Legal
Privacy Policy
Last updated: 15 October 2026
1. Who we are
We value your privacy and are committed to protecting your personal information. This Privacy Policy explains what we collect when you visit thethirastudio.com (the “Site”), create an account, shop with us online or in our store, or message us. It also explains how we use, share and protect that information, and the choices you have.
The Site is run by KLEEM-AURA LIFESTYLE (a partnership firm), trading as The Thira Studio (“we”, “us”, “our”), 4 Auro Villa Duplex, near Siddheshwar Haven, opp. C M Patel Farm, Kalali Road, near Gram Panchayat Office, Kalali, Vadodara, Gujarat 390012. We decide why and how your personal data is processed. Under the Digital Personal Data Protection Act, 2023, that makes us the “Data Fiduciary”.
We handle personal data in line with the Information Technology Act, 2000 and its rules, and the Digital Personal Data Protection Act, 2023 as it comes into force. This policy forms part of our Terms of Service.
2. What we collect
We collect only what we need to run the store. Most of it you give us directly. The rest comes from how you use the Site, or from partners who help us deliver your order.
| What | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email, mobile number, password (stored only as a secure hash), Google sign-in ID | You, or Google if you sign in with Google |
| Profile (optional) | Date of birth, gender, profile photo | You |
| Delivery details | Addresses, recipient name and phone, pincode | You |
| Orders and payments | Items, amounts, payment method and status, invoices, returns, the payment reference from Razorpay | You and Razorpay. We never receive your full card number, CVV or UPI PIN. |
| Refund details for COD returns | UPI ID or bank account name, number and IFSC | You, when you request a refund |
| Rewards and referrals | Points, store credit, referral code and who used it | Created as you shop |
| Affiliate partners only | PAN, payout UPI or bank details | You, when you join the affiliate programme |
| In-store purchases | Mobile number and what you bought, if you ask us to link the sale to your account | Our store staff, with your permission |
| Messages | Emails, contact-form messages, WhatsApp replies, reviews and photos you send us | You |
| Wishlist and bag | Items you save or add | You |
| Browsing activity (only with your consent) | Products viewed, searches, items added to bag or wishlist, checkout started | The Site (see section 4) |
| Technical data | IP address, browser and device type, login times | Your device, automatically, for security |
| Delivery updates | Tracking status, delivery attempts | Our courier partners |
3. How we use it
We use your information only for the purposes below. Some uses are needed to give you what you asked for, such as an order, an account or a reply. Others happen only if you agree, and you can withdraw that consent at any time.
| Purpose | What it involves | Basis |
|---|---|---|
| Your account | Signing you in (password, Google or a one-time code), keeping your details, addresses and wishlist | You asked for an account |
| Orders and delivery | Taking payment, packing, shipping, tracking, Cash on Delivery, invoices | Needed to fulfil your order |
| Returns and refunds | Arranging pickups and exchanges, paying refunds | Needed to fulfil your order |
| Customer support | Answering your emails, calls, WhatsApp messages and contact-form requests | You contacted us |
| Rewards and referrals | Points, store credit, birthday points if you gave your birthday, referral rewards | You use the programme |
| Reviews | Showing your review with your first name, marking it as a verified purchase | You chose to post it |
| Service messages | Login codes, order, shipping and refund updates | Needed for your account and orders |
| Marketing | New arrivals, offers, back-in-stock and points-expiry reminders, “we miss you” offers | Only with your consent (section 5) |
| Personalisation | Recently viewed items, reminders about products you looked at, grouping customers by shopping patterns to choose relevant offers | Only with your consent (section 4) |
| Analytics | Understanding which pages and products work, to improve the Site | Only with your consent (section 4) |
| Security and fraud prevention | Limiting login attempts, spotting fake orders or misuse of offers, keeping audit logs | Needed to protect you and us |
| Legal and tax | GST invoices and accounting records, responding to lawful requests from authorities | Required by law |
We do not sell or rent your personal information to anyone. We do not use it to make automated decisions that have legal or similarly significant effects on you.
