Privacy Policy

This policy explains what information Sauerkrat (operated by Chidshaktifoods OPC Private Limited, "CHIDSHAKTI FOODS", "we", "us") collects when you use this website, why we collect it, and how it's stored and protected.

Information we collect

We only collect what's needed to run the store and your account:

• Account details — your name, and either an email + password or a phone number, depending on how you sign up or log in.
• Order details — shipping name, email, address, city, state, and ZIP/PIN code, entered at checkout for each order.
• Payment information— card, UPI, and netbanking details are entered directly into our payment partner Razorpay's secure checkout and are never sent to or stored on our servers. We only receive a payment confirmation reference from Razorpay.
• Cart contents— while you're shopping, your cart is stored only in your browser (`localStorage`), not on our servers, until you check out.
• Anonymous site analytics— for every page you visit, we record the page, an approximate timestamp, your IP address (encrypted at rest, same as other personal data below), and an approximate location derived from that IP (city/country only — never precise enough to identify a device or address). This is tied to a random id stored in a cookie on your browser, not to your name or account, unless you're logged in at the time.

How we store and protect it

• Your name, email, phone, and shipping address are encrypted at rest (AES-256) in our database — not stored as plain, readable text. Email and phone are additionally matched using a one-way cryptographic fingerprint so we can find your account at login without ever running a search over decrypted values.
• Passwords are never stored in plain text — they're salted and hashed (scrypt) before being saved, so we cannot see or recover your actual password.
• Login sessions use a random, unguessable session id stored in an httpOnly cookie your browser cannot expose to page scripts; the underlying session can be immediately revoked (e.g. on logout or a password reset) by deleting it from our database.
• One-time login codes (OTP) and password-reset links are stored only as one-way hashes, expire automatically (5 minutes for OTP codes, 1 hour for password-reset links), and can each be used once.
• Your data is stored on servers we control and is not sold to third parties.

Who we share data with

We share the minimum necessary data with the service providers that make the store work, and nobody else:

• Razorpay (payment processing) — receives your order amount and whatever payment details you enter directly into their checkout.
• Our SMS gateway provider — receives your phone number only if you choose to log in or sign up via phone OTP, solely to deliver the login code.
• Our IP-geolocation provider — receives your IP address (nothing else) to resolve it to an approximate city/country for the anonymous site analytics described above.

We use the anonymous, first-party site analytics described above to understand traffic to this site. We do not use third-party advertising trackers, and this data is never sold or shared for advertising purposes.

Your choices

You can view, correct, or delete your account data yourself at any time from your account pageonce logged in — no need to contact us. Deleting your account erases your name, email, phone, and password, but does not remove historical order records we're required to keep for accounting/tax purposes (see our Refund & Cancellation Policy). If you'd rather we make the change for you, or have questions about it, see the Contact page.

Contact

Questions about this policy? Reach us via the details on our Contact page.