Privacy Policy

How we collect, use, and protect your personal information.

Last updated: July 2026

Who We Are

LayerPop ("we", "us", "our") is an Indian D2C brand selling handcrafted 3D-printed home decor, nameplates, and personalised gifts. Our website is www.layerpop.in.

What Data We Collect

We collect the following personal data when you interact with us:

Name, phone number (+91), email address — provided when you submit a custom order request.
Delivery address — collected via WhatsApp during order confirmation.
Custom order description — the idea or design details you submit via the Custom Order form.
Browsing and device data — collected via Google Analytics 4 (page views, session duration, device type, approximate location), only after you accept analytics in the cookie banner.
Anonymous product-view statistics — when you view a product we record the product, time, device type (mobile/desktop), the website that referred you (site name only), and approximate location where available. Your IP address is not stored with these records; a one-way scrambled code derived from it (which changes every day and cannot be traced back to you) lets us count unique visitors. These records are deleted automatically after 90 days.
IP address (temporarily) — our servers briefly store your IP address for rate limiting to prevent abuse. It is deleted automatically within about 20 minutes and is never used for analytics or marketing.
How you found us — if you arrive via a marketing link or another website, we note the campaign or referring site name for the duration of your visit, and save it with your order if you place one.

We do not collect payment card details. Payment is handled via WhatsApp-coordinated UPI / bank transfer.

Why We Collect It

To confirm and fulfil your order.
To respond to your custom order request.
To share order updates, tracking information, and customer support via WhatsApp or email.
To analyse website traffic and improve the user experience (GA4).

Third Parties We Share Data With

Google Analytics (GA4) — analytics data is sent to Google servers in the USA. Google's Privacy Policy applies.
Amazon Web Services (AWS S3 / CloudFront) — product images and media files are stored on AWS servers (region: ap-south-1, India). Some data may be replicated globally by the CDN.
WhatsApp (Meta) — order conversations are conducted via WhatsApp. Meta's privacy policy applies to messages sent on their platform.

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

Data Retention

Order data (name, address, items) is retained for 3 years as required under GST and accounting laws.
Custom order form submissions are retained until the request is resolved and then for 1 year thereafter.
Analytics data retention follows Google Analytics default settings.
Anonymous product-view statistics are deleted automatically after 90 days.
Rate-limiting IP records are deleted automatically within about 20 minutes.

Your Rights (DPDP Act, 2023)

Under India's Digital Personal Data Protection Act, 2023, you have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Request erasure of your data (subject to legal retention obligations).
Withdraw consent for analytics — decline in the cookie banner, or clear this site's data in your browser to be asked again.

Cookies, Analytics & Data Stored in Your Browser

Google Analytics is off by default. Its cookies are set only after you press Accept in the cookie banner; if you decline, no analytics cookies are set. No personally identifiable information is stored in these cookies. You can also install the Google Analytics Opt-out Browser Add-on.

To make the store work, we also keep some data in your browser's own storage (it stays on your device and is not sent to us until you act):

Your cart — the items you have added.
Your saved details — name, phone, and delivery address you typed at checkout, so repeat orders are faster. They are sent to us only when you place an order. Clear your browser data to remove them.
Your cookie choice — whether you accepted or declined analytics.
Your last custom-request reference — so you can find your request again.
Visit source — the campaign or referring site that brought you here, kept for the current visit only.

Security

Our website is served over HTTPS (SSL/TLS encrypted). Data stored in our database is hosted on MongoDB Atlas with access controls. We take reasonable precautions to protect your data but cannot guarantee absolute security of internet transmissions.

Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the website after changes constitutes acceptance of the updated policy.

What Data We Collect

We collect the following personal data when you interact with us:

Name, phone number (+91), email address — provided when you submit a custom order request.

Delivery address — collected via WhatsApp during order confirmation.

Custom order description — the idea or design details you submit via the Custom Order form.

Browsing and device data — collected via Google Analytics 4 (page views, session duration, device type, approximate location), only after you accept analytics in the cookie banner.

Anonymous product-view statistics — when you view a product we record the product, time, device type (mobile/desktop), the website that referred you (site name only), and approximate location where available. Your IP address is not stored with these records; a one-way scrambled code derived from it (which changes every day and cannot be traced back to you) lets us count unique visitors. These records are deleted automatically after 90 days.

IP address (temporarily) — our servers briefly store your IP address for rate limiting to prevent abuse. It is deleted automatically within about 20 minutes and is never used for analytics or marketing.

How you found us — if you arrive via a marketing link or another website, we note the campaign or referring site name for the duration of your visit, and save it with your order if you place one.

We do not collect payment card details. Payment is handled via WhatsApp-coordinated UPI / bank transfer.

Third Parties We Share Data With

Google Analytics (GA4) — analytics data is sent to Google servers in the USA. Google's Privacy Policy applies.

Amazon Web Services (AWS S3 / CloudFront) — product images and media files are stored on AWS servers (region: ap-south-1, India). Some data may be replicated globally by the CDN.

WhatsApp (Meta) — order conversations are conducted via WhatsApp. Meta's privacy policy applies to messages sent on their platform.

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

Data Retention

Order data (name, address, items) is retained for 3 years as required under GST and accounting laws.

Custom order form submissions are retained until the request is resolved and then for 1 year thereafter.

Analytics data retention follows Google Analytics default settings.

Anonymous product-view statistics are deleted automatically after 90 days.

Rate-limiting IP records are deleted automatically within about 20 minutes.

Your Rights (DPDP Act, 2023)

Under India's Digital Personal Data Protection Act, 2023, you have the right to:

Access the personal data we hold about you.

Correct inaccurate data.

Request erasure of your data (subject to legal retention obligations).

Withdraw consent for analytics — decline in the cookie banner, or clear this site's data in your browser to be asked again.

Cookies, Analytics & Data Stored in Your Browser

To make the store work, we also keep some data in your browser's own storage (it stays on your device and is not sent to us until you act):

Your cart — the items you have added.

Your saved details — name, phone, and delivery address you typed at checkout, so repeat orders are faster. They are sent to us only when you place an order. Clear your browser data to remove them.

Your cookie choice — whether you accepted or declined analytics.

Your last custom-request reference — so you can find your request again.

Visit source — the campaign or referring site that brought you here, kept for the current visit only.