Effective from: 18 October 2026. Last updated: 27 October 2026.
This policy explains what personal data we collect when you use myskinmatters.in, why we collect it, who we share it with, how long we keep it and what you can do about it. It is written to be read. If a sentence is unclear, write to us and we will explain it.
1.1 Who we are. This website is owned and operated by KIEVORA Private Limited, a company incorporated in India, with its office at First Floor, G-79, Ashok Vihar Phase-1 Road, New Delhi 110052. CIN U86901DC2026PTC473754. GSTIN 07AANCK1106B1Z2. In this policy, “SKIN MATTERS”, “we”, “us” and “our” mean KIEVORA Private Limited.
1.2 Our role. We decide why and how your personal data is processed on this website. Under the Digital Personal Data Protection Act 2023 (the “DPDP Act”) that makes us the Data Fiduciary and makes you the Data Principal. Under the Information Technology Act 2000 we are the body corporate responsible for your information.
1.3 The law we follow. This policy is written to meet:
1.4 What this policy covers. It covers personal data we process when you:
1.5 What it does not cover. It does not cover marketplaces or other websites where our product may be sold, or websites we link to. They have their own privacy policies. Read those before you share data with them.
1.6 Who can use this website. This website is meant for people in India who are 18 or older. See section 12 on children.
2.1 We collect only the data we need for the purposes in section 4. The table shows each category, what it includes and when we collect it.
| Category | What it includes | When we collect it |
|---|---|---|
| Account data | Name, email address, mobile number, password (stored in encrypted form), saved addresses | When you create or edit an account |
| Order data | Name, billing and delivery address, PIN code, mobile number, email address, items ordered, price paid, discount code used, invoice, delivery status, returns and refunds | When you place, change, cancel or return an order |
| Payment data | Payment method, transaction ID, payment status, last four digits of a card or a masked UPI ID where the gateway shares them, refund reference | When you pay or receive a refund. Collected through Cashfree Payments |
| Device and usage data | IP address, device type, operating system, browser, approximate location from IP address, pages viewed, links clicked, time on page, referring website, cookie and advertising identifiers | Automatically, when you browse. See our Cookie Policy |
| Skin quiz and guidance data | Your answers about skin type, skin concerns, current routine, climate and preferences, and the result we show you | Only if you take the skin quiz or ask for personal guidance |
| Support data | Emails and WhatsApp messages, call notes or recordings where we tell you a call is recorded, photos you send of a product or parcel, your order number | When you contact us |
| Reviews and photos | Your rating, review text, display name, city, skin type if you add it, and any photo or video you upload | When you submit a review |
| Marketing data | Your choices for marketing emails, and the date and source of your consent | When you sign up, change a preference or interact with a message |
| Business and job enquiries | Name, company, contact details, the content of your enquiry, your CV if you apply for a role | When you send a business or job enquiry |
| Privacy request data | The request you made, what we used to verify you and how we responded | When you use your rights under section 10 |
2.2 Card and bank details. We do not collect or store your full card number, CVV, card expiry, UPI PIN or net-banking password. You enter them on a page run by Cashfree, which processes them under its own security standards and privacy policy.
2.3 Sensitive personal data. We ask for as little of it as possible. What we may hold:
We use this data only for the purpose you gave it for.
2.4 Data we do not ask for. We do not ask for your Aadhaar number, PAN, passport or other government ID to shop with us.
2.5 Data about other people. If you order a gift for someone, please tell them first. We use their details only to deliver the gift.
2.6 If you choose not to give data. You can browse without an account. If you do not give the details marked as required at checkout, we cannot deliver an order to you. The skin quiz, reviews and marketing messages are optional.
2.7 Affiliate programme. If you apply to The Label Readers, our affiliate programme, we collect what you type in the application form: your name, email address, mobile number, city, where you share content, a link to your profile and the size of your audience, plus anything you choose to tell us about your audience. If you are approved, we also ask for a delivery address for the product we send you, and your PAN and UPI ID or bank details so that we can pay your commission and deduct tax as the law requires. We use this data only to review your application, run the programme, pay you and meet our tax obligations. We keep it while you are a member and afterwards for as long as tax and accounting law requires. The terms of the programme are on the affiliate programme page.
