Privacy Policy

Axiverse Ventures Private Limited (CIN: U62013MH2025PTC457316, GSTIN: 27ABDCA7946A1ZS), operating under the brand name Forest Thread™ (“Company”, “we”, “our”, “us”), respects an individual’s privacy and is committed to protecting the same. This Privacy Policy (“Policy”) describes how we collect, use, disclose and transfer Personal Information (as defined below), through platforms controlled by the Company viz forestthread.com and mobile sites/applications (the “Platforms”) of the individuals who browse, or access the Platform or provide information on or through the Platform, or whose information the Company otherwise collects, receives or processes in connection with the offer and sale of its products (“Products”) (hereinafter, collectively referred to as “Customers”, “you”, “your”) and ensure its compliance with applicable laws and regulations. This Policy does not apply to Personal Information collected from you offline (unless otherwise specified), to the Company’s websites that do not link to this Policy, to Customers of countries other than India, or to third-party websites to which Platform may link.

By visiting our website or app, accessing and/or using our Platform, and providing the information as explained in this Policy, you consent to the collection and use of the information you disclose on the Platform in accordance with this Policy, including but not limited to your consent for sharing your information as per this Policy. We encourage you to read this Policy regarding the collection, use, and disclosure of your information. If you are not comfortable with any of the terms or policies described in this Policy, you may choose to discontinue usage of the Platform.

Further, you agree and consent to receive all communications related to our services on the mobile number provided by you to the Company, even if such mobile number is registered under the DND/NCPR list under the Telecom Commercial Communications Customer Preference Regulations, 2018 (“TRAI Regulations”). Notwithstanding your registration with the National Do Not Call Registry (In a Fully or Partly blocked category under the National Customer Preference Register set up under the Telecom Regulatory Authority of India), you hereby express your interest and accord informed consent to receive communications (including commercial communications) in relation to the Company’s services. You further confirm that no communication to you from the Company or on behalf of the Company shall be construed as Unsolicited Commercial Communication under Regulation 2(bw) of the TRAI Regulations and you have specifically opted to receive communications in this regard on the mobile number provided by you.

For the purpose of this Policy, the term “Personal Information” shall mean any information that relates to you, which, either directly or indirectly, in combination with other information available or likely to be available with the Company, is capable of identifying you, which is submitted to and/or collected over the Platform and maintained by the Company in an accessible form, provided that, any information that is freely available or accessible in the public domain or furnished under the Right to Information Act, 2005 or any other law for the time being in force shall not be regarded as Personal Information for the purposes of this Policy.

We communicate with you through a variety of means and channels, including our Platform, email, phone, or text messaging on your mobile phone, although we do generally note that our preferred means of communication is email which helps us provide you with the best service levels. Such communications may involve giving to you, as well as receiving information from you. We collect, receive, and store the Personal Information in the following detailed manners:

The Company collects, processes, and stores the Personal Information that you knowingly and voluntarily provide while using or interacting with our Platform. This encompasses, inter alia, the data you input into designated data fields during the voluntary account registration process, guest checkout procedures, or identity verification protocols, including mandatory one-time password (OTP) authentication for mobile phone numbers. We also collect and store your Personal Information through sponsored social media platforms, customer support interfaces, and events. For example, you may submit your legal name, billing and postal delivery addresses, e-mail address, phone number, and/or other requisite information in order to register an account, place orders for the Products, register for optional newsletters, receive promotional offers, contact the Company’s customer care service via email or WhatsApp, or respond to the Company’s surveys. To protect your privacy, you should not provide the Company with any information that is not specifically requested or that you do not wish to share. You can choose not to provide certain information, but in doing so, you might be precluded from utilizing our Platform, completing the checkout process, or accessing certain integrated features of our Platform.

We, along with our authorized third-party service providers, automatically gather, log, and store certain types of unidentifiable or technical information whenever you interact with us or access the Platform. Such passive information collection technologies include, but are not limited to, session cookies, cross-site request forgery (CSRF) security tokens, web beacons, and server logs. Your internet browser or mobile device automatically transmits to the Platform specific technical parameters, including but not limited to the URL of the website you just visited, the browser version and operating system your computer or device is operating, your IP address, and associated timestamps. Passive information collection technologies can make your use of the Platform easier by allowing the Company to provide better service, persist guest shopping cart data, manage user authentication states, compile statistics, analyze trends, and otherwise administer and improve the Platform. Certain critical features of the Platform, including secure checkout and cart persistence, will not function without the use of these passive information collection technologies. Information collected by these technologies cannot be used to identify you without additional identifiable information.

