Privacy & Data Policy

We ask you for more than most baby brands do — your baby’s age, their skin concern, your water hardness, sometimes a photograph of a rash. We think you are owed a plain explanation of what we do with all of it. This policy is written to be read, not to be survived.

The short version. We collect what we need to give you better advice and safer products. We never sell it, rent it, or hand it to advertisers. We do not build advertising profiles of you or your child. Health-related information about your baby is kept apart from anything to do with marketing. You can ask to see it, correct it, or have it deleted, and we will do that.

Kyndora Ventures Private Limited (“Tenderma”, “we”) is the Data Fiduciary. This policy is governed by the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

1. What we collect, and why

a) To reach you and send your order. Your name, email, mobile number, delivery address and pincode. Used to confirm your reservation, deliver your order, and reply to you. Pincode also drives the climate logic in Build a Plan.

b) To give you a routine that fits. When you use Build a Plan: your baby’s age or date of birth, whether they were born early, their skin concern, any relevant history you choose to share, your bathing habits and your tap water. Used to generate your plan and, in aggregate, to understand which concerns are common in which parts of India. Answering is optional; the tool works with less.

c) If something goes wrong. When you report a problem: the product, batch number, what happened, your baby’s date of birth and gestation, any photographs you attach, and our conversation with you. Used to help you, to investigate the batch, and — only with your explicit permission — to seek the opinion of the paediatric dermatologist who reviews our formulations. Keeping this record is also a legal obligation for a licensed cosmetic.

d) To find out whether it worked. A few weeks after delivery we may ask three short questions: did it improve, are you still using it, would you buy it again. Answering is entirely optional and refusing changes nothing. We ask because knowing what actually helped is how the next formulation gets better.

e) Automatically. Minimal session data — browser type, referring page, city-level location. Essential cookies only. No advertising trackers, no behavioural profiling.

2. Our lawful basis

Consent, taken separately for each purpose. Agreeing to receive your order updates does not sign you up for marketing. Agreeing to marketing does not permit us to share a health report with a clinician. Each is asked for on its own and each can be withdrawn on its own, without affecting the others. Where we must keep a record by law — tax invoices, product safety reports — we say so.

3. What we will never do

We will never sell, rent, licence or trade your personal data, for any sum, to anyone. We will never share it with advertising platforms or data brokers, including in hashed or anonymised form as an audience segment. We will never use your baby’s skin information to target advertising at you. We will never use your data to train an artificial intelligence system without asking you separately and plainly. We will never publish your report, photograph or review without your written permission.

If Tenderma is ever sold or merged, your data would transfer only to a buyer bound by these same commitments, and we would tell you before it happened.

4. Your baby’s data

Our products are for babies; our website is for parents and guardians aged 18 and over. Information about your child is always held as part of your account, never as a profile of the child. Under the DPDP Act we do not undertake behavioural monitoring of children and we do not direct advertising at them. We hold no more than we need: a date of birth to compute age accurately, a gestation category, and the specific concern you told us about.

Photographs you send with a report are treated as clinical material. They are stored with restricted access, are never publicly linked, are not used in marketing, and are shared with our reviewing dermatologist only when you have said we may.

5. Who else touches your data

Only the service providers who make the business run: Razorpay (payments — we never see or store your card details), Shiprocket (delivery and tracking), Zoho (invoicing, inventory and email), and our cloud hosting provider. Each is bound by a data-processing agreement. Health-related information — your skin plan answers and your reports — is not sent to marketing or analytics tools.

6. How long we keep it

Reservation and account data: while your account is active, and for one year after your last interaction unless you ask us to erase it sooner. Order and invoice records: as long as tax and company law requires. Problem reports and their attachments: for the shelf life of the batch plus three years, because product safety records must outlive the product. Skin plan answers: three years, or until you delete them. Marketing consent records: for as long as the consent stands, plus proof of withdrawal.

7. Your rights under the DPDP Act

You may ask us for a copy of everything we hold about you; correct anything wrong; erase your data; withdraw any consent; nominate someone to exercise these rights on your behalf; and raise a grievance. Write to our Grievance Officer using the details in the Grievance Redressal policy. We will acknowledge within 48 hours and resolve within 30 days. If we cannot do something you have asked, we will tell you why rather than ignore it.

Erasing your account does not remove a product safety report where the law requires us to retain it; in that case we de-identify it so it no longer points to you.

8. Keeping it safe

Data is encrypted in transit and at rest. Access is limited to named people who need it for their role, with health-related records restricted further. Every change to a report is logged with who made it and when. If a breach ever affects your data, we will notify you and the Data Protection Board as required, without waiting to be asked.

9. Changes to this policy

If we change how we use your data in any way that matters, we will tell you before it takes effect — not quietly update a page. The date at the top always reflects the current version.

Note: the Digital Personal Data Protection Rules are still being notified in stages. We will update consent-manager arrangements as those requirements come into force.