Privacy policy

Last updated: July 7, 2026

Bestie Box operates this website and online store at https://bestiebox.in. This Privacy Policy explains how we collect, use, share, store, protect, and delete personal information when you visit our website, create an account, place an order, contact us, subscribe to marketing, use Facebook Login or other Meta services, interact with cookies, or use any other Bestie Box service.

This Privacy Policy is designed to support transparency and privacy compliance under applicable data protection laws, including India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Digital Personal Data Protection Rules, 2025, and, where applicable, the EU/UK GDPR.

Please read this Privacy Policy together with our Terms of Service, Cookie Policy, Refund Policy, Shipping Policy, and Data Deletion & Privacy Requests page.

1. Who we are

For the purpose of this Privacy Policy, “Bestie Box”, “we”, “us”, or “our” refers to the operator of the Bestie Box website and store.

Website: https://bestiebox.in
Email: contact@bestiebox.in
Business location: Bengaluru, Karnataka, India

For privacy questions, data deletion requests, consent withdrawal, or grievances, you can contact us at:

Email: contact@bestiebox.in
Subject: Privacy Request / Data Deletion Request / Grievance

2. Personal information we collect

We collect different types of personal information depending on how you interact with Bestie Box.

2.1 Order and checkout information

When you place an order or attempt to place an order, we may collect:

  • Name
  • Email address
  • Phone number
  • Billing address
  • Shipping address
  • Order details
  • Cart details
  • Payment status
  • Delivery and shipment details
  • Refund, replacement, cancellation, or dispute details

Payment details may be processed by payment service providers. We do not intentionally store full card numbers, CVV, UPI PINs, banking passwords, or OTPs.

2.2 Account and login information

If you create or use a customer account, we may process:

  • Name
  • Email address
  • Phone number
  • Login identifiers
  • Account preferences
  • Order history
  • Authentication-related information

2.3 Facebook Login and Meta-related information

If you use Facebook Login or interact with Bestie Box through Meta services such as Facebook or Instagram integrations, we may receive limited information depending on your permissions and Meta settings, such as:

  • Name
  • Email address
  • Facebook User ID
  • Profile-related information permitted by you
  • Authentication tokens or login identifiers

You can request deletion of Facebook Login or Meta-related data by following our Data Deletion & Privacy Requests page.

2.4 Personalization and custom product information

For personalized products, we may collect information provided by you for customization, such as:

  • Names
  • Initials
  • Custom text
  • Design preferences
  • Preferred colors
  • Product personalization instructions
  • Images or uploaded content, if such feature is enabled

We use personalization information only to design, produce, deliver, support, or resolve issues related to your order.

Please do not upload or share Aadhaar, PAN, passport, payment card details, medical information, passwords, OTPs, or other sensitive identity documents for product personalization.

2.5 Contact form and customer support information

When you contact us through our website, email, WhatsApp, social media, or any support channel, we may collect:

  • Name
  • Email address
  • Phone number
  • Order number
  • Message content
  • Support history
  • Attachments or screenshots shared by you

2.6 Refund, replacement, and unboxing video information

For damaged-on-arrival or similar claims, we may ask for proof such as images or an unboxing video, depending on our Refund Policy.

Such files may contain personal data, such as your voice, face, home background, address label, order details, or product details. We use this information only to verify and process refund, replacement, damage, fraud-prevention, or dispute-related requests.

2.7 Marketing and newsletter information

If you subscribe to our newsletter, offers, updates, WhatsApp messages, SMS, or other marketing communication, we may collect:

  • Email address
  • Phone number
  • Marketing preferences
  • Consent records
  • Email/SMS/WhatsApp engagement information

You can opt out of marketing communication at any time. You may still receive order-related, payment-related, delivery-related, or service-related messages where necessary.

2.8 Cookies, device, and usage information

When you visit our website, we and our service providers may collect:

  • IP address
  • Device type
  • Browser type
  • Operating system
  • Pages visited
  • Products viewed
  • Cart activity
  • Referral source
  • Cookie identifiers
  • Analytics and marketing identifiers
  • Consent preferences

For more details, please read our Cookie Policy. You can change your cookie choices anytime by clicking Cookie Preferences in our website footer.