We might concurrently receive, aggregate, or synthesize information about you from external, third-party sources. This includes, without limitation, updated delivery, logistics, and address intelligence from our authorized courier partners, which we use to correct our internal records and deliver your subsequent purchases more efficiently. Furthermore, you may choose to participate in or authenticate via a third-party application or social media site (including, but not limited to, Google Sign-In or Facebook Login) through which you explicitly authorize us to collect, or the third party to share and import, Personal Information about you, such as your name and email address, subject to subsequent manual OTP verification by the Company. We may also receive information, such as marketing-related or demographic data about you, from third-party analytics and advertising partners to enhance our ability to tailor our content and offer you the Products that we believe may be of interest to you. The Company is not responsible for the privacy practices, data retention, or security protocols of such third-party websites or identity providers which it does not own, manage, or control.

The Company limits itself to collecting, processing, and retaining information which is strictly necessary to ensure the accurate provision of our services, facilitate the processing and fulfillment of your Product orders, execute refunds or exchanges, and continually optimize our Platform and Product offerings. We expressly categorize the Personal Information collected and processed by us into the following detailed classifications:

This category encompasses your full legal name, primary e-mail address, verified mobile phone number(s), billing address, shipping and postal delivery addresses, and country of residence. If you establish a registered account on the Platform, we further collect and retain your account credentials, including your username, cryptographically hashed and securely encrypted passwords, saved delivery addresses, active shopping cart contents, curated wishlists, and comprehensive historical records of past orders and checkout configurations.

You may provide payment information when you utilize the Platform to purchase our Products. However, the Company expressly disclaims the collection, processing, or internal server storage of any raw financial or payment instrument data (including, but not limited to, credit card or debit card numbers, Card Verification Values (CVVs), UPI PINs, or net banking credentials). All such sensitive financial data is directly captured and securely processed by our designated third-party, PCI-DSS compliant payment gateway infrastructure (Razorpay). The Company exclusively collects and maintains non-sensitive transaction metadata required for order fulfillment, reconciliation, and legal compliance, which comprises internal Order IDs, Razorpay Payment IDs, cryptographic response signatures, precise transaction amounts, and payment authorization statuses (e.g., Authorized, Captured, Failed).

We routinely collect technical data and related telemetry information whenever you access or interact with the Platform. This includes, but is not limited to, your Internet Protocol (IP) address, specific device types and identifiers, system and operating system architecture, application software and browser versions, referring and exit Uniform Resource Locators (URLs), date and time stamps, session durations, page view metrics, and scroll depth data. This technical information is gathered periodically to facilitate the provision of software updates, ensure Platform security, detect fraudulent activities, and analyze Customer traffic trends.

In the event that you voluntarily submit product ratings, reviews, or upload photographic depictions of Products, such user-generated content is collected and may be rendered publicly accessible on the Platform, accompanied by your submitted name or, in the absence thereof, your masked email identifier. Furthermore, we collect and systematically retain comprehensive records of your correspondence and interactions with our customer care and support services, whether conducted via electronic mail, telephony, or designated on-site chat and WhatsApp widgets to ensure quality assurance and expedite the resolution of your inquiries.

We may collect any open data and public records, such as information about you that is openly available on the Internet or furnished by third-party identity providers (such as Google or Facebook) during external login authentications, specifically limited to your name and email address, which is subsequently validated via our internal OTP verification systems.

The Company processes your Personal Information exclusively for explicit, specific, and lawful purposes necessary for our commercial operations, the enhancement of our services, the fulfillment of contractual arrangements, and compliance with statutory frameworks. We systematically collect and process your Personal Information for the following comprehensive purposes:

