INDRALOKA

— Privacy —

◇What we collect, what we don't.

Indraloka is built on the principle that the less we know about you, the less we can leak. We collect only what we need to ship your order, run the protocol, and follow the law. Everything below is what that means in practice.

Last updated: 11 May 2026

— I — What we collect

The minimum to make this work.

We collect only what's needed to fulfill your order, run the protocol, or comply with Indian law. Specifically:

From shoppers (web2)

From wallet users (web3)

From creators

Automatic from any visitor

What we do NOT collect We do not ask for date of birth, ID documents, social security numbers, or any KYC-grade identification. We do not maintain advertising profiles. We do not sell or rent your data to anyone, ever.

— II — What we use it for

Operational, not marketing.

When we run paid advertising campaigns, we use conversion pixels to attribute a visit to the ad that brought you (so we know which ads work) and we may build campaign-specific audiences with the ad platforms for follow-up promotion. We do not sell your data, build cross-site behavioural profiles beyond what the ad platforms themselves do, or train external AI systems on it.

— III — Who we share with

Three categories. That's it.

  1. Service providers we cannot operate without. Currently: Qikink (manufacturing & shipping — receives your shipping address and order details), Razorpay (INR payments — handles card data we never see), Pinata (NFT metadata pinning — receives your wallet address and asset metadata), our hosting provider (server logs, encrypted database). These vendors are bound by their own privacy obligations and process data only on our instructions.
  2. Advertising platforms — only when we're running campaigns. When you visit a page reached through one of our paid ads, we load a conversion pixel from the platform that brought you. We may run campaigns with Google Ads, Meta (Facebook & Instagram), X (Twitter), and similar networks, with more added as we expand. These pixels are loaded via Google Tag Manager and share a record of your visit with the platform that ran the ad so they can attribute the conversion. We do not share order, payment, or wallet details with these platforms — only the fact that a visit happened and (if you complete checkout) that a purchase happened, without line-item detail.
  3. Public blockchains. Anything you sign or send on Ethereum is permanently public — wallet addresses, mints, burns, transfers, redemptions. We don't push extra information on-chain beyond what the protocol requires.
  4. Legal authority on lawful request. If we receive a valid legal order from an Indian authority compelling disclosure of specific records, we comply with the minimum required by the order. We do not volunteer information.

We have never sold user data. We never will.

— IV — On-chain & wallet data

Public by design.

Ethereum is a public ledger. Once you connect your wallet to Indraloka, interact with our contracts, or burn/transfer/redeem any token, that action is permanently recorded on Ethereum and visible to anyone with a block explorer.

Indraloka cannot edit, delete, or "forget" on-chain activity. If you want privacy on your purchases, consider using a fresh wallet for each order or routing through a privacy-preserving relay before transacting. We do not provide privacy infrastructure beyond what Ethereum itself offers.

— V — Payments

Card data never touches our servers.

Card and bank details for INR purchases are handled entirely by Razorpay, a PCI-DSS Level 1 compliant payment processor. We receive a payment ID and status; we never see your card number, CVV, expiry, or bank credentials. Cryptocurrency payments flow through smart contracts directly — no credentials are exchanged off-chain.

For refunds in INR, we ask Razorpay to issue the refund to the original payment method. For PRANA refunds, we send PRANA to the wallet you transacted with. We never request seed phrases, private keys, or wallet passwords for any reason.

— VI — Cookies & storage

Functional, not advertising.

We use a small set of browser storage items, all functional:

You can clear these at any time through your browser settings. Doing so will reset cart state and require you to reconnect your wallet on next visit, but does not delete your account or order history on our side.

— VII — Retention

How long we keep what.

— VIII — Your rights

What you can ask us to do.

You can write to connect@indraloka.shop with any of the following requests. We respond within 30 days:

For verification, we may ask you to send the request from the email address on the account, or to sign a message from the wallet address in question.

What we cannot delete On-chain records (mints, burns, transfers, redemptions on Ethereum) are outside our control. No one — including us — can delete them. Tax records of completed orders must be retained for the period required by Indian law.

— IX — Changes to this policy

If something changes, we tell you.

We may update this policy as the protocol grows, vendors change, or law evolves. Material changes that affect what we collect or how we use it will be communicated to active users by email, and the "Last updated" date above will reflect the change. Minor wording or structural edits may happen without notice.

For any privacy question or concern, write to connect@indraloka.shop. We're a small team — your message goes to a person.