communication
- Shipping & billing addresses — for delivery and GST-compliant invoicing
- GSTIN (optional) — for B2B customers requiring GST invoices
- Payment transaction data — processed through Razorpay; we do not store full card numbers or UPI PINs
2. Purpose of Data Collection
Your data is used solely for:
- Processing and fulfilling your orders
- Generating GST-compliant invoices as required by law
- Communicating order status, shipping updates, and service announcements
- Providing customer support and handling returns/refunds
- Complying with legal obligations under Indian law
3. Data Retention
We retain your personal data for as long as your account is active or as needed to provide our services. Specific retention periods:
- Financial records (invoices, payment logs, ledger entries): Retained for 8 years from the end of the relevant financial year, as mandated by the GST Act and Income Tax Act for MSMEs.
- Order history: Retained for the life of your account plus 90 days after account deletion, to handle post-deletion disputes.
- Personal data (name, mobile, email, addresses): Deleted or anonymized within 30 days of receiving a verified account deletion request, except where retention is required by law.
4. Data Sharing
We do not sell, rent, or trade your personal data. We share data only with:
- Razorpay (payment processor) — for processing payments
- Shipping/courier partners — name, mobile, and address for delivery
- Government authorities — when required by law or court order
5. Your Rights (DPDP Act 2023)
As a data principal under the DPDP Act, you have the right to:
- Access your personal data
- Correct inaccurate or incomplete data
- Erasure of your personal data (see our Account Deletion page)
- Grievance redressal — contact our Grievance Officer below
- Nominate an individual to exercise your rights in the event of death or incapacity
6. Security
We implement reasonable security practices including encryption in transit (TLS), hashed passwords, and access controls. Payment data is handled by Razorpay (PCI-DSS Level 1 compliant).
Grievance Redressal
In compliance with the Consumer Protection (E-Commerce) Rules, 2020, any consumer complaint may be directed to our Grievance Officer:
Acknowledgment: Within 48 hours | Resolution: Within 1 month
7. Changes to This Policy
We will notify you of material changes via email or a prominent notice on our platform. Continued use after changes constitutes acceptance.