2.8 Refer a Friend. If you have an account, we create a personal referral code linked to it. When someone places an order with your code, we record that the order used it, and we show you their first name, last initial, order date and whether your reward is due, so that you can follow your referrals. To check that a referral is a first order, we compare the email address and phone number given at checkout with earlier orders. When someone opens a referral or affiliate link, their browser stores the code in a cookie for up to 30 days so that the discount applies in the cart; the cookie is removed once an order is placed. The referral terms are on the Offers page.
3.1 Directly from you. Most of what we hold is what you type or upload: at checkout, in your account, in the skin quiz, in a review, in a form or in a message to us.
3.2 Automatically from your device. When you browse, our website and the tools on it record technical data through cookies, pixels and similar technology. Cookies that are not strictly necessary run only if you allow them. Details are in our Cookie Policy.
3.3 From other parties. We receive limited data from:
3.4 We do not buy contact lists.
4.1 The DPDP Act allows us to process your personal data only for a lawful purpose, and only (a) with your consent or (b) for certain legitimate uses the Act lists. The table shows which applies to each purpose.
| Purpose | Data we use | Legal basis |
|---|---|---|
| Take, pack, dispatch and deliver your order; send order, dispatch and delivery updates | Order data, payment data, account data | Legitimate use: you gave us this data for this specific purpose and have not told us you object |
| Take payment and issue refunds | Order data, payment data | Legitimate use, as above |
| Create and run your account | Account data | Legitimate use, as above |
| Show you a skin quiz result or give personal guidance | Skin quiz and guidance data | Consent |
| Publish your review, photo or video on our website | Reviews and photos | Consent |
| Reuse your review or photo in our advertising, social media or emails | Reviews and photos | Separate consent, asked for at upload |
| Send offers, launches and skincare content by email | Marketing data, account data | Consent, given separately for each channel |
| Measure how the site is used and improve it | Device and usage data | Consent, through your cookie choices |
| Show our advertisements to you on other platforms and measure them | Device and usage data, marketing data and, for orders, your contact details in hashed form (see 6.6) | Consent, through your cookie choices |
| Handle a product safety report, such as a skin reaction | Support data, order data, batch number | Legitimate use for the complaint you raised; and compliance with law where a record or report is required |
| Keep invoices and tax, accounting and consumer-law records | Order data, payment data | Compliance with law |
| Respond to a lawful order or request from a court or authority | Whatever the order requires | Compliance with law |
| Keep the website secure, and detect and prevent fraud and misuse | Device and usage data, order data, account data | Consent given with this notice, and compliance with our legal duty to keep data secure |
| Establish, exercise or defend legal claims | Relevant records | Compliance with law, and the exemptions the DPDP Act provides for enforcing legal rights |
| Respond to business and job enquiries | Business and job enquiries | Legitimate use: you gave us this data for this specific purpose |
4.2 What “consent” means here. We ask with a clear, separate request. Boxes are never ticked for you. You can say no and still shop with us. You can withdraw consent at any time, as easily as you gave it. See section 10.
4.3 What “legitimate use” means here. The DPDP Act lets us process data that you voluntarily give us for a specific purpose, where you have not told us that you do not consent. Placing an order is the main example.
4.4 No surprises. We will not use your data for a new purpose that is not in this table without telling you first and, where the law requires it, asking for your consent.
4.5 Automated decisions. We do not make decisions about you by automated means alone that have a legal or similarly significant effect on you. The skin quiz result is a suggestion based on your answers. It is not a medical assessment.
5.1 Two kinds of message. We send:
5.2 How we ask. We ask for marketing consent separately from the order, with boxes that are not ticked in advance. Saying no does not affect your order or your price.
