Privacy Policy

Boxbuzz is a brand of Bright & Bloom Private Limited, a company incorporated in India. Bright & Bloom Private Limited is the data fiduciary responsible for the personal data described in this policy, and is the entity you are dealing with when you shop on this website.

We use your information to:

• Pack, invoice and deliver your order
• Send order confirmations, dispatch and delivery updates
• Answer support queries and process return or refund claims
• Issue a GST-compliant tax invoice and meet our accounting obligations
• Improve website functionality and user experience
• Send promotional emails, only if you have opted in
• Prevent fraud and unauthorised transactions
• Comply with legal obligations

We use two kinds of cookies:

• Essential cookies— these keep you signed in, remember your cart and the contents you have chosen for a gift box, and secure the checkout. The website cannot function without them.
• Analytics cookies — we use Google Analytics 4 to understand which pages are visited and how the site is used, in aggregate. These are set when you load a page on our website.

You can block or delete cookies through your browser settings, though the cart and sign-in will stop working if you block the essential ones. To opt out of Google Analytics specifically, you can install Google’s Analytics Opt-out Browser Add-on.

We do not sell or rent your personal data. We share only what each of the following needs in order to do its job:

• Clerk— our identity provider, which stores your account credentials and manages sign-in
• Our payment gateway partner— to authorise and settle your payment
• Courier and logistics partners— your name, delivery address and phone number, so your box can be delivered
• Vercel— our hosting and media storage provider, which processes requests to this website
• Our email delivery provider— to send order, support and (where you opted in) promotional email
• Google Analytics 4— usage data as described in section 4
• Google Customer Reviews— if you opt in on the order confirmation page, we pass your email address, order number and estimated delivery date to Google so that Google can email you a review survey. This is optional and only happens if you opt in.
• Legal and regulatory authorities— where we are required by law to disclose information

Some of the providers named in section 5 — including Clerk, Vercel and Google — operate infrastructure outside India, so your personal data may be processed outside India. Where that happens we rely on the provider’s contractual data-protection commitments, and we share only the data described above.

• Account data— for as long as your account is open. If you ask us to delete your account, we delete it, subject to the invoice records below.
• Order and tax invoice records — for 8 financial years, because Indian company, GST and income-tax law require us to preserve them. We cannot delete these earlier, even on request.
• Marketing consent and email list membership— until you unsubscribe or withdraw consent
• Support and return-claim correspondence— for up to three years after the claim is closed

We implement appropriate technical and organisational security measures to protect your personal information, including encrypted connections to this website and restricted internal access to order data. However, no online transmission or storage is completely secure, and we cannot guarantee absolute security.

Under the Digital Personal Data Protection Act, 2023 and other applicable Indian law, you have the right to:

• Access a summary of the personal data we hold about you
• Have inaccurate or incomplete data corrected, updated or completed
• Have your data erased, subject to the retention periods in section 7
• Withdraw consent you previously gave, including for marketing email
• Nominate another person to exercise these rights on your behalf
• Raise a grievance with us, and escalate it — see section 11

Every promotional email we send carries a one-click unsubscribe link, which is the quickest way to stop marketing email. For anything else, write to contact@boxbuzz.in.

Our website is not directed at children. In India a child is anyone under the age of 18, and we do not knowingly collect personal data from children or serve them targeted advertising. If you believe a child has given us personal data, contact us at contact@boxbuzz.in and we will delete it.

If you have a complaint about how your personal data has been handled, contact our Grievance Officer:

We acknowledge every grievance within 48 hours of receiving it and aim to resolve it within 30 days. If you are not satisfied with the outcome, you may escalate the matter to the Data Protection Board of India.

We may update this Privacy Policy from time to time. Any change is published on this page and the effective date at the top is updated. Please check back periodically.

If you have any questions about this Privacy Policy, please contact us: