Privacy & Data Protection Policy

This Privacy Policy applies to all users, customers, and visitors who access or purchase through the website, mobile applications, and digital interfaces operated by Sunehri Leaf Co. (hereinafter referred to as "we", "us", "our", or "the Brand"), having its primary office and packaging depot at Holding No. 484/N, S.N. Bose Road, Babupara, Siliguri, Darjeeling, West Bengal – 734004, India.

By accessing our platform, registering an account, or placing an order, you explicitly consent to the collection, storage, and processing of your information in accordance with this policy and Indian regulatory frameworks including the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Consumer Protection (E-Commerce) Rules, 2020.

To deliver single-origin loose leaf teas directly from tea gardens to your doorstep, we collect the following categories of information:

We process your personal information strictly for legitimate commercial and regulatory purposes, including:

• Order Fulfillment & Logistics: Packaging loose teas at our Siliguri facility and handing over consignments to registered shipping carriers (Shiprocket, Delhivery, BlueDart, Shadowfax).
• Real-time Dispatch Updates: Triggering automated Air Waybill (AWB) tracking alerts, dispatch status, and out-for-delivery notifications via WhatsApp and SMS.
• Passwordless Customer Authentication: Generating and delivering secure 6-digit numeric One-Time Passwords (OTPs) for seamless login without vulnerable passwords.
• Customer Service & Warranty Redressal: Resolving refund, return, or parcel damage queries within our 7-Day Freshness Guarantee window.
• Accounting & Statutory Mandates: Maintaining electronic order invoices, accounting records, and customer fulfillment logs in accordance with applicable Indian trade laws and FSSAI traceability norms.
• Platform Security & Abuse Prevention: Detecting fraudulent orders, unauthorized access attempts, and high-frequency OTP spam attacks.

We never sell or lease your identity to data brokers or third-party marketing companies. We disclose relevant subsets of your data only to verified partners who assist in essential service operations under strict confidentiality agreements:

• Logistics Aggregators & Courier Partners: We share recipient name, destination address, and phone number with Shiprocket (BigFoot Retail Solutions Pvt. Ltd.) and logistics networks (such as Delhivery, BlueDart, DTDC, Xpressbees) to ensure door delivery.
• Authorized Payment Gateways: Payment details are processed directly through RBI-authorized payment aggregators (e.g., Razorpay, Cashfree, PhonePe) compliant with PCI-DSS standards.
• Messaging Service Gateways: SMS and WhatsApp notification services are dispatched via certified communication gateways (Meta WhatsApp Cloud API / StartMessaging) strictly for order fulfillment.
• Legal & Statutory Obligations: We may disclose information if mandated by Indian judicial authorities, law enforcement agencies, or tax authorities under statutory legal process.

We enforce industry-standard security safeguards to protect your personal information against unauthorized disclosure, interception, or loss:

• Transport Layer Security (TLS/SSL): All communication between your browser and our servers is secured using 256-bit TLS encryption.
• Cryptographic Tokenization: Session authentication uses cryptographically signed JSON Web Tokens (JWT) and secure HTTP-only cookies with short expiration windows.
• Encrypted Database Storage: Customer records and order histories are stored in enterprise-grade secured cloud database clusters with daily backups and role-based access restrictions.
• Rate Limiting & Anti-Brute Force Protection: Authentication and OTP generation endpoints enforce strict rate-limiting to prevent brute force and automated scraping attempts.

Our website uses cookies and browser local storage to maintain session state (e.g., keeping items in your shopping bag while browsing), authenticate logged-in sessions, remember UI preferences, and evaluate website performance. You may disable cookies through your browser settings; however, certain interactive functionalities (such as checkout and saved shopping carts) may not function properly without cookies enabled.

We retain personal information for as long as your account remains active or as needed to provide services, resolve disputes, and fulfill statutory tax and audit requirements (statutory tax invoices must be retained for up to 7 years under Indian tax regulations).

Under the Digital Personal Data Protection framework, you have the right to:

• Request access to the personal data we hold about you
• Request rectification or updating of inaccurate personal records
• Request erasure of your customer profile (subject to statutory invoice preservation requirements)
• Withdraw consent for non-transactional marketing communications at any time