5.3 How to stop.
| Channel | How to opt out |
|---|---|
| Click “Unsubscribe” at the bottom of any marketing email | |
| SMS | Reply STOP to the message, or use the opt-out instruction in it |
| Reply STOP, or block the business number in WhatsApp | |
| All channels at once | Use the form at Privacy Requests and Consent, or write to contact@myskinmatters.in |
5.4 How fast. We act on an opt-out within 7 working days. A message already scheduled may still reach you in that time.
5.5 What we keep after you opt out. We keep your contact on a “do not contact” list, so that we do not message you again by mistake.
5.6 SMS and calls. Commercial SMS and calls in India are regulated by the Telecom Regulatory Authority of India. We send promotional SMS only through registered channels and only to people who have opted in.
5.7 Advertising on other platforms. If you allow marketing cookies, we use the Meta Pixel, the Meta Conversions API and Google Ads conversion tracking to show you our advertisements on Meta and Google platforms and measure whether they worked. Section 6.6 explains what is sent. You can turn this off under “Cookie settings” in the footer of this website at any time.
6.1 We do not sell your personal data. We share it only with the parties below, and only as much as each one needs.
| Who | What they receive and why |
|---|---|
| Website platform and hosting: WordPress and WooCommerce | All data on the website is stored and processed on this platform so that the shop can run |
| Payment gateway: Cashfree Payments | Your name, contact, order value and the payment details you enter, to take payment and issue refunds |
| Courier and logistics partners: our courier partners | Your name, delivery address, PIN code, mobile number, to deliver and return parcels |
| Our manufacturer | For a product quality complaint: the batch number, your description and photos. We remove your name and contact details unless they are needed to investigate |
| Professional advisers and auditors | Records they need to advise us or audit our accounts, under a duty of confidentiality |
| Advertising platforms: Meta (Facebook, Instagram) and Google (Google Ads) | Only if you allow marketing cookies: the pages you view and actions you take on our website, order value and products, your IP address, browser details and advertising cookie identifiers, and, when you place an order, your contact details in hashed form (see 6.6). They use it to measure our advertisements and show them to people likely to be interested |
| Courts, regulators, law enforcement and other authorities | What we are required to disclose by law or by a lawful order |
| A buyer or successor of our business | If the business or its assets are merged, sold or restructured, your data may pass to the new owner, who must continue to honour this policy |
6.2 Our Data Processors. Companies that process data for us do so under a contract. The contract requires them to use the data only on our instructions, keep it secure, keep it confidential and delete or return it when the work ends.
6.3 Independent recipients. The payment gateway, courier companies, and advertising and social media platforms also process data for their own purposes, under their own privacy policies. We recommend you read them.
6.4 Public content. A review, display name, city or photo that you submit for publication is visible to anyone who visits our website. Do not put anything in a review that you want to keep private.
6.5 Asking who has your data. You can ask us for the identities of the Data Fiduciaries and Data Processors we have shared your data with, and a description of what was shared. See section 10.
6.6 Advertising tools and hashed contact data. If you allow marketing cookies (called “Advertisement” in the cookie banner), we use the Meta Pixel, the Meta Conversions API, which sends the same events from our server, and Google Ads conversion tracking with enhanced conversions. When you place an order, we send Meta your email address, mobile number, name, city, state, PIN code and country, and Google your email address, mobile number and name, all converted by SHA-256 hashing into codes that cannot practically be turned back into your details. Google also receives your PIN code and country. Meta and Google match these codes against their own users to measure which advertisements led to a sale. We never send your street address or payment details. If you do not allow marketing cookies, none of this is sent. The full list of tools and cookies is in our Cookie Policy.
7.1 We are based in India and sell only in India. Some of our service providers may store or process data on servers outside India. This applies mainly to our website platform and email tools and, if you allow marketing cookies, to Meta and Google.
7.2 The DPDP Act allows personal data to be transferred outside India, except to any country or territory that the Central Government restricts by notification. We do not transfer your personal data to a restricted country or territory.