3. How we collect personal information

We may collect personal information:

  • Directly from you when you place an order, create an account, submit a form, contact us, subscribe, or provide customization details
  • Automatically through cookies, pixels, tags, local storage, and similar technologies
  • From Shopify, which powers our online store
  • From payment, logistics, marketing, analytics, fraud-prevention, and customer-support service providers
  • From Meta/Facebook/Instagram services, if you use those integrations
  • From social media or messaging platforms when you contact or interact with us there

4. Why we use personal information

We use personal information for the following purposes:

  • To operate our website and online store
  • To process and fulfil orders
  • To process payments and payment status updates
  • To arrange shipping and delivery
  • To create personalized or customized products
  • To provide customer support
  • To handle refunds, replacements, cancellations, and disputes
  • To maintain customer accounts and login features
  • To send order, delivery, payment, and service-related messages
  • To send marketing messages where you have opted in or where permitted by law
  • To manage cookie, privacy, and consent preferences
  • To improve website performance, product pages, collections, and customer experience
  • To analyze website traffic and store performance, where allowed
  • To show or measure relevant advertising, where allowed
  • To prevent fraud, misuse, spam, fake COD orders, and security risks
  • To comply with legal, tax, accounting, regulatory, and record-keeping requirements
  • To protect our rights, users, property, business, and legal interests

5. Legal basis and lawful purpose

Under applicable law, including the DPDP Act and GDPR where applicable, we process personal information only for lawful purposes.

Depending on the situation, we may process your personal information based on:

  • Consent: for marketing, newsletter subscription, non-essential cookies, analytics, personalization, advertising, or optional services where consent is required
  • Contract or order fulfilment: to process your order, payment, delivery, customization, refund, replacement, or customer account
  • Legal obligation: to comply with tax, accounting, consumer protection, regulatory, or lawful request requirements
  • Legitimate business use or legitimate interests: where permitted, such as fraud prevention, security, service improvement, dispute handling, or business protection
  • Voluntary provision of data: where you choose to provide customization details, contact information, or support-related details

Where we rely on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect processing already completed before withdrawal.

6. Cookies and similar technologies

We use cookies and similar technologies to operate the store, remember your cart, support checkout, maintain security, understand website performance, personalize your experience, and, where allowed, support marketing and advertising.

Required cookies are necessary for the website to work properly. Personalization, analytics, and marketing cookies are used according to your choices.

You can manage your choices at any time by clicking Cookie Preferences in our website footer.

For more information, please read our Cookie Policy.

7. Marketing communication

We may send you marketing communication such as offers, discounts, product updates, gift ideas, festival offers, or promotional messages only where permitted by law or based on your consent.

You can opt out of marketing communication by using the unsubscribe link in our emails or by contacting us at contact@bestiebox.in.

Even after opting out of marketing communication, you may still receive non-marketing messages related to orders, payments, delivery, refunds, replacements, customer support, legal notices, or security.

8. Personalized products and customer-submitted content

When you submit names, text, images, designs, or instructions for personalized products, you confirm that you have the right and permission to provide such content to us.

You should not submit content that is illegal, offensive, infringing, misleading, harmful, or that violates the rights of another person.

If you submit personal information relating to another person, including a child’s name, photo, or birthday-related customization, you confirm that you have the authority or required consent to provide that information.

9. Children’s personal data

Our website is intended for use by adults or by users who have the involvement and permission of a parent or legal guardian.

We do not knowingly collect personal information directly from children without appropriate consent. However, because Bestie Box may sell personalized gifts, customers may provide a child’s name, photo, age, birthday reference, or other customization details.

If you provide personal information relating to a child, you confirm that you are the parent, legal guardian, or an authorized person permitted to provide such information.

We do not knowingly use children’s personal data for behavioral tracking or targeted advertising directed at children.

If you believe a child has provided personal information to us without appropriate permission, please contact us at contact@bestiebox.in and we will take appropriate action.

10. Aadhaar, PAN, and sensitive documents

Bestie Box does not require Aadhaar, PAN, passport, voter ID, medical records, banking passwords, OTPs, card PINs, or similar sensitive identity documents for normal shopping, product personalization, customer support, or COD verification.