• Identity Verification and Account Administration: To authenticate and verify your identity during account registration, password recovery, and guest or account checkout operations via automated electronic mail confirmation mechanisms and mandatory mobile telephone one-time password (OTP) verification; to administer, maintain, and secure your registered account; and to manage your personalized preferences, wishlists, and shopping carts across browsing sessions.
• Order Fulfillment, Packaging, and Logistics: To execute, process, package, dispatch, and fulfill your Product purchases and commercial transactions; to generate and transmit statutory tax invoices, shipping labels, and receipt acknowledgments; and to coordinate with logistics partners to ensure the physical delivery, return, or replacement of ordered Products.
• Transactional and Operational Communications: To communicate vital, non-marketing updates concerning your account status, order confirmations, dispatch status, shipment transit tracking, delivery delays, transaction failures, security alerts, and administrative notifications via automated email, SMS, or telephony.
• Customer Care, Support, and Inquiries: To provide prompt, personalized customer support; to investigate and resolve grievances, order discrepancies, delivery bottlenecks, or technical Platform errors submitted through email, telephone, or messaging widgets (including WhatsApp); and to monitor and document correspondence records for training, audit, and quality assurance purposes.
• Targeted Marketing, Behavioral Advertising, and Cart Recovery: To deliver marketing communications, curated updates, and promotional offerings (subject to your explicit consent or existing transactional relationship); to dispatch automated abandoned cart notifications and follow-up prompts via email or SMS reminders; to analyze browsing habits and conversion pathways; and to deploy retargeted advertisements across third-party digital networks and social media platforms (utilizing technologies such as the Meta Pixel and Google Analytics) to generate tailored lookalike audiences and interest-based commercial displays.
• Platform Optimization, Research, and Analytics: To administer surveys, promotions, contests, and interactive features; to request, compile, and publicly display product ratings, reviews, and customer feedback; to monitor aggregate traffic patterns, scroll behavior, bounce rates, and demographic distributions; and to conduct internal operational research to benchmark service levels, debug software faults, and optimize user experience architecture.
• Fraud Prevention, Cybersecurity, and Loss Mitigation: To detect, investigate, prevent, and mitigate unauthorized account access, fraudulent electronic payments, malicious cyber incidents, automated bot intrusions, and breaches of our Terms Of Service, thereby safeguarding our Customers, digital infrastructure, and commercial integrity.
• Legal Compliance, Disputes, and Statutory Governance: To establish, exercise, substantiate, or defend legal claims in prospective or active litigation; to enforce our contractual terms and conditions; to seek legal and professional counsel; and to satisfy mandatory statutory disclosures and requests issued by judicial, regulatory, law enforcement, or governmental authorities operating under applicable Indian jurisdiction.

We ensure that every processing operation involving your Personal Information is grounded upon valid statutory bases recognized under the Digital Personal Data Protection Act, 2023 and associated legal mandates:

• Performance of a Contract: The processing is indispensable for entering into or executing our contractual obligations with you, such as the direct manufacturing, packaging, shipment, transit, and delivery of Products purchased through the Platform.
• Compliance with Legal Obligations: The processing and subsequent archival of transactional, tax, and billing data are required to adhere to binding legal statutes, including the Central Goods and Services Tax (CGST) Act, 2017, the Information Technology Act, 2000, and associated corporate accounting regulations.
• Consent: Where statutory provisions mandate explicit consent—including the transmission of optional newsletters, participation in surveys, or the activation of certain tracking cookies—we solicit your consent prior to processing. You reserve the unconditional right to withdraw such consent at any subsequent interval by transmitting an electronic request to forestthread@gmail.com, without affecting the lawfulness of processing undertaken prior to such withdrawal.
• Legitimate Uses and Business Purposes: We rely on recognized legitimate uses to advance operational security, detect and prevent identity theft and fraud, manage corporate restructuring, resolve customer service requests, and optimize the overall performance of the Platform.

The Company may generate and compile anonymized, pseudonymized, or statistical data from your interaction with the Platform. Such aggregated datasets are stripped of all identifying characteristics such that no individual can be directly or indirectly identified, re-identified, or singled out through any reasonable technical or operational means available to us. Consequently, aggregated and anonymized data does not constitute Personal Information under this Policy or applicable law. The Company reserves the unrestricted right to utilize, manipulate, analyze, and disseminate such aggregated metrics for research, commercial benchmarking, and Platform diagnostic optimization.

When you initiate a commercial transaction on the Platform to procure our Products, you are required to furnish sensitive financial information and payment credentials. To safeguard your financial privacy and maintain rigorous compliance with applicable banking regulations and industry mandates, the Company operates an indirect, tokenized payment capture mechanism:

All monetary transactions, electronic fund transfers, and payment processing functions executed on or through the Platform are routed through and managed exclusively by our designated third-party, PCI-DSS (Payment Card Industry Data Security Standard) Level 1 certified payment intermediary, Razorpay Software Private Limited (“Razorpay”). The sensitive financial information required to authorize, authenticate, and settle your transactions—including, without limitation, credit card or debit card numbers, expiration dates, Card Verification Value (CVV/CVC) numbers, bank account particulars, Unified Payments Interface (UPI) virtual payment addresses (VPA), or net banking authentication credentials—is entered by you directly into Razorpay’s secured, encrypted payment interface or hosted iFrame/redirection session.

