What we collect, why we collect it, and how to make us delete it. Written to be read, not to be skipped.
Last updated 2 November 2026 · Operated by Aaroh Naturals, Pune, Maharashtra, India · FSSAI Lic. No. 11525079000402.
This site is operated by Aaroh Naturals, trading as Desi By Nature, from Pune, Maharashtra, India. We are the data fiduciary for the information described on this page. Reach us at care@desibynature.in or +91-9112345165.
What an order needs, what the site needs to work, and what helps us understand visits and remind you about your order or cart.
We do not ask for, and have no use for, your date of birth, gender, PAN, Aadhaar or any other government identifier.
We run a first-party visit log so we can see which of our own posts and reels actually lead to orders. It stores a random visitor id in a cookie on this domain — no name, no email, nothing that identifies you personally — alongside the campaign tag on the link you clicked. That cookie lasts up to 180 days.
Alongside it we set a session cookie that keeps your cart and your sign-in alive, and a cookie remembering an applied coupon. These are strictly necessary: without them the cart empties between pages.
We do not sell this visit log, we do not join it to any third-party profile, and it never leaves our own server. Clearing your cookies clears it, and the site keeps working.
Since 17 September 2026 we also use Google Analytics, to understand how people use the site and where they give up before buying, so we can fix those pages. It sets its own cookies (named _ga) that count visits and pages viewed, and it records which products are viewed, added to a cart and ordered, with their prices and the order total. It is never sent your name, email address, phone number or delivery address. We have switched off Google’s advertising features for it: the data is not used to personalise ads or joined to your Google account by us. You can block it with your browser’s tracker protection or Google’s opt-out add-on, and the site keeps working.
Since 15 October 2026 we also use the Meta pixel, to measure visits and whether Facebook and Instagram activity leads to sales. It sets Meta’s cookies and reports page views, products viewed, items added to a cart, checkout steps and purchases with their value. Meta also receives your IP address and browser details, and can use this under its own terms, including linking it to your Facebook or Instagram account. You can limit this with your browser’s tracker protection or in your Meta ad settings, and the site keeps working.
We also use small cookies to remember a referral link you arrived on, your language choice and, on our ghee product pages, the result of the state check described below (up to 60 days).
These are the outside services we use, and what each one receives.
We do not sell or rent your details to anyone, and we do not give your name, address or order details to data brokers or other sellers. We will disclose data to a public authority only where the law requires it.
Order records, invoices and the addresses on them are kept for eight years, because Indian tax law requires books of account to be retained that long. Account details are kept until you ask us to delete the account. The visit log, unfinished-cart records and WhatsApp messages are not currently deleted on a fixed timetable; ask us and we will delete yours, apart from anything we must legally keep.
You can ask us at any time to show you what we hold about you, correct anything that is wrong, delete your account, or stop sending you reminders and offers by email or WhatsApp. Refill reminders also have their own stop link. Write to care@desibynature.in from the address on the order and we will action it within seven working days, free of charge.
One limit worth stating plainly: we cannot delete an invoice for an order that was actually delivered, because we are required to keep it. We can delete everything else, and we will.
The whole site runs over HTTPS. Passwords are stored as bcrypt hashes and are never recoverable in plain text. Payment details never reach us at all. Admin access is restricted to named accounts with individual logins.
No system is perfect. If we ever discover a breach affecting your data, we will email you directly and tell you what happened and what to do — we will not bury it in a policy update.
When this page changes materially, the "last updated" date above changes with it and, where the change affects how we handle data you have already given us, we email you. Continuing to use the site after a change means you accept the updated policy.