Privacy Policy

Effective Date: 15 April 2026   |   Last Updated: 15 April 2026

At Episenz, we believe your trust is as important as the science behind our products. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you visit www.episenz.com or place an order with us.

By using our website, you consent to the practices described in this policy.

Information We Collect

Information You Provide Directly

• Account & Registration: Name, email address, phone number, billing and shipping address, username, and password.
• Purchase & Transaction Information: Products ordered, payment method type, order values, discount codes, and transaction reference numbers. Payment credentials are processed securely by PCI-DSS compliant gateways and are never stored on our servers.
• Communications: Emails, support tickets, product reviews, survey responses, and feedback.
• Skin Profile (Optional): Skin type, skin concerns, and product preferences shared through quizzes or consultations. This information is treated as Sensitive Personal Data with additional protections.

Information Collected Automatically

• IP address, browser type, operating system, device type, screen resolution, and time zone.
• Pages visited, products viewed, cart activity, navigation paths, referring URLs, and time spent on pages.
• Cookies and similar tracking technologies.

Information from Third Parties

• Social login information from Google, Facebook, or Instagram.
• Advertising attribution data from Meta Pixel and Google Ads.
• Publicly available information used for fraud prevention.

How We Use Your Information

• Process and fulfil your orders.
• Manage your account.
• Process secure payments.
• Provide customer support.
• Send order confirmations, shipping updates, and transactional communications.
• Send promotional emails, SMS, and WhatsApp communications with your consent.
• Recover abandoned carts and personalise product recommendations.
• Improve our website, products, and customer experience.
• Prevent fraud and enhance security.
• Comply with applicable legal obligations.

How We Share Your Information

We do not sell, rent, or trade your personal information. We share data only with trusted service providers who process information solely on our instructions.

• E-commerce Platform: Shopify Inc. (store hosting, checkout, order management)
• Payment Processors: Razorpay, PayU, Stripe, EasyBuzz & GoKwik
• Shipping Partners: Delhivery, DTDC, Blue Dart
• Email & SMS Providers: Klaviyo, MSG91, Mailchimp, WhatsApp Business
• Analytics: Google Analytics 4, Meta Pixel
• Customer Support: Freshdesk, Intercom
• Cloud Infrastructure: Amazon Web Services (via Shopify)

We may also disclose your information where required by law, court order, government regulation, or during a business merger or acquisition with prior notice where applicable.

Data Retention

• Account information: Duration of account + 3 years after closure.
• Order and transaction records: 7 years from the transaction date.
• Customer support records: 3 years after resolution.
• Marketing consent records: Until consent is withdrawn + 1 year.
• Skin profile and quiz data: Until account deletion or withdrawal of consent.
• Fraud prevention records: Up to 5 years.

When information is no longer required, it is securely deleted or anonymised.

Cookies and Tracking Technologies

We use cookies and similar technologies to improve your experience, analyse website performance, and deliver relevant marketing. You can manage your preferences through our Cookie Preference Centre or your browser settings.

• Strictly Necessary Cookies
• Performance & Analytics Cookies
• Functional Cookies
• Marketing & Targeting Cookies
• Social Media Cookies

Sensitive Personal Data

Skin health information and any medical or health-related information voluntarily shared by you is treated as Sensitive Personal Data under applicable Indian laws.

• Collected only with your explicit consent.
• Used solely for the purpose stated at the time of collection.
• Not shared without your consent unless legally required.
• Protected using TLS 1.2+ and AES-256 encryption.
• You may withdraw consent and request deletion at any time by contacting us.

Data Security

We implement industry-standard technical and organisational security measures including:

• SSL/TLS (HTTPS) encryption across our website.
• Shopify's PCI-DSS Level 1 compliant infrastructure.
• Two-factor authentication for authorised team members.
• Restricted access to customer information on a need-to-know basis.
• Data Processing Agreements with key service providers.
• Incident response procedures including regulatory notification where required.

Your Rights

Under the Digital Personal Data Protection Act, 2023 (DPDPA) and IT (SPDI) Rules, 2011, you have the right to:

• Access your personal information.
• Correct inaccurate or incomplete information.
• Request deletion of your personal information where legally permissible.
• Withdraw consent for consent-based processing.
• Request data portability where feasible.
• Raise a grievance with our designated Grievance Officer.

To exercise these rights, email wecare@episenz.com with the subject line: Data Privacy Request — [Your Name]. We acknowledge requests within 48 hours and aim to resolve them within 30 days.

Children's Privacy

Our website and products are not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has shared personal information with us, please contact us immediately.

Marketing Communications

With your consent, we may send promotional emails, SMS, WhatsApp messages, and push notifications.

• Email: Click the Unsubscribe link in any marketing email.
• SMS or WhatsApp: Reply STOP or contact us at wecare@episenz.com.
• Preferences: Update your communication preferences through your Episenz account.

Opting out of marketing communications does not affect transactional communications related to your orders or account.

Governing Law

This Privacy Policy is governed by the laws of India. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the courts in Mumbai, Maharashtra.

Contact & Grievance Officer

Email: wecare@episenz.com

Subject: Data Privacy Request — [Your Name]

Response: Acknowledgement within 48 hours | Resolution within 30 days

Registered Office: 802 C3, 8th Floor, A Wing, Pinnacle Corporate Park, BKC G Block, Bandra East, Mumbai – 400051