7.3 When your data is processed outside India, we require the provider, by contract, to protect it to a standard no lower than this policy and Indian law require.
7.4 Where the SPDI Rules apply, we transfer sensitive personal data outside India only where it is necessary to perform our contract with you or where you have consented, and only to a recipient that keeps the same level of data protection that we do.
8.1 We keep personal data only for as long as the purpose needs it, or for as long as a law requires us to keep it, whichever is longer. Then we delete it or make it anonymous.
| Data | How long we keep it | Why |
|---|---|---|
| Account data | Until you delete your account, or after 3 years without a login or order | To run your account |
| Order data, invoices and payment references | 8 years from the end of the financial year of the order | Tax, accounting and company-law record keeping |
| Support data | 3 years from the date your query is closed | To deal with follow-ups, disputes and consumer-law claims |
| Product safety reports | As long as product safety and regulatory rules require | Product safety and regulatory records |
| Skin quiz and guidance data | Until you withdraw consent, or 24 months after you gave it, whichever is earlier | To show and improve your result |
| Reviews and photos | For as long as they are published. Removed within 7 working days of your request | To display your review |
| Marketing data | Until you opt out. After that we keep only a “do not contact” record | To send what you asked for, and to honour your opt-out |
| Business and job enquiries | 12 months from the last contact | To respond and to consider you for the role |
| Device and usage data | As set out for each cookie in the Cookie Policy | Analytics and advertising |
| Security and access logs | 1 year or longer where the law requires | Security and legal compliance |
| Privacy request data | 3 years from the date the request is closed | To show that we handled your request properly |
8.2 When you withdraw consent or ask for deletion. We stop the processing and erase the data, and ask our Data Processors to do the same, unless a law requires us to keep it. Invoices are the main example: we must keep them for tax purposes even if you close your account.
8.3 Backups. Deleted data may remain in secure backups for a short period until the backup is overwritten on its normal cycle. We do not use backup copies for any other purpose.
8.4 Anonymous data. Data that can no longer identify you, such as total orders per month, is not personal data. We may keep it.
9.1 We use reasonable security safeguards to prevent a personal data breach, as the DPDP Act and the SPDI Rules require. These include:
9.2 No system is perfectly secure. We cannot promise that a breach will never happen. We can promise to act quickly and honestly if one does.
9.3 If there is a personal data breach. We will inform each affected person and the Data Protection Board of India, in the manner and within the time the law requires. We will tell you what happened, what data was involved, what we are doing about it and what you can do to protect yourself. We will also report to the Indian Computer Emergency Response Team (CERT-In) where the law requires it.
10.1 You have the following rights over your personal data. They are free to use.
You can ask us to confirm whether we process your personal data, and to give you a summary of the data and of what we do with it. You can also ask for the identities of the Data Fiduciaries and Data Processors we have shared it with.
If your data is inaccurate, incomplete or out of date, you can ask us to fix it. You can edit most account details yourself after you log in.
You can ask us to delete your personal data. We will delete it unless we need to keep it for the purpose it was collected for, or a law requires us to keep it. Section 8 explains what we must keep.
Where we rely on your consent, you can withdraw it at any time. Withdrawing is as easy as giving it. It does not affect anything we did lawfully before you withdrew. Some things will stop working as a result: for example, we cannot show a saved quiz result without the quiz answers.
You can name another person who may use these rights for you if you die or become unable to act.
You can complain to our Grievance Officer about how we handle your data or how we handled a request. Details are in section 15.
If you have used our grievance process and are not satisfied, you can take your complaint to the Data Protection Board of India, in the manner the law prescribes.
10.2 Reviewing sensitive data. Under the SPDI Rules, you can also ask to review the information you have given us and have anything inaccurate or deficient corrected.
10.3 Consent Managers. Where the law allows it, you may also give, manage, review or withdraw consent through a Consent Manager registered with the Data Protection Board of India.
