Privacy policy

1. Who this policy covers

This policy applies to customers and visitors using Zasso Fashions websites, mobile experiences, accounts, customer service, and connected shopping services. In this policy, “Zasso”, “we”, “us”, and “our” refer to the Zasso seller or service operator identified at checkout, in your order confirmation, or in the relevant service notice.

Zasso is responsible for deciding how personal data covered by this policy is used. A service provider acting only on Zasso’s instructions processes data on Zasso’s behalf.

2. Personal data we collect

The information we collect depends on how you use Zasso. It may include:

• Identity and account data, such as name, email address, mobile number, account identifier, authentication status, and profile preferences.
• Order and delivery data, such as cart contents, sizes, delivery and billing addresses, order history, delivery status, returns, refunds, and support records.
• Payment-related records, such as payment method type, provider reference, payment status, and refund status. Zasso is designed not to receive or store full card numbers, CVV values, UPI PINs, or banking passwords.
• Device and security data, such as IP address, browser or app type, device identifiers, sign-in events, security logs, cookie choices, and fraud-prevention signals.
• Communication and preference data, such as customer-service messages, newsletter consent, restock requests, product preferences, survey responses, and accessibility requests.
• Content you choose to submit, such as return evidence or a customer story. Sensitive uploads are kept private and reviewed only for the purpose for which they were submitted.

3. How we collect information

We receive information directly from you when you browse, create an account, sign in with Google, place or track an order, request a return, contact client service, or choose a preference. We also receive limited technical and transaction information automatically from our services and from providers involved in authentication, hosting, payment, delivery, fraud prevention, and communications.

If another person places an order for you or refers you to Zasso, they must have permission to provide your details.

4. Why we use personal data

We use personal data only for a stated and lawful purpose, including to:

• provide the storefront, account, wishlist, checkout, order, delivery, return, refund, and support services you request;
• verify identity, protect accounts, prevent fraud and abuse, maintain service reliability, and investigate security incidents;
• keep records required for accounting, tax, consumer protection, dispute handling, and other legal obligations;
• improve navigation, product discovery, fit guidance, service quality, and accessibility using aggregated or consented measurement; and
• send optional collection notes, restock alerts, or personalised recommendations only where you have made the relevant choice.

5. Cookies, local storage, and analytics

Essential cookies and local storage support sign-in, security, your bag, wishlist, checkout continuity, region, and consent choices. These functions may not work if essential storage is blocked.

Optional analytics is enabled only after you accept it. Analytics events are designed not to include contact details, addresses, payment credentials, authentication secrets, or the text of support messages. You can change your choice through the Cookies control in the footer. Read the Cookie Policy for more detail.

6. When we share personal data

We disclose only what is reasonably necessary to operate the requested service. Recipient categories may include cloud hosting, database and file-storage providers, identity providers, payment processors, delivery partners, customer-communication services, security and fraud-prevention providers, analytics providers enabled by consent, professional advisers, and public authorities where legally required.

At present, Supabase supports authentication, database, and managed storage functions; Google may support a sign-in method; and Hostinger supports website hosting. Each provider handles information under its own service terms and Zasso’s applicable processing instructions. We do not sell or rent personal data to data brokers.

7. Processing outside your location

Some infrastructure or service providers may process information in another country. Where this occurs, Zasso uses provider commitments and safeguards appropriate to the data and follows any transfer restrictions that apply under Indian law.

8. How long we keep information

We keep personal data only for as long as it is needed for the purpose described, to provide an active service, or to meet a legal requirement. Retention depends on the record: account data is generally kept while the account is active; consent and security records are kept for audit and protection; and order, payment, refund, tax, fraud, and dispute records may need to be kept after an account is closed.

When retention is no longer necessary, information is deleted, anonymised, or isolated from routine use. Backup copies expire according to controlled backup cycles rather than disappearing immediately from every system.

9. How we protect information

Zasso uses access controls, role restrictions, authenticated sessions, encryption in transit, private storage for sensitive files, audit records, secret management, and security monitoring appropriate to the service. No online system can be guaranteed completely secure. Please use a unique password, protect your email and device, and contact us promptly if you believe your account has been misused.

10. Your choices and privacy rights

Subject to identity verification, applicable law, and necessary legal retention, you may:

• request a summary or portable export of personal data associated with your account;
• ask us to correct inaccurate or incomplete information;
• ask us to erase eligible personal data or close your account;
• withdraw consent for optional marketing, analytics, or personalisation without affecting processing already completed;
• raise a grievance about how personal data is handled; and
• exercise any nomination or other right that becomes applicable under the Digital Personal Data Protection Act, 2023 and its rules.

11. Children’s privacy

Zasso accounts and direct purchases are intended for adults. A person under 18 should use Zasso only with a parent or lawful guardian. We do not knowingly use a child’s personal data for targeted advertising or behavioural monitoring. A parent or guardian may contact us to review or remove information submitted by a child, subject to legal retention requirements.

12. Requests, grievances, and complaints

For a privacy request or grievance, use the Contact page and choose “Privacy or data request”. Include the email attached to your account and enough detail for us to understand the request, but never send a password, one-time code, full card number, CVV, UPI PIN, or banking password.

We may ask for proportionate verification before disclosing, correcting, or deleting data. We will acknowledge and handle requests within the period required by applicable law. If a concern is not resolved, you may use the remedies available under applicable Indian data-protection or consumer law.

13. Changes to this policy

We may update this policy when services, providers, or legal requirements change. The current version and effective date will remain on this page. If a change materially affects an existing consent or how we use personal data, we will provide an appropriate notice and request a new choice where required.