Privacy Policy

Section 01

Who we are

Mohar is a brand owned and operated by Millions Kart Private Limited, registered in India at Plot No-13, Pabhat, Chandigarh-Ambala Road, Derabassi, Zirakpur, SAS Nagar, Punjab, 140603. In this policy, "Mohar", "we", "us" and "our" mean Millions Kart Private Limited acting through the Mohar brand. "You" means anyone who visits our website, buys from us, uses the Mohar app, or contacts us.

For the purposes of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described here. Where the UK GDPR or EU GDPR applies to a visitor, we act as the data controller.

Section 02

Personal data we collect

We collect only what we need to sell you a Mohar, deliver it, make the app work, and answer you when something goes wrong. We do not buy personal data from data brokers, and we do not sell yours.

We never see your full card number. Card, UPI and netbanking details are entered directly with our payment providers and are processed on their systems, not ours.

Section 03

Where this data comes from

• Directly from you, when you place an order, create an account, set up the app, subscribe to updates, or write to us.
• Automatically, through cookies, pixels and similar technologies as you use the website and the app.
• From our service providers, such as our store platform, payment gateways, courier and logistics partners, and analytics tools.
• From your device, with your permission, for the specific app permissions described in Section 05.

Section 04

How we use your data

To run the service

Taking and confirming orders, taking payment, shipping and tracking, handling returns, refunds, replacements and warranty claims, operating your account, pairing your Mohar to the app, and providing customer support.

To improve the product

Understanding which pages and features are used, diagnosing bugs and crashes, and testing changes to the site and the app. Wherever it is enough for the purpose, we use aggregated or de-identified data rather than data that identifies you.

To communicate with you

Sending order confirmations, dispatch and delivery updates, setup guidance, service notices, and, where you have consented, offers and new product news.

To keep things safe and lawful

Detecting and preventing fraud, abuse of offers, chargeback fraud and misuse of the app, protecting our rights and yours, and meeting our obligations under Indian tax, consumer protection, and data protection law.

Legal basis

In India we process personal data on the basis of your consent, or for the legitimate uses permitted under the DPDP Act, 2023, including where you have voluntarily given us data for a purpose you have not objected to, and where processing is needed to comply with the law. Where the GDPR applies, we rely on contract performance, legitimate interests, legal obligation, or consent, as the case may be.

Section 05

The Mohar app, and what it does not see

The Mohar app needs certain permissions to block apps when you tap your device. This is the part people most want to be sure about, so here it is precisely.

• NFC. Used only to read the tag inside your Mohar so the app knows a tap happened. It does not read any other tag data or transmit anything from your phone to the device. Your Mohar has no battery, no chip that stores data about you, and no internet connection.
• Focus, Screen Time or Accessibility permissions. Used only to place the apps you selected into a blocked state for the length of a session and to release them afterwards. On iOS, app selection is handled through Apple's Screen Time framework, which means your chosen app list stays on your device and is not readable by us.
• Notifications. Used to tell you a session started, is ending, or has ended.
• Session history. Stored so you can see your own streaks and totals. You can clear it from the app at any time.
• No browsing history, no message content, no microphone, no camera, no contacts, no continuous location. The app does not request these permissions.

If you delete the app, the local session data on your device goes with it. To also remove the account and pairing records held on our side, see Section 13.

Section 06

Who we share your data with

We share personal data only with partners who need it to do a specific job for us, and only to the extent required for that job. They are bound to protect it and may not use it for their own purposes.

We do not sell your personal data, and we do not share it with anyone for their own independent marketing.

Section 07

Our relationship with Shopify

Our online store is hosted by Shopify. Shopify provides the platform that lets us sell to you and processes personal data on our instructions as our service provider. Shopify also collects certain data on its own account to operate, secure and improve its platform. Shopify's own privacy practices are described in its privacy policy, available on shopify.com.