11.1 How to ask. Use the form at Privacy Requests and Consent. You can also write to contact@myskinmatters.in, marked for the Grievance Officer if you prefer. Tell us which right you want to use and the email address or mobile number linked to your orders.
11.2 Verification. We need to be sure we are dealing with the right person before we share or delete anything. We will contact you at the email address or mobile number we already hold for you, to confirm the request. We may ask for an order number. We will not ask for a government ID unless there is no other way to confirm who you are.
11.3 Timelines. We acknowledge a request within 48 hours and complete it within 30 days of verification. If a request is complex and needs longer, we will tell you why and when you can expect a reply.
11.4 Cost. We do not charge for a request.
11.5 When we may say no. We may decline a request, in full or in part, where the law allows it. For example: where we cannot verify you, where the data must be kept by law, where it is needed for a legal claim, or where giving it would reveal another person’s data. If we decline, we will tell you the reason.
11.6 Your responsibilities. The DPDP Act also places duties on you. Please:
12.1 This website is for people aged 18 and over. Under the DPDP Act, anyone under 18 is a child.
12.2 We do not knowingly collect the personal data of a child without the verifiable consent of a parent or lawful guardian. If you are under 18, please do not create an account, place an order, take the skin quiz or sign up for messages. Ask a parent or guardian to do it in their own name.
12.3 We do not track children, monitor their behaviour or direct targeted advertising at them.
12.4 If you are a parent or guardian and believe your child has given us personal data, write to contact@myskinmatters.in. Once we have confirmed the facts, we will delete the data, unless a law requires us to keep it.
12.5 If we learn that we have collected a child’s data without verifiable parental consent, we will delete it without waiting to be asked.
12.6 The same care applies to a person with a disability who has a lawful guardian. In that case we need the guardian’s verifiable consent.
13.1 Cookies. Cookies are small text files that a website saves on your device. We use strictly necessary cookies to make the shop work. We use preference, analytics and marketing cookies only if you allow them. You can change your choice at any time under “Cookie settings” in the footer. The full list is in our Cookie Policy.
13.2 Other websites. Our website may link to social media platforms, marketplaces, courier tracking pages and payment pages. Once you leave myskinmatters.in, this policy no longer applies. We are not responsible for how those websites handle your data.
13.3 Social media. If you tag us, message us or comment on our posts, the platform’s own privacy policy applies to that content. We may reply to you there. We will ask before we reuse your content.
14.1 We may update this policy when the law changes, when we add a feature or when we change a service provider.
14.2 The date at the top of this page shows when it was last updated.
14.3 If a change is significant, such as a new purpose or a new type of recipient, we will tell you before it takes effect, by email or by a notice on this website. Where the law requires fresh consent, we will ask for it. We will not rely on your silence.
14.4 You can ask us for an earlier version of this policy by writing to contact@myskinmatters.in.
14.5 Language. This policy is written in English. You can ask for it in Hindi or another language listed in the Eighth Schedule to the Constitution of India. If versions differ, the English version applies.
15.1 For any privacy question or complaint, contact our Grievance Officer. This person also answers questions about how we process your personal data.
15.2 What to send. Your name, the email address or mobile number linked to your account or order, and a short description of the problem. Please do not send card details or passwords.
15.3 Timelines. We acknowledge a complaint within 48 hours and resolve it within 30 days of receiving it.
15.4 If you are not satisfied. After you have used our grievance process, you may complain to the Data Protection Board of India. You also keep any other remedy you have under the Consumer Protection Act 2019 and other laws.
15.5 General support. For order questions that are not about privacy, write to contact@myskinmatters.in or see Contact Us. Our full complaints process is at Grievance Redressal.
15.6 Governing law. This policy is governed by the laws of India. Subject to your rights under the DPDP Act and consumer law, the courts at New Delhi have jurisdiction over any dispute about it. This policy is to be read with our Terms & Conditions.
Email the Grievance Officer: contact@myskinmatters.in