Privacy Policy | Winston Hide

Who is responsible for your information

This Privacy Policy applies to Winston Hide - the website at winstonhide.shop and the services offered through it - and covers browsing, accounts, sign-in (including Facebook Login and Google sign-in), carts, wishlists, orders, and support conversations. It is written for the service as it actually works today, and it is dated so you can tell when it last changed.

The business responsible for your information is Winston Hide, 8A Motijheel Lane, Tangra, Kolkata - 700015, India. You can reach us on WhatsApp or by phone on +91 99037 25189, or by post at that address. We do not operate a monitored email inbox, so please use WhatsApp, the phone, or post for anything about your data - those reach the workshop directly.

Orders placed through Amazon or Flipkart are handled under that marketplace's own privacy terms for the parts they control; this notice covers what we receive and do.

Information you give us

We collect this only when you choose to give it - by creating an account, signing in, saving an address, building a wishlist, placing an order, or writing to us.

Account details: your name, email address, phone number, and a profile picture if your sign-in provider supplies one.
Sign-in credentials: if you set a password, we store only a one-way hash of it, never the password itself. If you turn on two-factor authentication we store the secret needed to verify your codes.
Addresses: the shipping and billing addresses you save or enter at checkout.
Shopping records: your cart, wishlist, orders, order items, sizes and colours chosen, and the delivery stage of each order.
Support correspondence: the messages you send us and our replies, including WhatsApp conversations about sizing, orders, or returns.

Signing in with Google or Facebook is optional - you can always use an email address and password instead. If you do use it, we ask that provider for the smallest amount of information that lets us create and recognise your account.

Permissions we request from Facebook: public_profile and email. Those two, and no others. We request the equivalent basic profile and email scopes from Google.
From public_profile we receive your app-scoped user ID, your name, and your profile picture URL. The app-scoped ID is how we recognise you as the same customer on your next sign-in - without it every sign-in would create a new account. Your name is used to address you in the account area and on order correspondence; the picture is shown only to you, in your own account.
From email we receive your primary email address and whether the provider has verified it. It is used to identify your account and to send order and sign-in email - the same address an email-and-password account would use.
The access token: we exchange it once, server-side, to read the fields above, and then discard it. We do not store a long-lived Facebook or Google token, and we cannot act on your account later.
What we do NOT receive: your friends or contacts, your posts, photos, likes, pages, groups, messages, birthday, or any advertising, interest, or audience data.
What we never do: we do not post anything to your Facebook or Google account, we do not read anything from it after sign-in, and we run no Meta Pixel and no Facebook SDK on this website - sign-in is a server-side redirect, so no facebook.com script runs on our pages.
If Facebook returns no verified email address, we do not create an account and sign-in is refused, because we cannot run an order without a contactable address. You can still register with an email address and password instead.
To revoke access: on Facebook, Settings & Privacy -> Settings -> Apps and Websites, then remove Winston Hide. On Google, Manage your Google Account -> Security -> Your connections to third-party apps and services. Revoking stops future sign-in; it does not by itself erase the account we already hold - to erase it, see Deleting your account and data below.
Facebook's own handling of your data is governed by the Meta Privacy Policy at https://www.facebook.com/privacy/policy, and Google's by https://policies.google.com/privacy. Winston Hide is not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc. or Google LLC; we use their sign-in services only.

Payment information

Payments are taken by Razorpay, which is certified to handle card data. Your card, UPI, or netbanking credentials are entered on the Razorpay payment interface - they do not pass through winstonhide.shop, and we never see or store them.

What we keep is the outcome: the Razorpay payment and order reference numbers, the amount, the method type (for example UPI or card), and whether the payment succeeded or failed. That is what lets us match a payment to your order, answer questions about it, and process a refund. Our database holds no card numbers, expiry dates, CVVs, or UPI PINs.

Nobody from Winston Hide will ever ask you for a password, a one-time passcode, a CVV, or a UPI PIN. Please do not send those to us in any message.

Information collected automatically

The cookies this site sets are listed below, and every one of them exists to make the site work. There are no advertising cookies, no analytics cookies, no Meta Pixel, and no third-party tracking scripts of any kind on this website.

wh_session - keeps you signed in. Lasts 30 days, and is refreshed as you keep using the site.
wh_cart_id - remembers your cart so it survives closing the tab, including before you have an account.
wh_oauth_state and wh_oauth_code_verifier - short-lived security values that prove a Google or Facebook sign-in came back to us genuinely and was not forged by another site. Both expire after 10 minutes.
wh_oauth_callback - remembers which page to return you to after sign-in. Also expires after 10 minutes.

Server logs and abuse prevention

Our servers record ordinary request information - the page or interface requested, the time, the browser and device type reported, and the network address the request came from. We use it to diagnose faults, protect the admin area, and rate-limit sign-in and checkout attempts so accounts cannot be attacked by brute force.

We do not use this information to build a profile of you, and we do not combine it with advertising data.

