Privacy Policy

Root and Canvas (“we”, “us”, “our”), based in Ranchi, Jharkhand, India, operates www.rootandcanvas.com (the “Website”). This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, and the rights you have over it. It is published in line with the Information Technology Act, 2000, the rules made under it, and the Digital Personal Data Protection Act, 2023.

By using the Website or placing an order, you agree to this Policy. If you do not agree, please do not use the Website.

We use your information only to:

• Process, ship, and deliver your orders, and handle returns and refunds.
• Send order confirmations, delivery updates, and respond to your queries.
• Manage your account.
• Send offers and updates, only if you have agreed. You can opt out at any time.
• Improve the Website and understand how it is used.
• Prevent fraud and keep the Website secure.
• Meet legal, tax, and accounting obligations.

We do not sell your personal information. We share it only with:

• Service providers that help us run the business, such as payment gateways, courier and logistics partners, website hosting, email and SMS services, and analytics tools. They may use your data only to provide their service to us.
• Government or legal authorities, when required by law or a valid legal order.
• A successor business, if Root and Canvas is merged with or sold to another business.

We use cookies to keep your cart and login working, remember your preferences, and understand how visitors use the Website. You can block or delete cookies in your browser settings, but parts of the Website may then stop working properly.

We keep your personal information only for as long as needed to fulfil the purposes in this Policy or to comply with applicable law, including tax and accounting record requirements. After that, we delete or anonymise it.

You have the right to:

• Access the personal information we hold about you.
• Correct or update inaccurate or incomplete information.
• Request deletion of your information, subject to legal retention requirements.
• Withdraw your consent at any time. This does not affect processing done before withdrawal.
• Nominate another person to exercise these rights on your behalf if you die or become incapacitated.
• Raise a grievance with us, and if it is not resolved, complain to the Data Protection Board of India.

We use reasonable security practices, including encrypted (HTTPS) connections and restricted access to personal data. No online system is completely secure, so we cannot guarantee absolute security. Please keep your account password confidential.

The Website is not meant for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us their information, contact us and we will delete it.

The Website may link to other websites. We are not responsible for their privacy practices, so please read their policies separately.

We may update this Policy from time to time. The latest version will always be on this page, with its effective date at the top.