How we handle your data

Who we are

Shankar Jewellers is a retail jewellery business at CR Road, below Indian Overseas Bank, Raniganj – 713347, District Paschim Bardhaman, West Bengal, India.

We operate the website shankarjewellers.in and publish the Shankar Jewellers Raniganj Android app. For the purposes of India’s Digital Personal Data Protection Act, 2023, we are the Data Fiduciary — the party responsible for the personal data described here and the one you should approach with any question about it.

What we collect

It depends entirely on what you do. Reading is anonymous; everything else is something you choose to give us.

a. If you only browse or check the rate

• In the app: nothing personal at all. Gold and silver rates are public information and are fetched without identifying you.
• On the website: our host, Cloudflare, processes your IP address, browser type and the page requested in order to deliver the page and to block attacks. We also use Cloudflare Web Analytics, which counts page views without cookies and without following you to other websites.

b. If you send us an enquiry — through the contact form on either the website or the app — we receive the name, mobile number and message you type. Nothing is sent until you press Send. If you never use the form, we never receive any of this.

c. If you buy from us in the shop. When we prepare your bill we record the details a jeweller is required to keep: your name, mobile number and address, the items purchased with their weights, purity and price, and — only where tax law requires it for a purchase of that value — your PAN or Aadhaar number. These bills are kept in our own billing system and are used to issue your invoice, to honour it afterwards, and to meet our tax and accounting obligations.

d. If you work for us. Staff have individual logins. We keep a record of which staff account performed which action in the billing system, so that mistakes can be traced and corrected.

What we do not collect

The app does not ask for and cannot access your location, contacts, camera, photos, microphone, call logs or files, and it contains no advertising network and no analytics or tracking SDK. Neither the app nor the website has a customer login, so there is no customer account, password or profile to be breached.

We do not build a profile of you, we do not track you across other apps or websites, and we never sell, rent or trade personal information to anyone. We do not use your details for unrelated marketing.

Why we use it

• Enquiries — so someone from the shop can read your message and reply, usually by phone or WhatsApp.
• Bill records — to issue and honour your invoice, to handle repairs, exchanges and warranty questions, and because tax and accounting law requires us to keep them.
• Returning customers — when a colleague types a mobile number to start a new bill, our system may fill in the name and address from that customer’s previous purchase, so you are not asked for the same details twice. It uses only bills we have already issued. Your PAN or Aadhaar number is never filled in this way.
• Website and app operation — to serve pages, show the current rate, keep the site secure and understand roughly how many people visit.

Notifications, and why we hold no device token

The app can notify you when the gold or silver rate changes. This is optional and you can decline it or turn it off later in Android Settings.

Notifications are delivered using Firebase Cloud Messaging topic messaging: the app subscribes to a general topic named rates, and we publish to that topic. We never receive, store or record your device’s registration token, and we hold no list of who has the app installed. We cannot send a notification to one particular device, and we cannot tell who you are from a notification.

Cookies and browser storage

We set no advertising or tracking cookies, and the website shows no cookie banner because there is nothing to consent to for our own use.

• Cloudflare may set a security cookie to distinguish real visitors from automated traffic.
• Google Maps sets its own cookies when the embedded map on our contact section loads.
• Staff pages use your browser’s local storage to keep a member of staff signed in during their shift. This applies only to employee logins, never to customers.

Who else is involved

We keep the list of service providers deliberately short, and each receives only what it needs:

• Supabase — hosts the database holding submitted enquiries, our bill records and the published gold and silver rates.
• Cloudflare — hosts and delivers the website, protects it from attack, and provides the cookieless visit counts described above.
• Google Firebase Cloud Messaging — delivers the app’s rate notifications.
• Google Fonts — supplies the typefaces used on the website. Your browser requests them from Google, which means Google receives your IP address when a page loads.
• Google Maps — provides the embedded map showing our showroom. Google receives your IP address when that map is displayed.

Each is bound by its own privacy terms. We may also disclose information where the law of India requires it of us.

Where your data is stored. Our database is hosted by Supabase on Amazon Web Services infrastructure in the Asia Pacific (Sydney) region, Australia. Cloudflare and Google also operate globally distributed networks. Your information therefore leaves India. It is transferred only for the purposes described in this policy, is protected by encryption in transit, and the transfer is permitted under the Digital Personal Data Protection Act, 2023.

What stays on your device

So the app is usable on a weak signal, it saves a little data locally: the gold and silver rates it last saw with their update time, and a note of whether you have dismissed the notification prompt. This never leaves your phone, and uninstalling the app removes it.

Permissions the app requests

That is the complete list. The app requests no other permission.

How long we keep it

Anything the app keeps on your own phone is described in section 08, and uninstalling removes it.

How we protect it

All traffic to our website, our app and our database travels over encrypted HTTPS connections. Access to bills, enquiries and stock is restricted to signed-in staff, and each employee is given only the access their job needs — some can view records without being able to change them. Those limits are enforced by the database itself, not merely hidden in the screen, so they hold even if someone reaches the data another way. We also keep a short internal record of which staff account performed which action, for 90 days, so that a mistake can be traced and put right.

No system is perfectly secure. If a breach ever affects your personal data, we will inform you and the Data Protection Board of India as the law requires.

Your rights

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• Ask what we hold about you, and how it has been used and shared.
• Have it corrected if it is wrong, incomplete or out of date.
• Have it erased, unless we are required by law to keep it — a tax invoice, for example, cannot be deleted on request.
• Withdraw consent you previously gave, as easily as you gave it.
• Nominate another person to exercise these rights on your behalf if you die or become incapacitated.
• Complain to us, and afterwards to the Data Protection Board of India if you are not satisfied.

To exercise any of these, see section 13, write to burmanabhijit18@gmail.com, or use the contact details below, quoting the mobile number you gave us so we can find your record. We will respond as promptly as we reasonably can. There is no charge.

You may also delete the app at any time, which stops all notifications and removes everything it had stored on your phone.

How to delete your data

There are two ways, and you do not need an account for either:

• Email burmanabhijit18@gmail.com asking us to delete your details.
• Use the enquiry form on our website or in the app, and write “please delete my details” in the message.

Either way, please include the mobile number you gave us — it is how we find your record. There is no charge, and you do not have to give a reason.

What we delete: your enquiry messages, and your name, address and contact details wherever we are not required by law to keep them.

What we cannot delete: a tax invoice. The law requires us to keep bills for six years, so a purchase record cannot be erased on request — but we will stop using it for anything beyond that legal obligation.

We act on requests as soon as we can, and within 30 days at the latest. If you are not satisfied with how we handled it, you may complain to the Data Protection Board of India.

Children

Our website and app are meant for adults shopping for jewellery and are not directed at children. Indian law treats anyone under 18 as a child, and we do not knowingly collect a child’s personal data without the verifiable consent of a parent or guardian. We do not profile children or send them advertising. If you believe a child has sent us an enquiry, tell us and we will delete it.

Changes to this policy

If we change how we handle personal data, we will update this page and revise the effective date shown above. Continuing to use the website or the app after a change means the revised policy applies.

Contact us

For any question about this policy, or to exercise any of the rights in section 12, contact our Grievance Officer: