Privacy Policy

1Who we are, and what this policy covers

AimsCraft Pvt. Ltd. is the data controller for aimscraft.com, and this policy covers every piece of personal data the website, the mobile experience and our three Kashmir stores collect from you.

We are a private limited company registered in Jammu & Kashmir, India, trading as AimsCraft from Watergam, Rafiabad, Baramulla, Jammu & Kashmir 193303. “We”, “us” and “AimsCraft” in this document always mean that company.

This policy applies when you browse the site, place an order, create an account, subscribe to the newsletter, write a review, use the WhatsApp support line, or walk into one of our shops and give us an address for a delivery. It does not apply to sites we link to — a courier tracking page, for example, has its own policy and its own controller.

It sits alongside three other documents you may want open: the Cookie Policy, which itemises every cookie and browser-storage key we set; the Terms & Conditions, which govern the sale itself; and the Returns Policy, which explains what happens to the data attached to a refund.

2What we collect

We collect four things: what you tell us, what your order generates, what your browser sends, and what you choose to publish in a review. We do not buy data about you from anyone else.

Nothing in the table below is optional trickery: every field marked required at checkout is required because a parcel cannot physically reach you without it. Fields we do not need are not asked for — we have never asked a customer for a date of birth, a gender or an income bracket.

We do not knowingly collect special-category data: no religion, no health, no biometrics, no political opinion. If you volunteer something sensitive in a support message — a medical reason for an altered fit, say, or a bereavement behind a gift order — we use it only to answer you and delete it with the ticket.

3Why we use it, and our legal basis

Every use of your data falls under one of four legal bases: performing your contract, complying with Indian tax and consumer law, our legitimate interest in running a shop that works, or your explicit consent.

Under the Digital Personal Data Protection Act 2023 we process data for the specified lawful purposes below and no others. For customers in the UK and EU, the equivalent GDPR Article 6 basis is named in the same row.

Where the basis is legitimate interest we have written down the balancing test and will send it to you on request. Where the basis is consent you can withdraw it at any time without giving a reason, and withdrawing it never affects an order already in flight.

4Cookies, browser storage and analytics

AimsCraft sets no advertising cookies. Your bag, wishlist, theme and currency live in your own browser’s local storage, which never leaves your device unless you place an order.

The site is built as static HTML with no third-party tag manager and no advertising pixels. What would normally be a cookie here is a localStorage key instead — ss.cart, ss.wishlist, ss.theme, ss.currency and a handful of others. Those keys are readable only by this domain, are never transmitted to our servers, and are wiped the moment you clear site data in your browser.

Analytics are first-party and aggregated: we count page views, add-to-bag events and failed searches so we know which garment photograph is not doing its job. We do not build advertising profiles and we do not share analytics with an ad network.

The single third-party request the whole site makes is a stylesheet from Google Fonts, which necessarily sees your IP address and browser string in order to serve a font file. Everything else — scripts, icons, images, the entire catalogue — is served from aimscraft.com.

The complete inventory, with the purpose and lifetime of each item, is in the Cookie Policy.

5Who we share your data with

Your data goes to four kinds of recipient and no others: the courier delivering your parcel, the gateway taking your payment, the vendors running our infrastructure, and any authority with a lawful order.

• Couriers. Delhivery, Blue Dart and India Post inside India; DHL Express for the 42 countries we export to. They receive your name, address, pincode and phone number, because a parcel cannot be delivered without them.
• Payment gateway. Our RBI-licensed gateway processes the card, UPI or net-banking transaction. We receive a token; they never receive your order contents beyond the amount and an order reference.
• Infrastructure. Cloud hosting in AWS Mumbai (ap-south-1), transactional email and SMS providers for order notifications, and an accounting system for GST filings.
• Professional advisers. Our auditors and, rarely, our lawyers — under professional confidentiality, and only where a specific matter requires it.
• Authorities. Tax, customs and law-enforcement bodies where a valid legal order compels disclosure. We check that every request is lawful and, where the law permits, we tell you it happened.

Every processor is bound by a written data-processing agreement that forbids them from using your data for their own purposes. We have never sold, rented or shared a customer list for marketing, and this policy is a commitment that we never will. A change of ownership of the company would not change that: any buyer would inherit these commitments intact.

6Where your data is stored, and international transfers

All AimsCraft data is stored in India, in AWS’s Mumbai region, with encrypted backups held in the same country.

If you order from outside India, your data necessarily crosses a border to reach us. For customers in the UK and the European Economic Area those transfers are made under the European Commission Standard Contractual Clauses (2021/914) together with a transfer risk assessment that we will share on request.

International courier shipments also involve a transfer to the destination country’s customs authority: your name, address, the contents of the parcel and its declared value appear on the customs declaration, because they legally must.

7How long we keep it

We keep invoices for eight financial years because Indian tax law requires it, and delete almost everything else within two years of your last interaction.

When a period expires the record is deleted, not archived. Backups roll off on a 35-day cycle, so a deletion is fully flushed within five weeks even from cold storage.

8How we keep it safe

Everything moves over TLS 1.3, passwords are hashed with bcrypt and never stored in readable form, and access to customer records is limited to the eleven staff whose job needs it.

• HTTPS everywhere, with HSTS and a strict content security policy — the site loads no external scripts at all.
• Passwords hashed with bcrypt at cost factor 12. We cannot read your password and will never ask for it.
• Two-factor authentication available on your account, and mandatory for every member of staff.
• Role-based access: the packing desk sees an address label, not a payment record; the marketing desk sees neither.
• Encrypted backups, restored and tested quarterly.
• A documented breach procedure: the Data Protection Board of India within 72 hours, and you without undue delay if there is a real risk to you.

No system is perfect and we do not pretend otherwise. If you spot a vulnerability, write to security@aimscraft.com; we acknowledge within two working days and we do not take legal action against good-faith researchers.

9Your rights, and how to use them

You can ask for a copy of your data, correct it, delete it, restrict how we use it, take it elsewhere in a machine-readable file, or object to a use you disagree with — and we answer within 30 days at no charge.

• Access. A full export of your profile, addresses, orders, returns, reviews and support history.
• Correction. Fix a misspelt name or a wrong pincode yourself in your profile, or ask us to.
• Erasure. Delete the account and everything in it, except invoices the tax law obliges us to keep.
• Restriction. Freeze processing while a dispute about accuracy is resolved.
• Portability. A JSON or CSV export you can hand to another retailer.
• Objection. Object to any processing based on legitimate interest, including all profiling.
• Withdraw consent. One click in any newsletter, or one line in an email, with no effect on orders in progress.
• Nominate. Under the DPDP Act you may nominate someone to exercise these rights if you die or become incapacitated.

Write to privacy@aimscraft.com from the address on your account. We may ask one verification question — usually the value of your last order — before releasing anything, because handing your data to an impostor would be the worse failure.

If we get it wrong, you can complain to the Data Protection Board of India, or, in the UK and EEA, to your national supervisory authority. We would rather you told us first: nearly every complaint we have had was a fixable mistake.

10Marketing, and how to stop it

We email roughly twice a month, only to people who ticked the box, and every message carries a one-click unsubscribe that works immediately rather than “within ten days”.

The newsletter covers what has come off the looms, the winter overcoat cut-off dates and the occasional sale. If you bought from us without subscribing you will get transactional messages about your order — confirmation, dispatch, delivery, refund — and nothing else. Those are not marketing and cannot be unsubscribed from while an order is live.

WhatsApp updates are opt-in separately and can be stopped by replying STOP. SMS is used only for OTP codes and delivery alerts. We do not run retargeting campaigns, so unsubscribing here means you genuinely stop hearing from us rather than seeing us follow you around the internet.

11Children

AimsCraft is not intended for anyone under 18, and we do not knowingly collect data from children.

Accounts and orders require you to be 18 or older, as set out in the Terms & Conditions. Under the DPDP Act, processing a child’s data would need verifiable parental consent, and behavioural advertising to children is banned outright — we run none for anyone.

If you believe a child has given us personal data, write to privacy@aimscraft.com and we will delete it within seven days.

12Changes to this policy

When this policy changes materially we email every account holder at least 14 days before the new version takes effect, and we keep the previous version available on request.

Version 4.2, dated 1 September 2026, replaced version 4.1 of 12 March 2026. The change added the DPDP Act nomination right and named AWS Mumbai explicitly as the storage location. Typographic corrections do not trigger a version bump; anything that changes what we collect, why, or who sees it always does.

13Contacting our Data Protection Officer

Every privacy question, rights request and complaint goes to privacy@aimscraft.com, which reaches our Data Protection Officer directly rather than the general support queue.

Data Protection Officer

privacy@aimscraft.com

Grievance Officer (IT Rules 2021)

grievance@aimscraft.com

Postal address

The Data Protection Officer, AimsCraft Pvt. Ltd., Watergam, Rafiabad, Baramulla, Jammu & Kashmir 193303, India

Telephone

⁦+91 00000 00000⁩, Monday to Saturday, 10am–7pm IST

Acknowledgement

Within 2 working days

Full response

Within 30 days

14Questions we get asked about privacy

Five questions that come in most often, answered without the legalese.

15The rest of the small print

These five documents are written to be read together: the terms govern the sale, the privacy and cookie policies govern your data, and the shipping and returns policies govern the parcel.