Last updated 24 October 2026
Privacy policy
This notice explains what personal data ANAA Coffee (“we”) collects, why, who handles it, and your rights under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. For this data, we are the data fiduciary: we decide how it's used.
What we collect and why
| Data | When | Why | How long we keep it |
|---|---|---|---|
| Name, mobile number, email (optional), delivery address, and the items you choose | When you tap Send order on WhatsApp. The website saves the order at that moment, even if you then don't send the message. | To confirm, deliver and invoice your order, and to help with any problem | For paid orders, as long as GST and income-tax law require us to keep records (currently up to 8 years). Order requests that never go ahead are deleted within 12 months. |
| Payment reference (UPI or bank transaction ID) | When you pay | To match payments and refunds | As for paid orders |
| Your WhatsApp number and messages | When you message us: orders, subscription requests, “notify me” for drops, wholesale enquiries | To reply, and to send the updates you asked for | Until you ask us to delete them, unless they're part of an order record |
| Technical data such as IP address and browser type | When you visit the site | Logged automatically by our hosting provider to keep the site secure and working | Under our hosting provider's retention settings, usually a few days |
We don't collect card details, and we don't use advertising or analytics tracking.
Who handles it for us
- Sanity (Sanity Inc.), which stores our order records and website content.
- Vercel (Vercel Inc.), which hosts the website.
- WhatsApp (Meta Platforms), which carries the messages you send us.
- GoDaddy, which provides our email.
- Courier companies, which receive your name, phone and address to deliver your parcel.
- Government authorities, where the law requires it.
Some of these companies store data on servers outside India, including in the United States and Europe. The DPDP Act allows this except to countries the Government of India restricts, and we use providers that protect data with industry-standard security. We do not sell your data.
Cookies and storage
The site uses only what it needs to work. Your cart is kept in your own browser's local storage, not on our servers. If we ever add analytics or advertising, we'll ask for your consent first.
Children
The site isn't meant for anyone under 18. We don't knowingly collect their data without a parent's or guardian's consent; if you think we have, contact us and we'll delete it.
Your rights
- Ask for a summary of the personal data we hold about you and who we've shared it with.
- Ask us to correct, complete or update it.
- Ask us to delete data we no longer need. We keep order records while the law requires it.
- Withdraw consent for updates or messages at any time. Reply “stop” on WhatsApp, or leave our community.
- Nominate someone to exercise these rights for you if you die or can't act yourself.
- Complain to us, and then to the Data Protection Board of India if you're not satisfied.
Security
The site is served over HTTPS, order records are only visible to people signed in to our order system, and access is limited to people who need it. If a breach affects your data, we'll tell you and the Data Protection Board as the law requires.
Contact and complaints
Email support@anaacoffee.in with any privacy question or complaint. We acknowledge within 48 hours and resolve it within 30 days.
Changes
We'll update this notice if how we use data changes. The date at the top shows when it last changed.