Please do not share such documents with us unless we specifically request limited information for a lawful and necessary purpose.

11. How we share personal information

We may share personal information with trusted third parties only where necessary for the purposes described in this Privacy Policy.

This may include sharing information with:

  • Shopify: to host and operate our online store, checkout, customer account, analytics, and related services
  • Payment service providers: to process payments, refunds, and payment status updates
  • Shipping and logistics partners: to deliver orders and handle delivery updates
  • COD or order-management apps: to support COD, partial payment, fraud prevention, and order verification features, if enabled
  • Marketing and communication tools: to send emails, SMS, WhatsApp messages, offers, and updates where allowed
  • Analytics and advertising partners: to understand store performance and run ads where allowed by your consent and applicable law
  • Meta/Facebook/Instagram: where you use Facebook Login, social integrations, pixels, or related services
  • Customer support tools: to respond to questions, complaints, and service requests
  • Fraud prevention, security, and technical service providers: to protect our store, users, and business
  • Professional advisors: such as accountants, legal advisors, auditors, or consultants
  • Government, regulatory, law enforcement, or legal authorities: where required by law or valid legal process

We do not sell your personal information in the ordinary meaning of selling customer lists for money. However, some privacy laws may define “sale,” “sharing,” or “targeted advertising” broadly. Where such laws apply, we will provide required notices and choices.

12. Shopify and Shopify Network Intelligence

Our store is powered by Shopify. Shopify may collect and process personal information when you access or use our store, checkout, customer accounts, payment-related features, analytics, security features, and other Shopify-powered services.

Shopify may also provide enhanced services, including services that help with fraud prevention, analytics, personalization, advertising, and store improvement. Where Shopify processes personal information for its own purposes, Shopify may be responsible for that processing.

You can learn more about Shopify’s privacy practices by visiting Shopify’s Consumer Privacy Policy and Shopify Privacy Portal:

Where required, your cookie and privacy choices are used to control non-essential Shopify-managed data processing.

13. Third-party websites and social media

WhatsApp, Meta and social media communication

Bestie Box may provide support or communication through WhatsApp, Facebook, Instagram, or other social media and messaging platforms.

When you contact us through WhatsApp or any Meta-owned service, your phone number, profile information, messages, attachments, metadata, and communication details may be processed by WhatsApp/Meta according to their own terms and privacy policies.

We use WhatsApp or social media messages only to respond to your queries, provide customer support, confirm order-related details, assist with customization, handle refund or replacement requests, and communicate with you where permitted by law.

Please do not share passwords, OTPs, payment PINs, card details, Aadhaar, PAN, passport, medical information, or other sensitive documents through WhatsApp, social media, or messaging platforms.

If you contact us through a third-party platform, that platform’s own privacy policy and terms may also apply. Bestie Box is not responsible for the privacy practices of third-party platforms.

Our website may contain links to third-party websites or platforms such as Facebook, Instagram, YouTube, X, WhatsApp, payment providers, logistics providers, or other services.

When you leave our website or interact with third-party platforms, their own privacy policies and terms may apply. We are not responsible for the privacy practices, security, or content of third-party websites or platforms.

14. Data storage, hosting, and international transfers

Bestie Box uses Shopify and other service providers to operate the store. Your personal information may be stored, transferred, or processed in India or in other countries, including countries where Shopify, payment providers, analytics providers, marketing platforms, logistics partners, or other service providers operate.

When personal information is transferred internationally, we rely on applicable legal safeguards, contractual protections, service-provider obligations, or other mechanisms permitted by applicable law.

If GDPR or UK GDPR applies, international transfers may rely on recognized mechanisms such as adequacy decisions, Standard Contractual Clauses, or equivalent safeguards where applicable.

15. Data security

We take reasonable technical and organizational measures to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

These measures may include access controls, secure platforms, HTTPS, restricted admin access, vendor controls, account security measures, and other reasonable safeguards.

However, no online system, website, email, messaging app, or internet transmission is completely secure. Please avoid sharing passwords, OTPs, payment PINs, sensitive documents, or confidential information through insecure channels.

16. Data retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Retention periods may vary depending on the type of data and purpose:

  • Order, invoice, payment, tax, and accounting records: retained as required by applicable tax, accounting, and legal requirements
  • Shipping and delivery information: retained for order fulfilment, delivery support, dispute resolution, and legal purposes
  • Customer support messages: retained for support history, dispute handling, service improvement, and legal purposes
  • Personalization details: retained for order creation, delivery, replacement, support, dispute handling, and then deleted or restricted where appropriate
  • Refund or unboxing video evidence: retained only as long as needed for claim verification, dispute handling, fraud prevention, or legal purposes
  • Marketing consent and subscription data: retained until you unsubscribe or withdraw consent, and then retained only as necessary to record your opt-out
  • Cookie consent records: retained to remember and prove your privacy choices
  • Account information: retained while your account is active or as needed for legal, operational, support, or security purposes

Where deletion is not immediately possible due to legal, tax, accounting, fraud-prevention, dispute, or operational requirements, we may restrict use of the data and retain it only for the required purpose.

17. Your rights and choices

Depending on where you live and which law applies, you may have rights relating to your personal information.

These may include:

  • Right to access personal information we hold about you
  • Right to receive information about how your personal information is processed
  • Right to correct inaccurate or incomplete personal information
  • Right to update your personal information
  • Right to request deletion or erasure of personal information
  • Right to withdraw consent where processing is based on consent
  • Right to opt out of marketing communication
  • Right to manage cookie preferences
  • Right to object to or restrict certain processing, where applicable
  • Right to data portability, where applicable
  • Right to nominate another person to exercise rights on your behalf, where applicable under Indian law
  • Right to submit a grievance or complaint

These rights are not absolute and may be subject to verification, legal exceptions, active orders, fraud-prevention needs, tax/accounting requirements, dispute-resolution needs, or other lawful grounds.

To exercise your rights, please visit our Data Deletion & Privacy Requests page or contact us at contact@bestiebox.in.

18. Consent withdrawal

Where we process your personal information based on consent, you may withdraw your consent at any time.

You may withdraw or manage consent by:

  • Clicking the unsubscribe link in marketing emails
  • Contacting us at contact@bestiebox.in
  • Changing cookie choices through Cookie Preferences in the footer
  • Removing Bestie Box from your Facebook Apps and Websites settings, where Facebook Login was used
  • Submitting a request through our Data Deletion & Privacy Requests page

Withdrawal of consent may affect our ability to provide certain optional services, such as marketing, personalization, analytics-based improvements, or optional login features. It will not affect order-related, legal, tax, security, or service communications that are necessary.

19. Data deletion and privacy requests

You may request deletion of your personal information, including customer account data, Meta/Facebook Login data, marketing data, contact form data, personalization information, or other personal data, subject to verification and legal limitations.

For detailed instructions, please visit our Data Deletion & Privacy Requests page.

We may retain certain information where required for order fulfilment, tax, accounting, fraud prevention, dispute resolution, legal claims, security, or compliance purposes.

20. Grievance redressal

If you have a complaint or concern about how we process your personal information, please contact us:

Bestie Box Privacy Contact
Email: contact@bestiebox.in
Subject: Privacy Grievance

Please include enough information for us to understand and respond to your grievance. We aim to acknowledge privacy-related requests within 7 business days and respond within a reasonable time according to applicable law.

Where applicable law provides a specific complaint or escalation mechanism, you may also have the right to contact the relevant data protection authority.

21. Data breach and security incidents

If we become aware of a personal data breach or security incident affecting your personal information, we will take appropriate steps to investigate, contain, and address the incident.

Where required by applicable law, we will notify affected individuals and/or the relevant authority within the required timeline.

If you believe your personal information with Bestie Box has been misused, exposed, or accessed without authorization, please contact us immediately at contact@bestiebox.in with the subject line Privacy / Security Concern.

22. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our website, Shopify settings, apps, cookies, services, legal requirements, or business practices.

The updated Privacy Policy will be posted on this page with a revised “Last updated” date.

23. Contact us

For questions about this Privacy Policy, data deletion, consent withdrawal, cookie choices, privacy rights, or grievances, please contact:

Bestie Box Privacy Contact
Email: contact@bestiebox.in
Website: https://bestiebox.in
Business location: Bengaluru, Karnataka, India