Privacy policy

Who is responsible

Tinybridge Ventures Private Limited, trading as constituition.org, at WeWork Galaxy, 43 Residency Road, Richmond Town, Bangalore 560025, Karnataka, India, is the data fiduciary for personal data collected through https://constituition.org, under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

What we collect

• When you order: your name, email address, phone number, delivery address, and what you bought. A company name and GSTIN if you ask for a business invoice.
• When you sign in: your email address, and the list of articles you save. Sign-in is by a link sent to your email; no password is stored. An account keeps your saved list and is not linked to orders.
• When you pay: nothing about your card, UPI or bank. Payment is handled by Razorpay on its own pages; we receive only the payment reference, the amount, the method used (for example “UPI”) and whether it succeeded.
• Automatically: the cookies listed below, and server logs that record IP address, browser type and the pages requested, for security and to keep the site working. We do not run advertising trackers.
• When you write to us: what you send, and the address you send it from.

Why we use it

• to take, pack and deliver your order, and to tell you where it is;
• to take payment and issue invoices and refunds;
• to answer your messages and handle returns and complaints;
• to keep the site secure and to detect fraud;
• to meet legal obligations, including tax and accounting rules;
• to send you news from constituition.org only if you asked for it — every such email has a way to stop.

Who else sees it

We share personal data only with the parties needed to do the things above:

Razorpay Software Private Limited

Payment processing. Sees your name, email, phone and the amount; handles your payment details under its own privacy policy.

The courier

Delivery. Sees your name, address and phone number, and calls that number.

Our hosting, email and accounting providers

The servers the shop runs on, the service that sends order emails, and the service that raises the GST invoice. They process data on our instructions and do not use it for themselves.

Authorities

Where the law requires it — for example a tax authority, or a court order.

We do not sell personal data, and we do not share it with advertisers.

Cookies

The site sets only cookies it needs to work, none of them for advertising:

• the ones that keep you signed in, if you sign in;
• one that says only that this browser is probably signed in, so a page can offer your saved list without asking the server first.

The shop sets no cookie: checkout holds what you type only while the page is open. Your browser also keeps, on your device, your Light or Dark choice and, if you are not signed in, the list of articles you saved. You can delete cookies and site data in your browser; the sign-in and that list will then be forgotten.

How long we keep it

• Orders, invoices and refund records: 8 years from the end of the financial year, as Indian tax and company law require.
• Your account: until you delete it or ask us to.
• A checkout that never became an order: 30 days.
• Messages to us: as long as needed to deal with them, then deleted.
• Server logs: 90 days.

Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct or delete it, withdraw consent you have given (for example to news emails), and nominate someone to exercise these rights for you. Write to hello@constituition.org. We answer within 30 days. We keep what the law obliges us to keep (order and tax records) even after a deletion request, and tell you so.

Security

The site is served over HTTPS. Payment details never reach our servers. Access to order data is limited to the people who pack and support orders. No system is perfectly secure; if a breach affects your data we will tell you and the Data Protection Board of India as the law requires.

Children

The shop is for adults. We do not knowingly collect personal data from anyone under 18; if you believe we have, write to us and we will delete it.

Grievance officer and complaints

Questions and complaints about personal data go first to hello@constituition.org. If you are not satisfied, the grievance officer named on the contact page acknowledges a complaint within 48 hours and resolves it within one month. You also have the right to complain to the Data Protection Board of India.

Changes

We may change this policy; the date at the top of this page says when we last did. A change that affects how we use data already collected will be sent to the email we hold for you before it takes effect.