How we use your information

We use your information for these purposes and no others.

To show your cart and wishlist, and to keep you signed in.
To take an order, calculate the total, confirm payment, and get the order made and delivered.
To tell you what is happening with your order, including dispatch, tracking, and delivery.
To answer your questions and handle returns, exchanges, and refunds.
To keep accounts and payments secure and to detect and prevent fraud and abuse.
To keep the tax, invoice, and accounting records the law requires us to keep.

We do not sell your personal information. We do not share it with data brokers, information resellers, ad networks, or advertising platforms, and we do not use it for ad targeting or to build audiences. We share only what a given service actually needs to do its job, and each of these acts on our instructions under a written agreement that does not permit them to use your information for their own purposes:

Razorpay Software Private Limited (India) - to take payments and process refunds.
Google LLC and Meta Platforms, Inc. - only if you choose to sign in with them, and only as part of that sign-in.
Resend, using Amazon Simple Email Service - to send transactional email such as sign-in codes and order confirmations. Our sending route is configured in the Asia Pacific (Tokyo) region, so an email in transit is processed outside India.
Hostinger International - hosting for the website, the API, and the database.
Cloudinary - hosting and delivery of product photography. Product images are not personal information.
Delivery partners - your name, delivery address, and phone number, so a courier can reach you. The specific partner depends on your pin code and appears with your tracking details.
Professional advisers, or a government or law-enforcement body where we are legally required to disclose something.

Why we are allowed to use it

We use your information because one of the following applies: it is necessary to perform the contract you enter when you place an order; you consented, which you may withdraw at any time (choosing Facebook or Google sign-in is such a consent); it is necessary to meet a legal obligation, such as keeping tax records; or it is necessary for our legitimate interest in keeping the service secure and preventing fraud, which we balance against your interests.

How long we keep it

Order, invoice, and payment-reference records are kept for eight years from the end of the financial year the order was placed in, because Indian tax and company record-keeping rules require it. We cannot delete these earlier, even at your request - but we can delete everything that is not part of that legal record.

Your account, saved addresses, wishlist, and cart are kept until you ask us to delete them, or until the account has been inactive for three years, whichever comes first. Sign-in sessions expire after 30 days. The short-lived sign-in security cookies expire after 10 minutes. Server logs are kept for 90 days.

Your choices and your rights

You can ask us to do any of the following, and we will respond within 30 days. Contact us on WhatsApp or by phone on +91 99037 25189, or by post at the address above, and tell us enough to find your record - usually the phone number or email on the account, and an order number if your request is about an order.

See what information we hold about you, and get a copy of it.
Correct anything that is wrong - you can also edit your name, phone, and addresses yourself in your account.
Delete your account and the information we hold, subject to the tax records described above. See the Data deletion page for exactly what happens.
Withdraw consent, or object to a particular use. Note that we cannot complete an order without the information needed to deliver it.
Complain to us first if something has gone wrong, so we have a chance to fix it.

Deleting your account and data

You can have your account and the personal information attached to it deleted at any time. There is no charge and you do not need to give a reason. The full page is at https://winstonhide.shop/policies/data-deletion, and the steps are here too so you do not have to go looking:

Ask us: message or call +91 99037 25189 on WhatsApp or by phone, or write to Winston Hide, 8A Motijheel Lane, Tangra, Kolkata - 700015, India. Say that you want your account and data deleted.
We confirm it is you, by checking the phone number or email address on the account, and we may ask about a recent order.
Within 30 days we delete your name, email address, phone number, profile picture, password hash, two-factor secret, all saved addresses, your cart, your wishlist, your sessions, and any Facebook or Google sign-in link, including the app-scoped identifier we held to recognise you.
What survives, and only this: if you have placed an order, Indian tax and company rules require us to keep the order record, invoice, and payment reference for eight years from the end of that financial year. We reduce it to the legal minimum and detach it from your account, so it can no longer be used to sign you in, contact you, or market to you. It is deleted when that period ends.
We confirm to you when it is done, and say what was retained and when it expires. If you have never placed an order, deletion removes everything we hold about you.
We will also delete Facebook-derived data on our own initiative if we stop offering Facebook Login, or if Meta instructs us to.

Security

Passwords are stored only as one-way hashes. Sign-in uses a protected session cookie that browsers do not expose to other sites. Optional two-factor authentication is available on your account. Order and payment data is written only after the payment provider's own callback has been cryptographically verified, and every write is validated on the server rather than trusted from the browser. The site is served over HTTPS.

We take security seriously, but no service can promise absolute protection. If you think something is wrong with your account, contact us on the number above and we will help you secure it.

Children

This is a shop for adults and is not directed at children under 18. We do not knowingly collect information from a child. If you believe a child has created an account, tell us and we will remove it.

Changes to this notice

This notice is effective 9 September 2026. If we change how we use your information, we will update this page and change that date. For a change that materially affects you, we will also tell account holders directly.