Last updated: September 3, 2026

Tea Stories operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the “Services”). Tea Stories is powered by Shopify, which enables us to provide the Services to you. This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase or other transaction using the Services or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described in this Privacy Policy.

---

Personal Information We Collect or Process

When we use the term “personal information,” we are referring to information that identifies or can reasonably be linked to you or another person. Personal information does not include information that is collected anonymously or that has been de-identified. We may collect or process the following categories:

• Contact details — name, address, billing/shipping address, phone number, and email address.
• Financial information — credit/debit card numbers, payment card information, transaction details, and payment confirmation.
• Account information — username, password, security questions, preferences and settings.
• Transaction information — items you view, add to cart, wishlist, purchase, return, or cancel.
• Communications with us — information you include in customer support inquiries or other messages.
• Device information — device type, browser, network connection, IP address, and unique identifiers.
• Usage information — how and when you interact with or navigate the Services.

---

Personal Information Sources

We may collect personal information from the following sources:

• Directly from you — when you create an account, visit or use the Services, or communicate with us.
• Automatically through the Services — from your device via cookies and similar technologies.
• From our service providers — when they collect or process your personal information on our behalf.
• From our partners or other third parties.

---

How We Use Your Personal Information

• Provide, Tailor, and Improve the Services — process payments, fulfil orders, manage your account, arrange shipping, handle returns, and personalise your experience.
• Marketing and Advertising — send promotional communications by email, text, or post, and show relevant online advertisements.
• Security and Fraud Prevention — authenticate your account, detect fraudulent or malicious activity, and secure our services.
• Communicating with You — provide customer support and maintain our business relationship.
• Legal Reasons — comply with applicable law, respond to legal process, and enforce our terms and policies.

---

How We Disclose Personal Information

We may disclose your personal information to third parties in the following circumstances:

• With Shopify, vendors, and third parties who perform services on our behalf (IT management, payment processing, data analytics, cloud storage, fulfilment, and shipping).
• With business and marketing partners for advertising purposes. Partners use your information per their own privacy notices.
• When you direct us or consent to disclose information to third parties (e.g. shipping providers or social media integrations).
• With our affiliates or within our corporate group.
• In connection with a business transaction, legal obligation, enforcement of policies, or to protect our rights and those of our users.

---

Relationship with Shopify

The Services are hosted by Shopify. Information you submit will be transmitted to and shared with Shopify and third parties for the purpose of providing and improving the Services. In certain circumstances, Shopify is the data controller responsible for responding to your privacy requests. To learn more, visit the Shopify Consumer Privacy Policy or exercise rights via the Shopify Privacy Portal.

---

Third Party Websites and Links

The Services may link to third-party websites. We are not responsible for the privacy or security of those sites. Review their policies independently before sharing any information.

---

Children’s Data

The Services are not intended for children under 18. We do not knowingly collect or process personal data of children without verifiable consent from a parent or lawful guardian.

Under India’s Digital Personal Data Protection Act, 2023, if we become aware that we have collected a child’s data without verified parental consent, we will promptly erase it. We do not engage in behavioural monitoring, tracking, or targeted advertising directed at children.

If you are a parent or guardian and believe your child has provided us information without consent, contact us at hello@tstories.in and we will delete it within 30 days.

---

Security and Retention of Your Information

No security measures are perfect or impenetrable. We recommend you do not use unsecure channels to communicate sensitive information to us.

How long we retain your personal information depends on factors such as whether we need it to maintain your account, provide the Services, comply with legal obligations, resolve disputes, or enforce our contracts.

Where you withdraw consent or the purpose for collection is fulfilled, we will erase your personal data unless retention is required by applicable law.

---

Your Rights and Choices

Depending on where you live, you may have some or all of the following rights. These rights are not absolute and may apply only in certain circumstances.

• Right to Access / Know — request access to personal information we hold about you.
• Right to Delete — request deletion of personal information we maintain about you.
• Right to Correct — request correction of inaccurate personal information.
• Right of Portability — receive a copy of your personal information and request transfer to a third party.
• Marketing Opt-Out — unsubscribe from promotional emails at any time using the unsubscribe link in our emails.

We will not discriminate against you for exercising any of these rights. We may need to verify your identity before processing requests. To exercise your rights, contact us using the details in the Contact section below.

---

Your Rights Under India’s Digital Personal Data Protection Act, 2023

If you are located in India, the Digital Personal Data Protection Act, 2023 (“DPDPA”) grants you the following rights as a Data Principal:

• Right to Access Information — obtain a summary of personal data we process about you and the related processing activities.
• Right to Correction and Erasure — correct inaccurate or misleading data and erase data that is no longer necessary or where you have withdrawn consent.
• Right to Grievance Redressal — have grievances addressed within 30 days. If unresolved, escalate to the Data Protection Board of India at www.meity.gov.in.
• Right to Nominate — nominate another individual to exercise your DPDPA rights in the event of your death or incapacity. Contact us to register a nominee.
• Right to Withdraw Consent — withdraw consent at any time. We will cease processing and erase your data within 30 days, except where retention is legally required. Email hello@tstories.in to withdraw.

---

Personal Data Breach

In the event of a personal data breach likely to result in risk to your rights or interests, we will notify you and the Data Protection Board of India within the timelines prescribed under the DPDPA. Notification will include the nature of the breach, categories of data affected, and steps taken to address it.

---

Grievances and Complaints

For any grievance relating to the processing of your personal data, or to exercise rights under the DPDPA, please contact our Grievance Officer:

We will acknowledge your grievance within 48 hours and resolve it within 30 days.

If not satisfied with our response, you may lodge a complaint with the Data Protection Board of India at www.meity.gov.in. Users in the EEA or UK may also approach their local data protection authority.

---

International Transfers of Personal Data

For users in India: Transfers of your personal data outside India are subject to the DPDPA. We transfer your personal data only to countries or territories permitted under applicable Indian law, including any notifications issued by the Central Government under the DPDPA. Transfers to Shopify and its sub-processors are made under appropriate data processing agreements.

For users in the EEA or UK: We rely on recognised transfer mechanisms such as the European Commission’s Standard Contractual Clauses, or equivalent UK contracts, unless the destination country has an adequacy decision.

---

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for legal or regulatory reasons. We will post the revised Policy on this page and update the “Last updated” date.

---

Contact

For questions about this Privacy Policy or to exercise any of your rights, contact us: