Privacy Policy

1. Who We Are

JBM Buildcare Products is the Data Fiduciary responsible for your personal data under the DPDP Act.

• Registered address: Sr No. 20, Kiwale Gaon, Dehuroad, Pune - 412101, Maharashtra, India
• GSTIN: 27EHDPM8440L1ZV
• Email: JBMBUILDCAREPRODUCT@GMAIL.COM
• Phone: +91 85303 86363

2. Personal Data We Collect

Data you give us directly

• Account details — first and last name, email address, phone number, and a password. Passwords are stored only as a salted one-way hash and are never readable by us or stored in plain text. We also email you a one-time code to confirm your email address when you register.
• Sign-in with Google— if you choose to sign in with Google, on the website or in the App, Google shares your name, email address, profile photo and Google account identifier with us. We receive only what Google sends after you approve it, and we do not receive your Google password. An account created this way has no password until you choose to set one; you can do so with "Forgot password" on the sign-in page.
• Profile photo — only if you choose to upload one, or if it is supplied by Google when you sign in with a Google account.
• Delivery addresses — recipient name, phone number, and address details you save to your account or enter at checkout.
• Order and cart contents — items selected, quantities, order value, payment method, order status and history, and any delivery notes you add. If you are signed in, your cart is saved to your account.
• Enquiries — the name, email, phone number, subject and message you submit through our contact form or a bulk quote request.
• Reviews — any rating or review text you choose to publish against a product, shown publicly with your first name.

Data collected automatically

• Sign-in session records, including a session identifier and its expiry, used to keep you logged in securely.
• Technical data such as IP address, browser or device type and request logs, retained for security, fraud prevention and diagnosing faults.
• Notices we create for your account, such as an in-app notification when the status of your order changes, and records of the transactional emails we send you (for example order confirmations, cart reminders and review requests).
• Small amounts of data stored on your own device — see section 7.

Data we do not collect

We do not collect or store your card number, UPI ID, net-banking credentials or any other payment instrument details. These are entered directly with our payment partner, Razorpay, and never pass through or rest on our servers. We also do not knowingly collect any special or sensitive category data such as health, biometric, caste, religious or political information, and you should not send such data to us.

If you use the App

The App does not access your location, contacts, camera, microphone, photos or messages, and does not read other apps on your phone. It uses your internet connection to load the website, can save a downloaded file (such as an invoice) to your phone, and can vibrate. If you sign in with Google in the App, the Google account picker on your phone is used, and Google tells us which account you chose. Links to phone calls, WhatsApp, maps and email open in the relevant app on your phone, and from that point that app's own privacy policy applies.

3. Why We Use Your Data, and Our Legal Basis

Cart reminders and review requests are sent by our team, one at a time, not by an automated marketing system. We send at most one reminder for a given cart in any 24 hours, and one review request for a given order. We do not use your personal data to make any decision about you that is based solely on automated processing and produces a legal or similarly significant effect.

4. Consent, and How to Withdraw It

Where we rely on your consent, you gave it by creating an account and accepting these terms, and we record the date and time you did so. You may withdraw your consent at any time by writing to our Grievance Officer at the address in section 12, or by replying to any reminder or review-request email and asking us to stop. We will then stop sending you those emails.

Withdrawing consent does not affect anything we lawfully did with your data beforehand. Please note that some data is necessary to run your account and fulfil orders you have already placed — if you withdraw consent for that data, we may no longer be able to provide the service, and we may still need to retain records we are legally required to keep.

5. Who We Share Your Data With

We share the minimum data necessary with service providers who process it on our instructions and are bound to keep it confidential. We do not sell your personal data, and we do not share it with third parties for their own advertising.

• Razorpay — to process payments and refunds. Razorpay receives your name, contact details and order amount, and collects payment instrument details directly from you under its own privacy policy.
• Google — if you choose to sign in with a Google account, Google shares your name, email address and profile photo with us, and learns that you signed in to our service. Google also provides the map on our Contact page (see section 7).
• Resend — to deliver transactional email. Receives your email address and the message content.
• Cloudinary — to host images, videos and documents, including any profile photo you upload and our product images, product videos and technical data sheets.
• Hosting and infrastructure providers — Vercel serves the website, Render runs our server, and Supabase hosts our database. All of the data in this policy is stored with, and passes through, these providers.
• Delivery and logistics partners — the recipient name, address and phone number needed to deliver your order.
• Professional advisers and authorities — where we are required to disclose data by law, a court order, or a lawful request from a government agency, or to establish or defend legal claims.

If you tap the WhatsApp button on our site, WhatsApp opens with a prefilled message to our business number. Nothing is sent until you send it, and from then on WhatsApp's own privacy policy applies to the conversation. We will see the number you write from.

6. Transfers Outside India

Some of the service providers listed above operate infrastructure outside India, so your data may be processed outside the country. We transfer data only to providers that offer contractual protections and security standards comparable to those required here, and only to countries not restricted for transfer by the Central Government under the DPDP Act.

7. Cookies and Similar Storage

Cookies. We use a small number of strictly necessary cookies. These hold your sign-in tokens, are marked HttpOnly so they cannot be read by scripts in your browser, and exist only to keep you securely signed in and to protect against request forgery.

Storage on your device.We also keep three things in your browser's (or the App's) local storage: your chosen language, your chosen light or dark theme, and, if you browse without signing in, the items in your basket, so that it survives a page refresh. This never leaves your device until you sign in and check out. It stays until you clear your browser data, clear the App's storage or uninstall the App.

Content from Google.The sign-in and registration pages load Google's sign-in button on the website, and our Contact page shows a Google Map. Loading either causes your browser to contact Google, which can see your IP address and that you visited that page, and may set its own cookies under Google's privacy policy. We do not control this. In the App, Google sign-in uses your phone's Google account picker instead of Google's web button.

We do not use advertising cookies, third-party analytics, tracking pixels or cross-site profiling. Because our cookies are strictly necessary for the service to work, blocking them in your browser will prevent you from signing in or placing an order.

8. How We Protect Your Data

We maintain reasonable security practices and procedures as required by section 43A of the IT Act and the SPDI Rules, including encryption of traffic in transit over HTTPS, one-way hashing of passwords, HttpOnly session cookies with expiry, role and permission-based access so staff can only reach the records their role requires, and audit logging of staff actions on customer records.

No method of transmission or storage is completely secure. You are responsible for keeping your password confidential and for any activity under your account, and should tell us immediately if you believe it has been compromised. Install the App only from a source we publish, and keep your phone's screen lock on.

9. How Long We Keep It

• Account data — for as long as your account is active, and for a reasonable period afterwards to resolve disputes and enforce our agreements.
• Order records and tax invoices — for the period required by Indian tax and company law, which is generally eight years, even if you close your account.
• Contact-form messages and quote requests — for as long as needed to deal with the enquiry and keep a record of it.
• Session and security logs — for a short period appropriate to security monitoring.

When data is no longer required for any of these purposes, we delete it or anonymise it so it can no longer be linked to you.

10. Your Rights

As a Data Principal under the DPDP Act, you have the right to:

• obtain a summary of the personal data we hold about you and how we process it, and the identities of those we have shared it with;
• have inaccurate or incomplete data corrected, updated or completed — much of which you can do yourself from your profile and address pages;
• have your personal data erased where it is no longer needed for the purpose it was collected for, and where we are not required by law to keep it — to ask for your account to be closed and its data erased, contact our Grievance Officer below;
• nominate another individual to exercise these rights on your behalf in the event of your death or incapacity;
• have your grievance addressed by us, and to escalate it to the Data Protection Board of India if you are not satisfied with our response.

You also have a duty under the DPDP Act not to raise frivolous or false complaints and to give authentic information when exercising a correction right.

Visitors from outside India

If you are in the European Economic Area or the United Kingdom, you may also have the right to restrict or object to processing, to receive your data in a portable machine-readable format, and to lodge a complaint with your local supervisory authority. We honour these requests as a matter of policy. To exercise any right, contact our Grievance Officer below. We will verify your identity before acting, and will respond within the timelines in section 12.

11. Children

This website and the App are intended for people aged 18 and over, and we do not knowingly collect the personal data of children. Under the DPDP Act, processing a child's data requires verifiable parental consent, and tracking or targeted advertising directed at children is prohibited — we do neither. If you believe a child has given us personal data, contact our Grievance Officer and we will delete it.

12. Grievance Officer and Contact

In accordance with the IT Act and the SPDI Rules, the Consumer Protection (E-Commerce) Rules, 2020, and the DPDP Act, the following officer may be contacted about this policy, your personal data, or any grievance about our service:

We will acknowledge your complaint within 48 hours of receiving it, and resolve it within one month, as required by the Consumer Protection (E-Commerce) Rules, 2020. If you are not satisfied with how we have handled a complaint about your personal data, you may escalate it to the Data Protection Board of India.

13. Changes to This Policy

We may update this policy from time to time. The "last updated" date at the top will always show when it last changed, and where a change materially affects how we use your data, we will notify you by email or through a notice on the website. Continuing to use the website or the App after a change takes effect means you accept the updated policy.

This policy should be read together with our Terms & Conditions and our Refund & Cancellation Policy.