4. Browsing activity, cookies and analytics
When you first visit, a banner asks whether you accept optional tracking. Nothing optional is recorded unless you click Accept. If you decline, the shop works exactly the same.
If you accept, we do two things:
- We keep our own record of what you browse here: products you view, what you search for, items you add to your bag or wishlist, and when you start checkout. We use it to show you recently viewed items, to remind you about pieces you looked at, and to choose offers that suit you. We delete each entry after 180 days.
- We use Google Analytics (through Google Firebase) to understand, in aggregate, how people use the Site. Google sets its own cookies for this, and processes the data under Google’s privacy policy.
You can change your mind at any time in your account. If you withdraw consent while signed in, we stop recording on every device and delete the activity we already hold. We never record browsing activity for anyone we know is under 18.
Cookies we always use. A few cookies are strictly necessary for the Site to work, and they do not need consent:
| Cookie | What it does | How long it lasts |
|---|---|---|
| access_token, refresh_token | Keep you signed in securely | 15 minutes; 30 days |
| csrf_token | Protects forms from forgery attacks | 12 hours |
| thira_anon | Keeps your shopping bag before you sign in | 60 days |
| g_oauth_state | Protects Google sign-in | 10 minutes |
We also store a few small preferences in your browser: your cookie choice, your delivery pincode, and whether you are mid-login. You can clear cookies in your browser settings. If you block the necessary cookies, you will not be able to sign in or check out.
5. Messages and your consent
Service messages are sent because they are part of your account or order. They include login codes, order confirmations, payment, shipping and delivery updates, and return and refund updates. They come by email, and by WhatsApp if you have turned on WhatsApp order updates. Login codes for mobile sign-in come by WhatsApp.
Marketing messages are sent only if you have said yes:
- Email: only if you subscribe to our newsletter.
- WhatsApp: there are two separate switches, one for order updates and one for offers and reminders. Both are off until you turn them on, at checkout or in your account.
Bag reminders. If you leave items in your bag while signed in, we may send you one email reminder. Every reminder email includes a “Stop bag reminders” link, and once you use it we will not email you bag reminders again. Bag reminders on WhatsApp are sent only if you have turned on WhatsApp offers and reminders.
To stop marketing at any time:
- use the unsubscribe link in any marketing email;
- reply STOP to any WhatsApp message to turn off both WhatsApp switches, or tap “Stop promotions” to turn off offers only;
- change the switches in your account, or write to us.
Withdrawing consent is as easy as giving it. It does not affect messages already sent, or service messages about orders you have placed.
6. Who we share it with
We share personal data only with partners who help us run the store, and only what each needs for its job. They process it on our behalf and under contract.
| Partner | Why | What they receive |
|---|---|---|
| Razorpay | Processes online payments and refunds | Order amount, your name, email and mobile number. You enter your card or UPI details directly with Razorpay. |
| Shiprocket and its courier partners | Deliver your order and collect returns | Name, delivery address, mobile number, order contents and value, COD amount |
| Sign-in with Google, email delivery (Google Workspace), and Google Analytics if you consent | Your Google account ID and email; the emails we send you; analytics data (section 4) | |
| Meta (WhatsApp Business) | Sends login codes and the WhatsApp messages you have opted in to | Your mobile number and the message content |
| Cloud hosting and storage | Hosts the Site, our database and images | All the data in this policy, stored securely on our behalf |
| Our chartered accountant and auditors | GST filings and accounts | Invoices and transaction records |
We may also disclose information:
- when the law requires it, or a court or government authority lawfully asks for it;
- to protect our rights, our customers or the public, for example to prevent fraud;
- to a buyer or successor if our business is sold or restructured. They would remain bound by this policy.
Some of our products link to our listings on Amazon. If you buy there, Amazon handles your order and your data under its own privacy policy.
