Homfly Building & Interior Materials is a sole proprietorship business operating in Gurgaon, Haryana, India. For the purposes of the Digital Personal Data Protection Act, 2023, the proprietor carrying on business under the name Homfly is the Data Fiduciary for the personal data described in this policy — meaning the person who determines why and how your personal data is processed.

This policy covers the Homfly website and app, our WhatsApp support and ordering thread, and our phone line. It applies to the business operated under the name Homfly Building & Interior Materials. It does not cover any third-party site or service that we link to.

What you give us.

• Your mobile number — this is your account. We need it to sign you in, to reach you about an order, and to hand it to the person delivering to you.
• Your name, and your email address if you choose to add one.
• Delivery addresses, including the label you give them, the contact person at the site, and the map coordinates when you place a pin using the address picker.
• Business and tax details — your GSTIN and business name, if you give them, so that GST invoices are issued correctly.
• Anything you write to us on WhatsApp, by email or on a call.

What using the service creates.

• Your orders — items, quantities, prices, invoices, delivery status and the history of how each order moved.
• Payment records — the amount, the method, whether it succeeded, and the reference ids our payment gateway gives us. See section 3 about card and UPI details.
• Technical data — IP address, browser and device type, and server logs of the requests your device makes. We use this to keep the service up, to apply rate limits, and to detect abuse.
• Usage data — which pages you visit, how you move between them, how long you stay, and the approximate region, device and browser you use, collected through Google Analytics. We look at this in aggregate to understand how the site is used.

Your delivery location. If you allow location access, your device shares its coordinates so we can check whether we deliver to you and prefill an address. That choice is stored in your browser. We only receive coordinates when you save them as part of a delivery address — we do not track your location in the background, and we do not have a way to locate you when you are not using the app.

We never see your card number, UPI PIN, CVV, or bank login. Online payments happen on our payment gateway's own systems. What comes back to us is a transaction id and whether the payment succeeded — nothing you could pay with.

We do not store your OTP. A one-time password is kept only as a one-way cryptographic hash, so a code cannot be read back out of our systems, and it expires shortly after it is issued.

We do not ask for and do not want any sensitive identity document — no Aadhaar, no PAN card image, no biometric data. If you send one to us anyway, we will delete it.

We use your personal data only for these purposes:

• To sign you in and keep your session secure.
• To take, confirm, source and deliver your orders, including telling the delivery executive where to go and who to hand the goods to.
• To take payment and to issue GST-compliant invoices, which tax law requires us to keep.
• To talk to you about an order — confirmations, dispatch and delivery updates, a payment link, an invoice, and support, mostly over WhatsApp.
• To check whether we can deliver to you, by comparing your pincode and location against our serviceable area.
• To keep the service working and honest — fixing faults, preventing fraud and abuse, and enforcing our Terms of Service.
• To understand and improve the site — seeing, in aggregate, which pages are used, where people get stuck, and what to fix next.
• To meet our legal obligations under tax, accounting, consumer and information-technology law.

We do not sell your personal data, and we do not share it with anyone for their own advertising.

We share only what a recipient needs to do its job, and only with these categories of recipient:

• Delivery executives and logistics partners — your name, phone number and delivery address, so the goods reach you.
• Suppliers and warehouses fulfilling part of an order — the delivery address and the items, where they ship to you directly.
• Our payment gateway (Razorpay Software Private Limited) — the order amount and your contact details, to process payment and any refund.
• Our WhatsApp messaging provider — your mobile number and the message content, so the message can be delivered.
• Mapping and geocoding services (OpenStreetMap's Nominatim service, and map tiles) — an address or a coordinate, to turn one into the other. We cache the results so the same lookup is not repeated.
• Our infrastructure providers — database and application hosting, the image service that serves product photography, and Cloudflare, which fronts the site and supplies the bot check on the sign-in screen.
• Our analytics provider (Google Analytics, operated by Google) — usage data about how the site is browsed, as described in section 2. It does not receive your name, mobile number, address or order details from us.
• Our professional advisers — accountants and lawyers, under a duty of confidence.
• Government or law-enforcement authorities, where we are legally required to disclose, or where it is necessary to establish or defend a legal claim.
• A buyer or successor, if the business is sold or reorganised. You would be told before your data becomes subject to a different policy.

Most of what we send is transactional — your OTP, an order confirmation, a dispatch or delivery update, a payment link, an invoice. These are part of the service you asked for, so they are not marketing and cannot be switched off while you have an active order.

If we ever send you offers or promotional messages, they will be clearly marked and you can opt out — reply STOP on WhatsApp, or write to us. Opting out of promotions does not stop messages about an order.

We keep this small. We use:

• A session cookie that keeps you signed in. It holds a random, meaningless token — your identity is looked up server-side, so the cookie itself reveals nothing about you even if it is read.
• Local storage in your browser for your chosen delivery location, your cart, and small interface preferences. This stays on your device.
• Analytics cookies set by Google Analytics on our site, which tell repeat visits apart from new ones so we can count usage accurately. You can block them in your browser settings, or with Google's Analytics opt-out add-on, without affecting anything else on Homfly.

We do not run third-party advertising or cross-site tracking cookies, and we do not use analytics data for advertising. Clearing your browser storage will sign you out and empty your cart; it does not delete your account.

• Account details — while your account is open, and for a reasonable period afterwards.
• Orders and invoices — at least 8 years, which is what Indian tax and company law requires us to retain financial records for. We cannot delete these on request while that obligation runs.
• OTP records — minutes. They expire and are cleared.
• Server and security logs — a short rolling window, then discarded.

When data is no longer needed for the purpose it was collected for, and no law requires us to hold it, we delete it or irreversibly anonymise it.

All traffic between your device and Homfly is encrypted in transit. Sign-in uses one-time passwords rather than reusable passwords; sessions are opaque server-side tokens that can be revoked. Staff access to the admin system is restricted by role, requires a second factor, and is logged.

No system is perfectly secure, and we do not claim otherwise. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as the law requires.

The Digital Personal Data Protection Act, 2023 provides rights to individuals in relation to their personal data. As the applicable provisions come into force, you may have the right to:

• Know what personal data of yours we hold and who we have shared it with;
• Correct anything inaccurate, and complete anything missing — most of it you can edit yourself under Account;
• Erase your data, where we are not legally required to keep it (see section 8 on invoices);
• Withdraw consent you have given, which may mean we can no longer provide parts of the service;
• Nominate someone to exercise these rights on your behalf if you die or become incapacitated;
• Complain — to us first, and then to the Data Protection Board of India, where applicable.

To exercise any of these, write to [email protected] from the email on your account, or message us from your registered mobile number. We may need to verify it is really you before we act — that verification protects you. We respond within 15 days.

Homfly is for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, tell us at [email protected] and we will delete it.

Your data is stored on servers operated by our infrastructure providers. Some of these — and some of the services in section 5 — may process data outside India. Where they do, we rely on contractual protections with those providers, and on transfers being to countries not restricted by the Government of India under the DPDP Act.

We will update this page when our practices change. The date at the top tells you when it last changed. If a change materially affects how we use your data, we will tell you — by a notice in the app or a message to your registered number — before it takes effect.

For anything about this policy or your data:

• Founder, Homfly Building & Interior Materials
• [email protected]
• 360 P, Sector 28, DLF Phase 1, Gurgaon, Haryana 122002, India
• +91 7303683067

We acknowledge every request within 1 working day. If you are not satisfied with how we handle it, you may complain to the Data Protection Board of India, where applicable.