Section 08

Cookies and similar technologies

Cookies are small files placed on your device. We and our partners use them for four things:

• Strictly necessary. Keeping you signed in, remembering your cart, securing checkout. These cannot be switched off without breaking the store.
• Performance and analytics. Understanding which pages are visited, where people drop off, and how sessions behave, including session replay and heatmap tools.
• Functional. Remembering your preferences, such as language or region.
• Advertising. Measuring the results of our ads and, where you have consented, showing you relevant ads on other platforms.

You can block or delete cookies through your browser settings, and you can control ad personalisation in the settings of the relevant ad platform. Blocking necessary cookies may stop parts of the store from working.

Section 09

Marketing, email and WhatsApp

We send transactional messages about your order regardless of marketing preferences, because you need them. Promotional messages by email, SMS or WhatsApp are sent only where you have opted in.

You can opt out at any time by using the unsubscribe link in any email, replying STOP to a WhatsApp or SMS message, or writing to us at the address in Section 16. Opting out of marketing does not stop order and service messages.

Section 10

Third party websites and links

Our website and app link to places we do not control, such as the App Store, Google Play, Instagram, YouTube and courier tracking pages. We are not responsible for how those sites handle your data. Read their policies before sharing anything with them.

Section 11

Children's data

Mohar is sold to adults. We do not knowingly collect personal data from anyone under 18 without verifiable consent from a parent or legal guardian, as required by the DPDP Act, 2023. Where a Mohar is bought for a child, the account and the app should be set up and held by the parent or guardian, who is responsible for that account.

We do not use children's data for tracking, behavioural monitoring or targeted advertising. If you believe a child has given us personal data without the required consent, write to us and we will delete it.

Section 12

Security and how long we keep data

We use reasonable technical and organisational safeguards, including encryption in transit, access controls, and restricting internal access to staff who need it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach affects you, we will notify you and the Data Protection Board of India as the law requires.

We keep personal data only as long as we need it for the purpose we collected it, and then for as long as the law requires:

• Order and invoice records for the period required under Indian tax and company law.
• Account and app data for as long as your account is active, and for a short period afterwards in case you return.
• Support conversations for as long as needed to resolve the issue and handle any related claim.
• Marketing consent records for as long as we send you marketing, and afterwards as proof that consent existed.

After that, we delete the data or de-identify it so it can no longer be linked to you.

Section 13

Your rights and choices

Subject to the law that applies to you, you can ask us to:

• Access a summary of the personal data we hold about you and how it is processed.
• Correct data that is inaccurate, and complete data that is incomplete.
• Erase data we no longer need for the purpose it was collected, or where you withdraw consent.
• Withdraw consent at any time, with effect going forward.
• Nominate another person to exercise your rights if you die or become incapacitated, as permitted under the DPDP Act.
• Object to or restrict certain processing, and receive a copy of your data in a portable format, where the GDPR applies.

To exercise any of these, write to us using the details in Section 16. We may ask you to confirm your identity before we act, and we will respond within the timelines set by the applicable law. There is no charge for a reasonable request.

A note on obligations. Under the DPDP Act, you are expected to give accurate information and not to file false or frivolous complaints. We mention this only because the Act does.

If you are not satisfied

Write to us first, at the address in Section 16. We acknowledge complaints within 48 hours and aim to resolve them within 30 days. If our response does not settle the matter, you may complain to the Data Protection Board of India. If you are in the UK or EU, you may complain to your local supervisory authority.

Section 14

International transfers

We are based in India and most of your data is processed here. Some of our service providers, including our store platform, analytics tools and app infrastructure, operate servers outside India. Where data is transferred abroad, we do so in line with the DPDP Act and any government restrictions in force, and we require our providers to apply protections comparable to those described in this policy. Where the GDPR applies, transfers rely on Standard Contractual Clauses or another approved mechanism.

Section 15

Changes to this policy

We update this policy when our practices, our tools or the law change. The version in force is always the one on this page, and the date at the top tells you when it last changed. If a change materially affects your rights, we will tell you by email or a notice on the site before it takes effect.

Section 16

Contact us

Real people read this inbox, usually within four hours during the day.