1. Scope and who we are

9XO is an India-based online store for personalized and custom gifts, including photo mugs, cushions, photo frames, LED mirrors, keychains, mobile covers, plaques, and related products. In this policy, “9XO”, “we”, “us”, and “our” refer to the operator of this website and store.

This policy applies to personal data processed through the 9XO website, WooCommerce store, customer account area, Help Center, and communications connected with your order. It is intended to be read consistently with India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”), the Information Technology Act, 2000, and applicable rules, as they come into force or are amended.

2. Personal data we collect

Account and identity information

When you create an account or place an order, we may collect your name, email address, mobile number, username, password in encrypted form, billing and delivery addresses, and account preferences.

Order and transaction information

We collect product selections, personalization instructions, order value, applied offers, invoice details, payment status, shipment details, returns or support history, and related correspondence. We may retain tax and accounting records where required by law.

Payment information

Payments may be offered in INR through third-party payment gateways supporting methods such as UPI, Visa, Mastercard, and PayPal. The gateway receives the payment credentials needed to process your transaction. 9XO does not store full card numbers, CVV codes, UPI PINs, or online-banking passwords. We may receive a transaction reference, payment method, status, and limited billing information from the gateway.

Personalization content

We collect the photos, images, names, messages, design choices, and instructions you upload or provide so that we can create your custom product. An uploaded image may contain personal data about you or another person.

Device, usage, and cookie data

Our systems may automatically receive your IP address, browser and device type, operating system, referring page, pages viewed, approximate location derived from IP, session identifiers, cart activity, and diagnostic or security logs. We collect this through essential cookies and, where used, analytics or similar technologies.

Communications

We collect information you provide when contacting the Help Center, responding to an order message, requesting support, submitting a grievance, or communicating with us through email, phone, WhatsApp, or social channels.

3. Uploaded photos and personalization files

We use uploaded photos and personalization files solely to review the order, prepare the design, manufacture or print the product, perform quality checks, deliver the order, and resolve order-related support issues. We do not sell customer-uploaded photos or use them for unrelated advertising.

Access is limited to personnel and production partners who need the files to fulfil the order. Files may be resized, cropped, colour-adjusted, or otherwise technically processed according to your instructions and the product’s print area.

Before uploading an image of another person, you should have their permission and the legal right to provide it to us. Please avoid uploading unnecessary sensitive information, identity documents, financial information, or images containing embedded location data.

4. How and why we use personal data

We process personal data for the following purposes:

• to operate the store, authenticate accounts, maintain carts, and provide requested services;
• to create previews, manufacture personalized products, process orders, and arrange delivery;
• to process payments, issue invoices, detect fraud, and maintain transaction records;
• to send order confirmations, production updates, shipping notifications, and service messages;
• to respond to questions, complaints, rights requests, and return or replacement claims;
• to secure, troubleshoot, analyse, and improve our website, products, and customer experience;
• to comply with tax, accounting, consumer-protection, law-enforcement, and other legal obligations; and
• to send promotional communications where permitted and, where required, with your consent. You can opt out of marketing messages without affecting transactional order messages.

Under the DPDP Act, processing may be based on your consent or on certain legitimate uses permitted by law. You may withdraw consent using the same general channel through which you provided it or by contacting us, although withdrawal does not affect processing already lawfully completed or records we must retain.

5. Cookies, analytics, and social features

Essential cookies keep the store working—for example, by maintaining your cart, session, login, security settings, and checkout flow. Preference cookies may remember choices. Analytics technologies, when enabled, help us understand traffic and improve performance. You can control non-essential cookies through any cookie controls we provide and through your browser settings; blocking essential cookies may prevent account, cart, or checkout features from working.

Pages may include links, pixels, videos, or embedded features from third parties such as Instagram, Facebook, YouTube, WhatsApp, analytics providers, or payment services. Those parties may collect information under their own privacy policies. A link to a third-party service does not mean that 9XO controls that service’s data practices.

6. When we share personal data

We share only what is reasonably necessary with service providers acting for us or providing their own regulated services, including:

• payment gateways and fraud-prevention providers to authorise and reconcile payments;
• printing, manufacturing, packaging, and quality-control partners to produce customized items;
• courier, logistics, and address-verification partners to deliver orders across India;
• website hosting, cloud storage, email, communications, analytics, security, and technical-support providers;
• professional advisers, auditors, insurers, regulators, courts, or law-enforcement bodies where required or permitted by law; and
• a successor in a merger, reorganisation, sale, or transfer of the business, subject to appropriate safeguards.

We do not sell or rent personal data. Some providers may process data outside your state or outside India. Where cross-border processing occurs, we use providers and safeguards consistent with applicable Indian law and any government restrictions.

7. Data security

We use reasonable technical and organisational safeguards appropriate to the nature of the data, including access controls, role-based permissions, encrypted connections where supported, password hashing, software updates, logging, backups, and restricted production-file access. Payment credentials are handled by payment gateways rather than stored by 9XO.

No online system is completely secure. You are responsible for keeping your account password confidential and for notifying us promptly if you suspect unauthorised account use.

8. How long we retain information

We keep data only as long as needed for the purposes described above. Retention depends on the record: account information is generally kept while the account remains active; order, invoice, payment-reference, and tax records are retained for the period required under applicable tax, accounting, and limitation laws; support and security records are kept for a reasonable period to resolve issues and prevent abuse; and personalization files follow the shorter period described in Section 3.

When retention is no longer necessary, we delete, anonymise, or securely isolate the data, subject to normal backup cycles and legal holds.

9. Your choices and rights

Subject to applicable law and appropriate identity verification, you may ask us to:

• confirm whether we process your personal data and provide a summary of that processing;
• correct, complete, or update inaccurate or incomplete personal data;
• erase personal data that is no longer needed or for which consent has been withdrawn, unless retention is legally permitted or required;
• withdraw consent or opt out of direct marketing;
• receive information about processors or other parties with whom your data has been shared, where the law requires it; and
• raise a grievance and, if unresolved, pursue remedies available under applicable law.

You may update certain account details through “My account”. For other requests, use the Help Center. We may ask for information needed to verify that the request relates to you. You may also nominate another individual to exercise rights on your behalf in the event of death or incapacity, where provided by the DPDP Act.

10. Children’s data

Our store is intended for adults who can enter into a contract. A person under 18 should use the store only with the involvement and consent of a parent or lawful guardian. We do not knowingly seek to profile children or target behavioural advertising to them. If you believe a child’s data or image was provided without appropriate consent, contact us so we can review and remove it where required.

11. Changes to this policy

We may update this policy to reflect changes in our services, providers, security practices, or legal requirements. The revised version will be posted on this page with a new “Last updated” date. If a change materially affects how we use data for a new purpose, we will provide any notice or request any consent required by law.

12. Contact and grievance officer

For privacy questions, a data-rights request, or a grievance, contact the 9XO Grievance Officer / privacy contact through our Dedicated Help Center. Select the most relevant support route and include “Privacy Request” in your message, your account or order email, the nature of your request, and any relevant order number. Please do not send passwords, payment credentials, or unnecessary identity documents.

We will acknowledge and address grievances within the timelines required by applicable law. If you are not satisfied after using our grievance process, you may have the right to approach the Data Protection Board of India or another competent authority, as applicable.