Privacy that reads like a promise, not fine print.

This Privacy Policy describes how Mumcure ("Mumcure", "we", "us", "our") handles your personal data when you visit our website at mumcure.in, browse or buy from our online stores, contact our support team, or otherwise engage with our brand. Mumcure is a Delhi-based skincare and haircare label operating under the promise "Cure That Cares."

For the purposes of India's data protection framework, Mumcure acts as a Data Fiduciary — the party that decides why and how your personal data is processed. Our registered contact details, and the details of the officer you can reach with any privacy concern, are set out in Section 17.

This policy applies to personal data we collect through mumcure.in (built on Odoo), our store on Shopify, our customer-support channels, and any campaigns or forms we run. It does not apply to third-party websites or services that we link to but do not control — see Section 9.

By using our website and services, or by giving us your information to place an order or make an enquiry, you consent to the collection and use of your personal data as described here. Where the law requires your specific, informed consent for a particular purpose (for example, marketing messages), we ask for it separately, and you can withdraw it as easily as you gave it.

A few terms recur throughout this policy. Here's what they mean:

We collect only what we need to run our store and serve you well. Broadly, this falls into the categories below.

We do not intentionally collect sensitive information beyond what you volunteer. Please share only the skin- or health-related detail you're comfortable providing; it always remains optional.

Your personal data reaches us in three ways:

• Directly from you — when you place an order, create an account, subscribe to our updates, take a product quiz, leave a review, or contact our team.
• Automatically — through cookies and similar technologies that record how you interact with our site, so pages load correctly and we can improve your experience.
• From trusted partners — such as our payment gateways (confirming a payment succeeded), our logistics partners (delivery updates), and analytics or advertising platforms that help us understand and reach our audience.

We use your personal data for clear, limited purposes:

• To fulfil your orders — processing purchases, arranging delivery, handling returns, refunds, and exchanges.
• To support you — answering questions, resolving issues, and keeping you updated on your orders.
• To personalise your experience — recommending products suited to your skin and hair, and remembering your preferences.
• To improve our products and website — understanding what works, fixing problems, and developing better formulations and content.
• To communicate with you — sending order confirmations, service notices, and, where you've opted in, offers and skincare tips.
• To keep our platform safe — detecting and preventing fraud, misuse, and security incidents.
• To meet legal obligations — including tax, accounting, consumer-protection, and other regulatory requirements.

We will not use your personal data for a new, unrelated purpose without letting you know and, where required, obtaining your consent.

Cookies are small files stored on your device that help our website function and help us understand how it's used. We use a few kinds:

• Essential cookies — needed for core features like your cart, checkout, and secure login. The site won't work properly without these.
• Analytics cookies — help us see which pages are popular and where visitors run into trouble, so we can improve.
• Preference cookies — remember choices such as your region or recently viewed products.
• Marketing cookies — used, where you allow them, to show you more relevant offers on our site and elsewhere.

You can control or clear cookies through your browser settings. Blocking some cookies may affect how parts of the site work. Where required, we'll ask for your consent to non-essential cookies through a banner when you first visit.

We do not sell or rent your personal data. We share it only where necessary to run our business and serve you, and only with parties bound to protect it:

• Payment partners — to process your payment securely.
• Logistics & courier partners — to pack and deliver your order and share delivery updates.
• Technology & hosting providers — such as our website and store platforms, which host our services and store data on our behalf.
• Communication & marketing tools — to send order updates and, where you've opted in, our newsletters and offers.
• Analytics & advertising platforms — to understand our audience and measure our campaigns.
• Professional advisers & authorities — where we're required by law, court order, or a valid request from a government or regulatory body, or to protect our rights, safety, and property.
• Business transfers — if Mumcure is involved in a merger, acquisition, or sale of assets, your data may transfer to the successor entity, subject to this policy.

Our website and communications may link to third-party sites, social platforms, or services we don't operate — for instance, a payment page, a review platform, or our social profiles. Once you leave our site, this policy no longer applies. We encourage you to read the privacy policy of any third party before sharing information with them.

We keep your personal data only for as long as we need it for the purposes described in this policy, or for as long as the law requires us to. Order, invoice, and tax records are retained for the periods set by applicable financial and regulatory rules. When data is no longer needed and there's no legal reason to keep it, we delete it or anonymise it so it can no longer identify you.

If you close your account or ask us to erase your data, we will do so, except where we must retain certain records to comply with the law, resolve disputes, or enforce our agreements.

We apply reasonable technical and organisational safeguards to protect your personal data against unauthorised access, alteration, disclosure, or loss. These include secured connections, access controls, and working only with reputable service providers who maintain their own security standards.

No method of transmission or storage is completely secure, so we can't guarantee absolute security. If a data breach affecting your personal data ever occurs, we will act promptly to contain it and will notify you and the relevant authority where the law requires, along with the steps you can take to protect yourself.

You hold meaningful control over your personal data. Subject to applicable law, you can exercise the following rights by contacting us using the details in Section 17:

To protect your data, we may need to verify your identity before acting on a request. We'll respond within the timelines the law prescribes. If you're not satisfied with how we've handled your concern, you may escalate it to the Data Protection Board of India once its grievance channels are operational.

Our products and website are intended for adults. We do not knowingly collect personal data from children under the age of 18 without verifiable consent from a parent or lawful guardian. If you are under 18, please use our site only with a parent's or guardian's involvement.

If we learn that we have collected a child's personal data without the required consent, we will delete it. If you believe a child has provided us data, please contact us using the details in Section 17 and we'll take prompt action.

Some of the service providers we rely on — for hosting, analytics, or communications — may store or process data on servers located outside India. Where your personal data is transferred abroad, we take steps to ensure it remains protected to a standard consistent with this policy and applicable Indian law, and we transfer it only to destinations not restricted by the Government of India.

With your consent, we may send you newsletters, product launches, offers, and skincare tips by email, SMS, WhatsApp, or other channels. You can opt out at any time by using the unsubscribe link in our emails, replying with the stated keyword to messages, updating your account preferences, or writing to us. Even if you opt out of marketing, we'll still send essential service messages about your orders and account.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or the law — including as the Digital Personal Data Protection Rules come fully into force. When we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you. We encourage you to review this page periodically.

If you have any question, request, or complaint about your personal data or this policy, please reach our Grievance Officer, who is designated to address privacy concerns in accordance with Indian law:

We aim to acknowledge every privacy request or grievance promptly and to resolve it within the timelines prescribed by law. If your concern remains unresolved, you may approach the Data Protection Board of India through its official channels.