FORMA
Legal

Privacy Policy

What we collect, why, and how to ask us to delete it. This is the short version; the Indian DPDP Act, 2023 requires us to be explicit about personal data.

1. What we collect

  • Account — email or mobile (for sign-in via OTP), display name, optional address.
  • Orders — shipping address, order history, payment status. Card numbers are collected by Razorpay and never reach our servers.
  • Site analytics — anonymous page views, referrer, device class. No third-party tracking or advertising cookies.
  • Contact form — name, email, message body, approximate IP for spam prevention.

2. Why we collect it

  • To process and ship your order.
  • To send order-related emails (confirmation, shipping, delivery).
  • To improve the site — which pages load, which don't, where users get stuck.
  • To respond when you contact us.

3. What we do NOT do

  • We do not sell your data to anyone.
  • We do not run third-party advertising trackers.
  • We do not send marketing email unless you opted in to the newsletter.

4. Sharing with service providers

We share the minimum needed with:

  • Razorpay — payment processing.
  • Twilio — SMS OTP delivery.
  • Resend — transactional email.
  • Shipping partners (Delhivery, BlueDart, DTDC, India Post) — name, address, phone, weight.
  • Sentry — anonymous error reports (no PII).

Each has their own privacy practice. We choose providers who meet Indian data-protection requirements.

5. Retention

  • Order data: 8 years (required by Indian tax law).
  • Account data: until you ask us to delete it.
  • Contact-form submissions: 1 year, then deleted.
  • Newsletter subscription: until you unsubscribe.

6. Your rights under DPDP Act 2023

  • Ask what data we hold about you (right to access).
  • Ask us to correct inaccurate data.
  • Ask us to delete your account and data (right to erasure).
  • Withdraw consent for processing at any time.

To exercise any of these, write to privacy@forma.studio. We respond within 30 days as required by the Act.

7. Cookies

We use a single HttpOnly session cookie (forma_session) for authentication. No third-party cookies, no advertising cookies, no analytics cookies that follow you across the web.

8. Children

FORMA is for adults. We do not knowingly collect data from anyone under 18.

9. Grievance officer

Per the DPDP Act, our Grievance Officer is reachable at grievance@forma.studio and will respond within 30 days.

Last updated: 2026-07-01

Questions? Get in touch.