Privacy Policy

Who we are

DOODLE is a children's clothing brand operated by CANVAS, based in Bengaluru, India. For the purposes of the DPDP Act, the business is the “Data Fiduciary” that decides how and why your personal data is processed.

Registered legal entity: [PLACEHOLDER: registered legal entity name]. Registered business address: [PLACEHOLDER: registered business address]. GSTIN: [PLACEHOLDER: GSTIN — N/A until registered].

What data we collect

We collect only the data we need to run the shop and fulfil your orders:

• Identity & contact data — your name, email address and phone number.
• Order & delivery data — your shipping address, billing details, order history and delivery status.
• Payment data — handled directly by our payment processor, Razorpay. We do not see or store your full card, UPI or bank credentials.
• Technical & usage data — basic analytics and cookie data (such as pages viewed and device/browser type) used to keep the site working and improve it.

Why we collect it

We use your personal data to take and fulfil orders, process payments and refunds, arrange shipping and returns, provide customer support, send transactional messages about your order, prevent fraud, and meet our legal and tax obligations. With your consent, we may also send you occasional updates about new drops — you can opt out at any time.

Where your data is stored

We use trusted third-party service providers (“Data Processors”) to run the store. Your data may be stored or processed by them:

• Neon (Postgres database) — stores marketing and account-related records.
• Medusa, hosted on Railway — runs our commerce backend (orders, carts, customers).
• Razorpay — processes payments.
• Resend — sends transactional and account emails.
• Vercel — hosts and serves the website.

Cookies and analytics

We use cookies and similar technologies to keep your cart and session working and to understand how the site is used. You can control or block cookies through your browser settings; some features may not work correctly if you disable them.

Your rights under the DPDP Act

As a Data Principal under the DPDP Act, you have the right to:

• Access — ask for a summary of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your personal data where we are no longer required to keep it.
• Withdraw consent — withdraw any consent you previously gave, as easily as you gave it.
• Grievance redressal — raise a complaint with our Grievance Officer (see below).

How to exercise your rights

To exercise any of these rights, email us at hello@doodlebycanvas.in. We will respond to verified requests within 7 days.

Children's data

DOODLE makes products for children, but our store is intended to be used by parents and guardians, not by children directly. We do not knowingly sell to or collect personal data directly from children. We do not run behavioural tracking or targeted advertising directed at anyone under 18.

Data retention

We keep your personal data only for as long as needed to fulfil orders, provide support, and meet legal, accounting and tax requirements, after which it is deleted or anonymised.

Grievance Officer

In line with the DPDP Act and the Consumer Protection (E-Commerce) Rules, 2020, you may contact our Grievance Officer for any data or consumer complaint. Full contact details are on our Contact page.

Grievance Officer: [PLACEHOLDER: Grievance Officer name]. Email: hello@doodlebycanvas.in. Phone: [PLACEHOLDER: grievance contact phone].

Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be available on this page with its effective date.