Privacy & cookies

What we collect, and when

Nothing is collected about you until you do something that needs it. Here is each of those moments.

Browsing

Our own server counts page views: the page, the site you came from, whether the device is a phone, and a shortened one-way hash of your session id so two views can be told apart. No IP address and no browser fingerprint are stored, and no identifier is placed in your browser for this. Kept 400 days.

Basket and wishlist as a guest

The products you add, against a random token in a cookie (below). A guest basket is kept 30 days from your last visit, a guest wishlist 90 days. Nothing about who you are is in either.

Basket when signed in

The products in your basket, kept against your account so our team can see what is waiting. Kept 30 days from its last change; placing the order or emptying the basket deletes it.

Checking out

Name, email, mobile number, delivery address, PIN code and state — what a parcel and a GST invoice need — plus your chosen payment method. A business order also records the legal name, GSTIN and billing address you type for the tax invoice. The mobile number is normalised to ten digits and the PIN code is checked against its state before the order is accepted, so the courier gets an address that works. Card, UPI and bank details never reach us: the payment provider takes those on its own pages.

Unfinished baskets

Once you have typed your email at checkout, or signed in, with something in your basket, a copy of that basket is kept against the email so we can send one reminder if it is still waiting after 4 hours. Placing the order or emptying the basket deletes the copy. Every reminder carries a link that stops them for good.

Creating an account

Name, email, mobile number (optional) and a password we store only as a one-way hash. The offers and new-arrivals email option on the registration form starts unticked; tick it only if you want those emails, and change it on your profile at any time. Each sign-in records the device type and IP address for 60 days, which is what lets you see your signed-in devices and sign them all out.

Writing to us

The contact form sends your name, email, optional mobile number and message to our inbox, together with the IP address it came from, which is how we tell a person from a flood of automated messages. The message stays in our mail log so we can follow the thread.

Business enquiries

Company, contact name, email, phone, GSTIN, city and state, what you want to buy and your message, with the IP address, kept as an enquiry record the business desk works from.

Reviews

Your rating, headline and review text, shown publicly under the name on your account with a verified-buyer badge, and linked to the order that qualifies you to write it.

Offers list

Your email, where you signed up (the footer, the register form or your profile) and when. One click leaves; we keep a note of the opt-out so you are not emailed again.

Spin-to-win

If the popup is switched on and you play, the name and email you give and the offer you won, kept so the code can be honoured at checkout.

Search

What you type into the search box is tallied by the word — how many times, not by whom. Nothing ties a search to you: no session, no account, no IP address, no record of the moment you searched, only a per-day count of the words themselves. Kept 180 days.

Keeping the shop safe

Failed sign-ins are counted against the IP address and email for one day, and repeated requests against the IP address for one day, so a script cannot guess passwords or flood a form. Both are cleared automatically.

Cookies we set

Everything below is first-party — set by this site, readable by no other.

Session (BIKLI2_STORE)

Signs you in and keeps your basket while you browse. Essential; ends when the browser closes.

Basket (bikli_cart)

A random token that finds a guest basket again. Essential to shop; kept 30 days from your last visit.

Wishlist (bikli_wish)

A random token for a guest wishlist — set only when you first heart something. Kept 90 days.

Theme (bikli_theme)

Light or dark, set only when you use the toggle. Kept a year.

Announcements (bikli_announce)

Remembers a message bar you closed, so it stays closed. Kept a year.

Your cookie choices (bikli_consent)

The categories you allowed, and the version of the question you were asked. Essential; kept a year, and asked again if what we set ever changes.

Theme and announcements are Essential: nothing is written until you use the toggle or close a bar. Page-view counts are Analytics, and are not recorded while that is off. There is no Marketing category in use: no advertising cookie, no cross-site tracker, nothing an ad network can read. The switch exists so that if that ever changes, it is off until you say otherwise.

The bar at the foot of the screen has three answers and they are all one tap: Accept all allows every category above; Essential only allows none of the optional ones; and Choose what it keeps opens the three switches. Closing the bar with the ✕ is the same as Essential only: closing it never switches anything optional on.

Who else sees it

• The courier gets the name, address and mobile number on the parcel, and nothing else.
• The payment provider gets the order amount and reference when you choose to pay online, and may set its own cookies on the payment page to complete the transaction; it handles your card or UPI details itself. Cash on delivery involves no third party at all.
• Our email provider delivers order confirmations, dispatch notes, password resets and any reminder you have not opted out of.
• Videos load from YouTube or Vimeo only after you press play, and the button says which. Until that press, nothing is fetched from them.
• Google and Meta (Facebook) receive a record of the pages you view here, but only once you have accepted the matching cookie category. Decline it, or ignore the panel, and nothing is sent.

No data broker receives anything, and nothing is sold.

How long we keep it

Orders and invoices

For as long as GST and accounting rules require order records to be kept.

Your account

Until you ask us to delete it. Orders stay on record as above, without the account.

Page-view counts

400 days.

Search word counts

180 days.

Copies of emails we sent you

180 days.

Guest basket / wishlist

30 / 90 days from your last visit.

Signed-in basket

30 days from its last change.

Unfinished-basket copy

Until the order is placed, the basket is emptied, or you unsubscribe.

Sign-in devices

60 days from the last time the device was seen.

Failed sign-ins, rate limits

One day.

Messages and enquiries

For as long as the conversation they belong to is live, then on request.

Your choices and rights

• See and correct your details on your profile and address book.
• Stop offer emails at /unsubscribe, by unticking the box on your profile, or with the link in any reminder.
• Sign every device out of your account by changing your password.
• Ask for a copy, a correction or deletion of what we hold through our contact form, from the email address on your account. We will act within a month, keeping only what tax law obliges us to keep, and you may nominate someone to exercise these rights for you as the Act provides.
• Complain to us first, using the contact details above. If we do not resolve it, you may complain to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.
• Cookies: the Essential ones above are needed for the shop to work — blocking them in your browser stops the basket and sign-in from working. Analytics is optional: turn it off under Change your cookie choices and the shop works exactly the same.