Privacy policy

Privacy Policy

Last updated: 15 October 2026

This policy explains how Qimati ("we", "us") collects, uses and shares personal data when you visit www.qimati.in, buy from us, or talk to us on WhatsApp. It applies to buyers in India and abroad, including the European Union, the European Economic Area, the United Kingdom and Switzerland.

1. Who we are

Qimati is a brand of Gem Castle, a proprietorship of Prakhar Patni (legal name: PRAKHAR PATNI; trade name: GEM CASTLE; GSTIN 08DSNPP5709P1ZQ). We decide how your personal data is used, so we are its "data fiduciary" under India's Digital Personal Data Protection Act, 2023 and its "controller" under the EU and UK GDPR.

Registered address: 6, Patni Farm, Phool Colony, Miya Bajaj Ki Gali, Sanganer, Jaipur, Rajasthan 302029, India.
Office: 302, A-6, Acharya Kriplani Marg, Adarsh Nagar, Jaipur, Rajasthan 302004, India.
Email: info@qimati.in  ·  Phone: +91 97990 43748

2. What we collect

  • Order and account details: name, business name, phone number, email, billing and shipping address, GSTIN (if you give one), order history and messages about your orders.
  • Payment details: card and UPI payments are handled by our payment gateway (PayU, through Shiprocket Checkout) and by Shopify. We do not see or store full card numbers.
  • WhatsApp conversations: your WhatsApp number and profile name, the messages, photos and product codes you send us, and how you first reached us, for example a link or advert (see section 5).
  • Instagram messages: your Instagram username and the messages, photos and posts you send to our account @houseofqimatii (see section 5).
  • Device and usage data: IP address, approximate location, browser, device type, time zone, pages viewed, clicks, scrolling and the page or advert that brought you to our site. Cookies and similar technologies collect this data (see section 4).

3. Why we use it, and on what legal basis

  • To take, pack, ship and support your orders, and to send order confirmations, invoices and delivery updates. This is necessary to perform our contract with you.
  • To keep GST and accounting records and to check GSTINs you give us against the government GST registry. This is our legal obligation.
  • To run, secure and improve the website and to understand which products and pages work. This is our legitimate interest, or your consent where cookies are involved (see section 4).
  • To measure our advertising and show you relevant ads on Google, Facebook and Instagram. This is based on your consent where the law requires it.
  • To send offers and new-design updates, but only if you have agreed. You can opt out at any time (see section 5).

4. Cookies and tracking

Essential cookies make the cart, checkout and security work, so they are always on. The other tools below measure and improve the site and our advertising:

  • Shopify analytics: store statistics, such as visits and sales.
  • Google Analytics, Google Ads and Google Merchant Center (Google tag and the Google & YouTube app): site usage, ad performance and conversions, such as purchases. Our pages also load fonts from Google Fonts, which receives your IP address.
  • Meta Pixel (Facebook and Instagram): ad measurement and ad audiences, once connected.
  • Microsoft Clarity: heatmaps and session replays that show how pages are used, such as clicks, scrolling and mouse movement.
  • Shiprocket (including its OTPless phone sign-in at checkout): checkout, cart, delivery-date estimates and delivery tracking.
  • Our own visit tracker: records the page you landed on, the referring site and a scrambled (hashed) cart identifier on our server, so that we can see which channel led to an order. It runs only if you have allowed both analytics and marketing cookies.

Visitors from the EU/EEA, UK and Switzerland see a cookie banner. Analytics and marketing tools stay off until you accept them, and Google tags run in consent mode. You can change your choice at any time by clearing cookies for qimati.in, which shows the banner again, or by emailing us. In other countries these tools run by default. You can block them through your browser settings or tools such as Google's ad settings, but some features may then not work.

5. Our WhatsApp and Instagram assistants

Our WhatsApp number +91 93588 59059 is an automated assistant that runs on Meta's WhatsApp Business Platform. It answers common questions, takes design requests and sends order summaries. Your messages are processed on our own automation and request systems, and a member of our team may read them and reply personally. We record how you first contacted us, for example which link or advert, to understand what brings buyers to us. We send order and service messages about your orders. Promotional messages are sent only if you have agreed; reply STOP or tell us, and we will stop. Meta's own privacy policy also applies to your use of WhatsApp.

Messages you send to our Instagram account @houseofqimatii may be answered by an automated assistant that runs on Meta's Instagram messaging platform. It answers common questions about our products, prices and policies; anything else, and any photo or video you send, goes to our team, who reply personally. Our team can see every conversation. Meta's own privacy policy also applies to your use of Instagram.

6. Who we share it with

We do not sell your personal data. We share it only with service providers that help us run the business, and only as far as each one needs:

  • Shopify (store platform and hosting)
  • PayU and Shiprocket Checkout, including OTPless (payments, checkout and phone sign-in)
  • Shiprocket and its courier partners (shipping and tracking)
  • Meta Platforms (WhatsApp and Instagram messaging; Facebook and Instagram advertising)
  • Anthropic (the AI service that writes the automatic replies to Instagram messages)
  • Google (analytics, advertising, Merchant Center and web fonts)
  • Microsoft (Clarity analytics)
  • OVHcloud (hosting for our automation server)
  • Supabase and our own cloud servers (our internal order-request and reporting systems)
  • A GST verification service (to check GSTINs you give us)
  • Our accountant (tax records)

We may also disclose data when the law, a court or a government authority requires it, or to protect our rights, customers or business.

7. International transfers

We are based in India. Several of our providers process data in other countries, including the United States and the EU. Where EU or UK data leaves those regions, we rely on the safeguards our providers offer, such as the European Commission's Standard Contractual Clauses and the UK equivalent.

8. How long we keep it

  • Orders, invoices and GST records: for as long as Indian tax law requires.
  • WhatsApp and Instagram conversations and design requests: for as long as we need them to serve you and handle disputes.
  • Analytics data: under each provider's retention settings.

When data is no longer needed, we delete or anonymise it.

9. Your rights

You can ask us to:

  • tell you what personal data we hold and give you a copy
  • correct or update it
  • delete it, unless the law requires us to keep it
  • withdraw consent, including for marketing messages and cookies
  • nominate someone to act for you (India)

In the EU/EEA, UK and Switzerland you can also object to processing, restrict it, and ask for your data in a portable format. You may complain to your local data protection authority; in the UK this is the Information Commissioner's Office.

To use any of these rights, email or call our Grievance Officer (section 13). We reply within one month.

10. Security

We use access controls, encrypted connections and reputable providers to protect your data. No method of internet transmission or storage is completely secure. If a breach affects your data, we will tell you and the authorities as the law requires.

11. Children

We sell wholesale to businesses and adults. We do not knowingly collect personal data from anyone under 18.

12. Changes to this policy

We will post any changes on this page and update the date at the top.

13. Contact and Grievance Officer

For privacy questions, requests or complaints, contact our Grievance Officer:

Yash Choudhary, Grievance Officer (CTO)
Gem Castle (Qimati), 302, A-6, Acharya Kriplani Marg, Adarsh Nagar, Jaipur, Rajasthan 302004, India
Email: cto@qimati.in

We acknowledge complaints within 48 hours and resolve them within one month of receipt, as required by the Consumer Protection (E-Commerce) Rules, 2020. If you are in India and are not satisfied with our response, you may complain to the Data Protection Board of India.