Privacy Policy

Effective Date: 10 May 2026 | Last Updated: 13 May 2026

This Privacy Policy explains how Kredey Innovations Private Limited ("Kredey," "we," "us," or "our"), operating the Slowatom online store (accessible at slowatom.com), collects, uses, stores, and protects your personal data. This policy is published in compliance with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and the Consumer Protection (E-Commerce) Rules, 2020.

1. Who we are

Slowatom is a brand of Kredey Innovations Private Limited, a company incorporated under the Companies Act, 2013, with its registered office in Ghaziabad, Uttar Pradesh, India. Slowatom designs and sells hand-thrown ceramic stoneware mugs, made to order and shipped across India.

In the context of applicable data protection law, Kredey Innovations acts as the Data Fiduciary — we determine the purpose and means of processing your personal data.

Legal Entity: Kredey Innovations Private Limited
Brand: Slowatom (slowatom.com)
Registered Office: Kavi Nagar, Ghaziabad, Uttar Pradesh 201002, India
Contact: support@slowatom.com

2. What data we collect

We collect only the data necessary to operate the store and fulfill your order.

Category	What we collect	Purpose
Account & Identity	Name, email address, phone number	Order placement, account access, customer support
Delivery	Shipping address, billing address	Order fulfillment and delivery
Order & Transaction	Items purchased, order value, color selection, order status, payment confirmation via Razorpay	Order processing, payment verification, order history
Communication	Messages sent to support, contact form submissions	Responding to your queries
Device & Usage	Browser type, device type, IP address, pages visited, session duration, interaction data (heatmaps, session recordings via Microsoft Clarity)	Site security, performance monitoring, bug resolution, understanding how visitors use the site

What we do NOT collect: We do not collect Aadhaar numbers, bank account details, UPI IDs, credit/debit card numbers, or biometric data. All payment processing is handled entirely by Razorpay — we only receive confirmation of payment status, never your financial credentials.

3. How we collect your data

Directly from you: when you create an account, place an order, or contact us for support.
Automatically: when you browse the site, through standard web technologies (cookies, server logs), limited to what is necessary for site operation and security.
From third-party services: Razorpay provides us with payment confirmation status (success/failure) and a transaction reference ID. Razorpay’s own privacy policy governs how they handle your payment data.

4. Legal basis for processing

Under the Digital Personal Data Protection Act, 2023, we process your personal data on the following grounds:

Consent: You provide explicit consent when you place an order or sign up for our newsletter. For marketing communications, consent is collected separately at the point of signup and can be withdrawn at any time via the unsubscribe link in any email.
Legitimate use: Certain processing is necessary for the performance of a contract — for example, we must process your delivery address to fulfill your order.

5. How we use your data

Order fulfillment: to process your order, dispatch your mug, and respond to delivery questions.
Communication: to send you order confirmations, shipping updates, and essential service notifications. We send marketing emails only with your separate, explicit consent and you may unsubscribe at any time.
Customer support: to respond to questions, handle damage claims, and resolve disputes.
Site security and integrity: to detect and prevent fraud, abuse, and unauthorized access.
Site improvement: to understand how visitors use our site through analytics and session recording tools, in order to improve the browsing and shopping experience.
Legal compliance: to comply with applicable laws, regulations, and enforceable government requests.

6. Data sharing and disclosure

We do not sell, rent, or trade your personal data to any third party. We share data only in the following limited circumstances:

Shipping partners: to deliver your order, we share your name, address, and phone number with our courier partner. They use this information solely to deliver your shipment.
Payment processor (Razorpay): we share necessary transaction details with Razorpay to process payments. Razorpay operates as an independent Data Fiduciary for payment data.
Hosting platform (Shopify): our store is hosted on Shopify. Shopify may independently collect and process data about your interactions with our store. See Shopify’s Consumer Privacy Policy for details.
Session recording and analytics (Microsoft Clarity): we use Clarity to understand how visitors interact with our site through heatmaps and session recordings. Clarity may collect device and usage data. Microsoft’s privacy policy governs their handling of this data.
Other service providers: we may use third-party services for email and analytics. These providers process data only on our instructions and are bound by confidentiality obligations.
Legal authorities: we may disclose data if required by law, court order, or government authority under applicable Indian law.

7. Your rights as a Data Principal

Under the Digital Personal Data Protection Act, 2023, you have the following rights:

Right to Access: you may request a summary of the personal data we hold about you.
Right to Correction: you may request correction of any inaccurate or incomplete data.
Right to Erasure: you may request deletion of your personal data, subject to any legal obligations that require us to retain certain records.
Right to Withdraw Consent: you may withdraw your consent at any time. Upon withdrawal, your account will be deactivated and your data deleted in accordance with our retention policy.
Right to Grievance Redressal: you may file a complaint with our Grievance Officer (see Section 12) or with the Data Protection Board of India.

All rights requests will be fulfilled within 90 days of receipt, as required by law. To exercise any of these rights, email us at support@slowatom.com with the subject line "Data Rights Request."

8. Data retention

Account data: retained for as long as your account is active. Upon account deletion, your data is erased within 90 days, except where retention is required by law.
Order and transaction data: retained for a minimum of 8 years from the date of the transaction to comply with tax, accounting, and legal requirements under Indian law (including the Income Tax Act, 1961, and the GST Act).
Device and usage data: retained for up to 12 months, then automatically deleted or anonymized.

9. Data security

We implement reasonable security safeguards to protect your data, including: encryption of data in transit using TLS/SSL, secure authentication, restricted access controls within Kredey Innovations, and regular review of our security configurations. Our store runs on Shopify, which maintains industry-standard security certifications including PCI-DSS Level 1 compliance for payment data.

In the event of a data breach, we will notify the Data Protection Board of India and affected users within 72 hours, as required by law.

10. Children’s data

Slowatom is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a person under 18, we will delete it promptly.

11. Cookies and tracking

We use cookies that are strictly necessary for site operation — for example, to maintain your shopping cart and authentication state. We use Shopify’s built-in analytics and Microsoft Clarity for session recording and heatmaps to understand how visitors use our site. We do not use advertising cookies or third-party tracking pixels without your consent. You can disable non-essential cookies through your browser settings or our cookie preferences (where available).

12. Grievance Officer

In accordance with the Digital Personal Data Protection Act, 2023 and the Consumer Protection (E-Commerce) Rules, 2020, we have appointed a Grievance Officer:

Grievance Officer: Rajat Bansala
Kredey Innovations Private Limited
Email: support@slowatom.com
Acknowledgement: within 48 hours
Resolution: within 30 days
Escalation: Data Protection Board of India / National Consumer Helpline 1800-11-4000

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via the site or by email. Your continued use of Slowatom after such notification constitutes acceptance of the updated policy.

14. Contact us

Entity: Kredey Innovations Private Limited
Brand: Slowatom (slowatom.com)
Registered Office: Kavi Nagar, Ghaziabad, Uttar Pradesh 201002, India
Email: support@slowatom.com