Metalloid Card · Last updated: [26 september 2026]

Your privacy matters to us, especially because our work involves your bank card. This Privacy Policy explains, in plain language, what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have.

This policy applies to www.metalloidcard.com, our Instagram, WhatsApp and other social channels, and our walk-in store in Jaipur (the "Services"). The Services are operated by [Metalloid card], GSTIN [08CXSPS4005E2Z8], 3092, Jat ke Kuwe ka Rasta, 6th Crossing, Chandpole, Jaipur, Rajasthan – 302001, India ("Metalloid", "we", "us", "our").

We follow the Digital Personal Data Protection Act, 2023 and its Rules, the Information Technology Act, 2000 and related rules, and, where they apply to you, international privacy laws such as the EU/UK GDPR.

---

Quick summary

• We never ask for and never store your PIN, CVV, OTP or banking passwords.
• We do not record or store your card number. We handle your physical card or chip only to make your metal card.
• Online payments are processed by Razorpay. We do not see or store your full card details.
• We use your data only to fulfil orders, provide support, meet legal requirements and, with your consent, for marketing.
• We do not sell your personal data.
• You can ask us to access, correct or delete your data at any time: care@metalloidcard.com.

---

1. What personal data we collect

Information you give us

• Contact and identity details: name, phone number, email address, delivery and billing address.
• Order details: products ordered, design choices, names or text to engrave, artwork or logos you upload, design approvals.
• Communication records: messages, emails, WhatsApp chats, call notes and support requests.
• Photos and videos you send us (for example, unboxing videos for a damage claim).
• Reviews and feedback you post.

Your physical bank card or chip

When you use our Chip Transfer Service, you send us your card or its cut-out chip. We handle it only to transfer the chip into your metal card and return it to you. We do not photograph, copy, record, scan or store your card number, expiry date, CVV or chip data. The chip's stored data is controlled by your bank and is not read or accessed by us.

Payment information

Online payments are processed by Razorpay, a PCI-DSS compliant payment gateway. We receive only a payment confirmation, transaction ID and limited details (such as payment method type and the last 4 digits, where provided by the gateway). For COD refunds, we may ask for bank account or UPI details in your name, used only to send the refund.

Information collected automatically

When you visit our website, our e-commerce platform (Shopify) and analytics tools may collect your IP address, device and browser type, pages visited, time spent and referring website, using cookies and similar technologies (see Section 7).

In our walk-in store

We may collect your contact details to create your order. [If applicable: Our store is monitored by CCTV for security. Footage is kept for [30] days unless needed for an investigation.]

---

2. Why we use your data

Purpose	Legal basis
Processing and delivering your order, including design and production	Your consent / to perform our contract with you
Returning your bank card or chip securely	Your consent / contract
Customer support, warranty claims, returns and refunds	Your consent / contract
Invoicing, GST and legal record-keeping	Legal obligation
Preventing fraud, misuse and unauthorised card use	Legitimate use / legal obligation
Improving our website and products	Consent (for non-essential cookies) / legitimate use
Sending offers and updates by email, SMS or WhatsApp	Your consent only – you can opt out anytime
Posting photos of your finished card on social media	Your consent only – card details always hidden

We collect only the data we need for these purposes.

---

3. Who we share your data with

We share personal data only as needed, and only with:

• Payment gateway: Razorpay, to process payments and refunds.
• E-commerce platform: Shopify, which hosts our online store and order records.
• Courier and logistics partners: to deliver your order and track shipments (name, phone, address).
• Communication tools: such as WhatsApp Business and email providers, to talk with you.
• Analytics and advertising partners: such as Google and Meta, using cookie data, only where you allow it.
• Professional advisers: accountants, auditors and lawyers, under confidentiality.
• Government or legal authorities: only when required by law, court order or to prevent fraud or crime.

These partners may only use your data to provide services to us. We never sell or rent your personal data.

---

4. International data transfers

Some of our service providers (such as Shopify, Google and Meta) may store or process data on servers outside India. Where this happens, we rely on those providers' security and contractual safeguards and transfer data only as permitted under Indian law. If you are in the EU or UK, such transfers are made using appropriate safeguards such as standard contractual clauses.

---

5. How we protect your data

• Our website uses SSL/HTTPS encryption.
• Payments are handled by a PCI-DSS compliant gateway; we never see full card details.
• Physical cards and chips are kept in a secure, locked area and handled only by authorised staff.
• Access to customer data is limited to staff who need it for their work.
• We do not keep any record of your card number, CVV or PIN.

No method of storage or transmission is 100% secure, but we take reasonable security practices and procedures to protect your data. If a personal data breach affects you, we will inform you and the relevant authorities as required by law.

---

6. How long we keep your data

• Order and invoice records: as long as required by tax and accounting laws (typically up to 8 years).
• Design files and approvals: up to [3] years, so we can remake your card (e.g., for expiry replacement) and resolve disputes.
• Support and communication records: up to [3] years after your last order.
• Marketing data: until you withdraw consent.
• Photos/videos for damage claims: until the claim is resolved, plus [1] year.
• Your physical card or chip: returned to you with your order. Any unusable plastic card material is destroyed securely unless you ask for it back.

After these periods, we delete or anonymise your data.

---

7. Cookies

Cookies are small files stored on your device. We use:

• Essential cookies: needed for the cart, checkout and security. These cannot be switched off.
• Analytics cookies: help us understand how visitors use our site.
• Marketing cookies: help us show relevant ads on platforms like Instagram and Google.

You can accept or reject non-essential cookies through our cookie banner, and manage cookies in your browser settings. Blocking essential cookies may stop parts of the website from working.

---

8. Your rights

You have the right to:

• Access a summary of the personal data we hold about you and how we use it.
• Correct or update inaccurate or incomplete data.
• Erase your data when it is no longer needed (except where we must keep it by law, such as invoices).
• Withdraw consent at any time, for example to stop marketing messages. This does not affect processing done before withdrawal.
• Nominate a person to exercise your rights in case of death or incapacity.
• Raise a grievance with us and, if unresolved, with the Data Protection Board of India.

If you are in the EU/UK, you also have rights to data portability, restriction and objection, and may complain to your local data protection authority.

To use any right, email care@metalloidcard.com with the subject "Privacy Request". We may need to verify your identity before acting. We will respond within the time required by law, and in any case within 30 days.

---

9. Marketing messages

We will send you promotional messages only if you agree. You can opt out at any time by clicking "unsubscribe" in an email, replying "STOP" on WhatsApp/SMS, or contacting us. Order updates and service messages will still be sent, as they are necessary to fulfil your order.

---

10. Children

Our products and services are for people aged 18 and above. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

---

11. Links to other websites

Our website may link to Instagram, YouTube, Pinterest, Google Maps and other sites. We are not responsible for their privacy practices. Please read their policies.

---

12. Grievance Officer

Name: [Rohit soni] Email: care@metalloidcard.com Phone / WhatsApp: +91 8503999933 Address: 3092, Jat ke Kuwe ka Rasta, 6th Crossing, Chandpole, Jaipur, Rajasthan – 302001 Hours: [Monday–Saturday, 10:00 AM–7:00 PM IST]

We will acknowledge your privacy complaint within 48 hours and aim to resolve it within 30 days.

---

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here with a new "Last updated" date and, for significant changes, notify you by email or on our website.

---

14. Contact us

Email: care@metalloidcard.com · WhatsApp: +91 85039 99933 · Walk-in store: Chandpole, Jaipur, Rajasthan