7. How long we keep it
We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires.
| Data | How long |
|---|---|
| Account, profile, addresses, wishlist, bag | Until you delete your account |
| Browsing activity | 180 days, or until you withdraw consent or delete your account |
| Login codes and sign-in sessions | Codes expire within minutes; sessions last up to 30 days |
| Orders, GST invoices, credit notes, payment and rewards records | At least 8 years, as GST and accounting law requires |
| COD refund bank or UPI details | Until the refund is settled, and never after you delete your account |
| Newsletter subscription | Until you unsubscribe |
| Support messages and WhatsApp conversations | As long as needed to resolve your request, and never after you delete your account |
| Security logs (IP address, device, login times) | As long as needed for security |
When you delete your account, we erase your profile, addresses, login details, wishlist, bag, browsing activity, newsletter and contact records, and refund payout details. Your reviews stay on the Site as “Anonymous”. Orders, invoices and credit notes must be kept for tax law, so we keep them with your name, email, phone and address removed or replaced. You cannot delete your account while an order or return is still in progress.
8. How we protect it
We use reasonable security practices to protect your information from unauthorised access, loss, misuse or disclosure. These include:
- encryption in transit (HTTPS) on every page and connection;
- passwords stored only as one-way hashes, and login codes stored hashed and valid for a few minutes;
- secure, HTTP-only sign-in cookies, protection against cross-site request forgery, and limits on repeated login attempts;
- staff access limited by role, with an audit log of changes made in our admin panel;
- payment card and UPI details handled entirely by Razorpay, which is PCI-DSS compliant, and never stored by us.
No website or electronic storage is completely secure, so we cannot guarantee absolute security. If a personal data breach affects you, we will tell you and the authorities as the law requires, along with what we are doing about it. Please keep your password and login codes private.
9. Children and under-18s
The Site is meant for adults. If you are under 18, a parent or legal guardian must create the account, place orders and give any consent on your behalf, as our Terms of Service set out. We do not knowingly collect personal data from anyone under 18 without a parent or guardian’s consent.
Where we know a customer is under 18 (for example from a date of birth in their profile), we do not record their browsing activity. We also do not include them in customer groups for offers, and we do not send them marketing or targeted offers.
If you believe a child has given us personal data without a parent’s consent, write to [email protected] and we will delete it.
10. Your rights
You have the right to:
| Right | How |
|---|---|
| See what we hold about you, and who we have shared it with | Download a copy from “Your data” in My Profile, or write to us |
| Correct or update your details | Edit them in My Profile and My Addresses, or write to us |
| Delete your account and personal data | “Your data” in My Profile. Tax records are kept as described in section 7. Unused store credit and points are lost on deletion. |
| Withdraw consent for browsing history, analytics or marketing | “Browsing history” and the WhatsApp switches in your account, the email unsubscribe link, or STOP on WhatsApp |
| Nominate someone to exercise these rights if you die or become unable to | Write to us with their name and contact details |
| Raise a grievance about how we handle your data | Write to us (below) |
To use any of these rights, or if you have a concern, email [email protected] from the email address on your account, or include your registered mobile number. We may ask you to confirm your identity before acting. We aim to respond within 30 days.
11. Where your data is stored, and other websites
Our database and servers are located in India. Some of our partners, such as Google, Meta and Cloudflare, may process data on servers outside India. Where that happens, it is done under contracts that protect your data and only to countries the Government of India has not restricted.
The Site links to other websites, such as Instagram, WhatsApp, and our listings on Amazon. We do not control those sites and are not responsible for their privacy practices. Please read their privacy policies before you share information with them.
12. Changes to this policy, and contact
We may update this Privacy Policy when our practices or the law change. The “Last updated” date at the top shows when. For significant changes, such as a new purpose for your data, we will tell you on the Site or by email, and ask again for your consent where the law requires.
For questions or concerns about this policy or your data, contact:
KLEEM-AURA LIFESTYLE (The Thira Studio)
4 Auro Villa Duplex, near Siddheshwar Haven, opp. C M Patel Farm, Kalali Road, near Gram Panchayat Office, Kalali, Vadodara, Gujarat 390012
Email: [email protected]
Phone / WhatsApp: +91 63563 50163 (Monday to Saturday, 10:00 AM – 6:30 PM IST)