1. Introduction
amonaar ("we", "us", or "our") is committed to protecting the privacy of visitors to our website and users of our services. This Privacy Policy explains what information we collect, how we use it, and the choices you have regarding your personal data.
By accessing our website or using our services, you agree to the practices described in this policy. This policy applies to all visitors, regardless of whether you have an account with us.
2. Information We Collect
We collect information in the following categories:
2.1 Information You Provide
- Contact form: Name, email address, company name, and your message.
- Payment page: Name, email, phone number, payment type (advance or balance), invoice number, and amount.
- Admin account: Username, password (stored as a bcrypt hash — never in plain text), name, and email.
2.2 Information Collected Automatically
- IP address: Used for security, rate limiting, and brute-force protection.
- Browser & device data: Browser type, operating system, and pages visited.
- Session data: A session cookie is set when you visit our site or log in. This cookie is HttpOnly, Secure (over HTTPS), and SameSite=Lax.
2.3 Information from Payment Gateways
- Razorpay: Transaction ID, payment status, and amount. We do not store card numbers, CVV, or net banking credentials — Razorpay handles all sensitive payment data on their PCI-DSS compliant infrastructure.
3. How We Use Your Information
We use the information we collect for the following purposes:
- To respond to your inquiries submitted via the contact form.
- To process and track payments made through our website.
- To send you payment confirmations and receipts.
- To provide customer support and resolve disputes.
- To protect our website from spam, abuse, and fraudulent activity.
- To improve our website, services, and user experience.
- To comply with legal obligations under applicable Indian laws.
We do not sell, rent, or trade your personal information to third parties for marketing purposes.
4. Cookies & Session Data
Our website uses a single session cookie to maintain your session (required for the contact form CSRF token and admin login). This cookie:
- Is marked HttpOnly — JavaScript cannot access it (protects against XSS theft).
- Is marked Secure — transmitted only over HTTPS in production.
- Is marked SameSite=Lax — blocks cross-site request forgery.
- Expires when you close your browser.
We do not use third-party tracking cookies, advertising cookies, or analytics cookies. Google Fonts may set cookies when loading fonts; you can block this with browser extensions if desired.
5. Payment Information
When you make a payment through our website, your payment is processed securely by Razorpay, a PCI-DSS Level 1 certified payment gateway. We receive only the following from Razorpay after a successful transaction:
- Razorpay Order ID and Payment ID (for record-keeping).
- Payment status (paid, failed, refunded).
- Transaction amount and currency.
We never see, store, or have access to your card number, CVV, expiry date, or net banking password. These details are entered directly on Razorpay's encrypted checkout page and never pass through our servers.
For UPI payments, the QR code encodes our merchant UPI ID and the payment amount. The transaction is settled directly to our bank account by your UPI app. We verify UPI payments against our bank statement before marking them as confirmed.
6. Information Sharing & Disclosure
We share your information only in the following circumstances:
- Payment processors: Transaction data is shared with Razorpay to process your payment.
- Service providers: Hosting provider (server infrastructure) and email service (for sending responses to your inquiries).
- Legal compliance: If required by law, court order, or government authority under the Information Technology Act, 2000 or other applicable Indian legislation.
- Business transfer: In the event of a merger, acquisition, or asset sale, customer data may be transferred as part of the transaction — you will be notified via email before this happens.
7. Data Security
We implement industry-standard security measures to protect your data:
- SQL injection protection: All database queries use PDO prepared statements.
- XSS protection: All user-supplied data is escaped with
htmlspecialchars() before output.
- CSRF protection: All forms require a cryptographic token verified server-side.
- Password hashing: Admin passwords are stored using bcrypt (PHP
password_hash()).
- HTTPS enforcement: All traffic is redirected to HTTPS via
.htaccess.
- Rate limiting: Form submissions and login attempts are rate-limited to prevent abuse.
- Session security: Session IDs are regenerated on login (prevents session fixation).
- Security headers: X-Frame-Options (DENY), X-Content-Type-Options (nosniff), HSTS.
- Server-side input validation: All inputs are validated and length-limited.
Despite these measures, no method of transmission over the Internet is 100% secure. If a data breach occurs, we will notify affected users within 72 hours as required under the Digital Personal Data Protection Act, 2023.
8. Data Retention
We retain your data for the following periods:
- Contact form submissions: 2 years from the date of submission, then permanently deleted.
- Payment records: 7 years (as required for tax and accounting purposes under Indian law).
- Admin user accounts: Until the account is deleted by an administrator.
- Rate limit logs: Automatically purged after 1 hour.
- Session data: Destroyed when you close your browser or log out.
9. Your Rights
Under the Digital Personal Data Protection Act, 2023 (DPDP Act), you have the following rights regarding your personal data:
- Right to access: You can request a copy of the personal data we hold about you.
- Right to correction: You can request correction of inaccurate or incomplete data.
- Right to erasure: You can request deletion of your personal data (subject to legal retention requirements for payment records).
- Right to withdraw consent: You can withdraw consent for data processing at any time.
- Right to data portability: You can request your data in a machine-readable format.
- Right to grievance redressal: You can file a complaint with our Grievance Officer (see Contact section below).
To exercise any of these rights, email us at info@amonaar.com with the subject line "Data Protection Request". We will respond within 30 days.
10. Children's Privacy
Our website is intended for business use and is not directed at children under the age of 18. We do not knowingly collect personal information from individuals under 18. If you believe a minor has provided us with personal data, please contact us and we will promptly delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For significant changes (such as new data practices or new services), we will post a prominent notice on the homepage for at least 30 days before the change takes effect.
We encourage you to review this page periodically to stay informed about how we protect your information.
If you have any questions about this Privacy Policy, or if you wish to exercise your data protection rights, please contact our Grievance Officer: