Privacy Policy · Orgieva Overseas

Effective date: 11 October 2026

This policy explains what personal data Orgieva Overseas Private Limited ("Orgieva", "we", "us") collects when you use orgieva.com and the Orgieva web app (together, the "Service"), why we collect it, who we share it with, how long we keep it, and the choices you have. It is written to comply with India's Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules under them, and with the Google API Services User Data Policy for sign-in.

1. Who we are

Orgieva Overseas Private Limited is a company registered in India that sells dry fruits, spices, ayurvedic herbs and oil and nut seeds directly to customers. Registered office: Faridabad, Haryana, India. Email: hello@orgieva.com. Phone: +91 74177 94904. We are the data fiduciary (controller) for the personal data described here.

2. Data we collect

Account data from Google Sign-In. The only way to sign in is with a Google account. When you sign in we receive from Google your name, your email address, your Google account identifier and, if set, your profile picture. We request only the basic openid, email and profile scopes. We do not request access to your Gmail, Drive, Contacts, Calendar or any other Google data, and we never receive your Google password.

Order and delivery data. Delivery name, phone number, postal address and PIN code, the products you order, quantities, prices, taxes, discounts, and the status of each order, shipment and return.

Payment data. Payments are processed by Razorpay. We receive the payment status, a payment reference, the amount and the payment method type (for example card, UPI, net banking, cash on delivery). We never receive, see or store card numbers, CVV, UPI PINs or bank passwords. Refunds are issued through the same provider to the original instrument.

Communications. Support tickets, messages you send us, product reviews and questions you post, and your notification preferences.

Device and usage data. IP address, browser type, pages viewed, products viewed and added to the cart, approximate region derived from your IP address, and error logs. We use this to keep the Service secure, to detect fraud and to understand which products people look at.

Cookies and local storage. A session cookie keeps you signed in. A cart identifier lets a cart survive between visits. A theme preference is stored in your browser. We do not use third-party advertising cookies and we do not track you across other websites.

Push notifications (optional). If you turn on browser notifications we store a push subscription token for your browser. You can turn this off at any time in your browser or under Account.

Information you do not have to give us. You can browse the catalogue without signing in. Signing in is required to place an order so that we can deliver it and issue a tax invoice.

3. Why we use your data

To create and secure your account and sign you in (Google account data, session cookie).
To take, pack, ship, deliver and, where needed, return or refund your orders (order, delivery and payment data).
To issue GST tax invoices and keep the accounting records Indian tax law requires.
To send transactional messages about your orders by email, and by WhatsApp or push notification if you have opted in: order confirmation, dispatch, delivery, return and refund updates.
To answer support requests and resolve complaints.
To publish reviews and questions you choose to post, shown with your first name.
To prevent fraud, abuse and payment misuse, and to keep the Service available and secure.
To understand which products are viewed and bought so we can plan stock. This analysis is done on our own systems; we do not sell or share it with advertisers.
With your separate consent, to send occasional marketing emails about new products and offers. You can unsubscribe from every such email with one click.

4. How we use Google user data specifically

Your Google name, email address and profile picture are used only to create your Orgieva account, show you who is signed in, send you order emails and let our support team identify your orders.
We do not use Google user data to build advertising profiles, to determine creditworthiness, or for any purpose unrelated to providing the Service.
We do not sell Google user data, and we do not transfer it to third parties except to the service providers listed in section 5 as needed to operate the Service, to comply with law, or as part of a merger or acquisition with notice to you.
Humans at Orgieva read your name and email only when handling your order or support request, for security investigations, or where you have asked us to.
Orgieva's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Who we share data with

We share personal data only with service providers that process it on our instructions, and only the minimum each one needs:

Razorpay Software Private Limited (payments and refunds): amount, order reference, your email and phone for payment notifications.
Shiprocket (Bigfoot Retail Solutions Private Limited) and the courier it assigns (delivery and returns): delivery name, address, phone and parcel details.
Resend (transactional email): your email address and the content of the email.
Meta Platforms (WhatsApp Business API), only if you opt in to WhatsApp updates: your phone number and the order message.
Google (sign-in): the sign-in request itself.
Vercel (hosting), Neon (database), Upstash (caching), Cloudinary (product and return-evidence images), Pusher (live support chat): infrastructure providers that store or transmit data on our behalf under contracts that restrict their use of it.

We may also disclose data where Indian law requires it, to respond to a lawful request from a public authority, to enforce our terms, or to protect the rights, property or safety of Orgieva, our customers or others. We do not sell personal data.

Some providers process data outside India. Where that happens we rely on contractual protections and the provider's own security certifications.

6. How long we keep data

Orders, invoices, payments and refunds: 8 years from the end of the financial year, as required by GST and company law.
Account profile (name, email, picture): for as long as your account exists, then deleted within 30 days of a deletion request unless an order record requires the name to remain on an invoice.
Delivery addresses: until you delete them from Account → Addresses, or on account deletion.
Support messages: 3 years after the ticket is closed.
Reviews and questions: until you delete them or your account is deleted; the text may be kept in anonymised form.
Usage logs and error logs: 90 days.
Push subscriptions: until you turn notifications off or the browser revokes them.

7. Your rights and choices

Under the Digital Personal Data Protection Act, 2023 you may:

Access a summary of the personal data we hold about you and how it has been used.
Correct inaccurate or incomplete data. Name and addresses can be edited under Account.
Delete your account and personal data, subject to the retention periods above.
Withdraw consent for optional processing such as marketing email, WhatsApp updates or push notifications at any time, with effect for the future.
Nominate another person to exercise these rights on your behalf in case of death or incapacity.
Complain to our Grievance Officer and, if unresolved, to the Data Protection Board of India.

To exercise any right, write to hello@orgieva.com from the email address on your account. We respond within 30 days. You can also revoke Orgieva's access to your Google account at any time at myaccount.google.com/permissions; doing so signs you out, but does not delete your Orgieva account or order history, which you can request separately.

8. Security

Data is encrypted in transit (TLS) and at rest by our hosting and database providers. Access to customer data inside Orgieva is limited to staff who need it for their role and is logged. Cost prices, bank details and staff credentials are never exposed to the storefront. If a breach affecting your personal data occurs, we will notify you and the Data Protection Board of India as the law requires.

9. Children

The Service is intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us data, contact us and we will delete it.

10. Grievance Officer

In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, our Grievance Officer is listed with full contact details on our Grievance Redressal page. Complaints are acknowledged within 48 hours and resolved within 30 days.

11. Changes to this policy

We will post any change on this page and update the effective date. For material changes affecting how we use data you have already given us, we will notify you by email before the change takes effect.

12. Contact

Orgieva Overseas Private Limited, Faridabad, Haryana, India. Email hello@orgieva.com, phone +91 74177 94904.