The Company does not, under any circumstances, capture, intercept, process, view, host, or store your raw payment card credentials, CVV codes, net banking passwords, or personal financial secrets on our internal servers, application databases, or hosting environments managed by MilesWeb. Your submission of financial information is governed directly by Razorpay’s proprietary security infrastructure, encryption protocols, and distinct terms of service and privacy documentation. These authorized payment intermediaries are strictly bound by statutory Reserve Bank of India (RBI) directions, card network mandates, and contractual covenants that prohibit the retention, exploitation, or unauthorized disclosure of your payment credentials for any purpose other than facilitating authorized transaction processing and settlement on our behalf.

While raw payment credentials remain strictly confidential and isolated within Razorpay’s secure processing environment, our Platform databases automatically receive and retain non-sensitive transaction telemetry, reconciliation logs, and cryptographic responses transmitted via secure webhooks upon transaction completion or termination. This metadata includes, inter alia, the unique internal Order ID, Razorpay Transaction/Payment ID, cryptographic response signature, selected payment mode or rail (e.g., UPI, Net Banking, Credit Card, Debit Card), monetary currency, total transaction amount debited or refunded, date and time of transaction execution, and instantaneous authorization status (e.g., Initiated, Authorized, Captured, Failed, or Refunded). This metadata is strictly retained by the Company to verify payment settlement, prevent fraudulent chargebacks, generate legally compliant tax invoices, facilitate customer refunds or exchanges, and satisfy mandatory corporate accounting audits.

When executing payments on the Platform, you remain solely responsible for ensuring the confidentiality of your personal login devices, one-time passwords (OTPs) dispatched by your issuing bank, UPI authentication PINs, and secure internet connectivity. The Company disclaims all liability for unauthorized transactions, financial losses, or damages resulting from compromised user hardware, phishing exploits, malware, or the negligence of the Customer in disclosing authentication credentials to unauthorized third parties.

The Company adheres to a strict principle of data minimization and confidentiality. We do not sell, rent, lease, trade, or otherwise commercialize your Personal Information to any third-party marketing agencies, brokers, or external entities for their independent commercial gain. Access to your Personal Information is strictly restricted to authorized personnel, affiliates, and vetted third-party service providers who operate under strict contractual confidentiality obligations and are bound to process such data solely in accordance with our explicit instructions and this Policy.

We disclose, transfer, or share your Personal Information exclusively under the following circumstances and with the designated categories of recipients:

To consummate the physical delivery, fulfillment, tracking, and return of Products ordered through the Platform, we share essential contact and shipment parameters, specifically comprising your full legal name, shipping address, landmark particulars, postal pin code, and contact mobile phone number with our authorized logistics and courier partner, Delhivery Private Limited (“Delhivery”), and associated transport service providers. These logistics intermediaries are granted access to your data solely to execute courier routing, dispatch automated shipment tracking notifications, perform doorstep deliveries, reconcile cash or digital delivery transactions, notify status via sms/whatsapp and manage reverse pickups. They are contractually barred from utilizing your Personal Information for extraneous marketing or unrelated commercial pursuits.

To facilitate identity verification, two-factor authentication, automated security warnings, and critical operational updates, your mobile phone number and system-generated transactional messages are transmitted to our telecommunication service provider, Twilio Inc. (“Twilio”), and authorized SMS gateways. This data sharing is executed strictly to dispatch one-time passwords (OTPs), account verification codes, transactional order receipts, and delivery milestone alerts. Twilio processes such information in the capacity of a technical transmission pipeline governed by stringent telecommunications security covenants.

Our digital infrastructure, core application logic, encrypted file systems, relational databases, and server-side logs are hosted, deployed, and systematically maintained on Virtual Private Servers (VPS) and data center environments provisioned by MilesWeb Internet Services Private Limited. While your Personal Information resides on MilesWeb’s server hardware, MilesWeb operates purely as an infrastructure host and data custodian, without autonomous administrative authority to inspect, exploit, or disclose your personal data, and is bound to uphold enterprise-grade server security, firewall monitoring, and physical perimeter protections.

As described in Section 4, we transmit essential transactional identifiers, order amounts, and session validation tokens to Razorpay Software Private Limited to link your purchase carts with payment gateways, authenticate transaction states, reconcile billing accounts, and process customer-initiated refunds or chargeback disputes.

We transmit pseudonymized technical identifiers, interaction events, conversion actions (such as product page visits, items added to cart, and completed checkouts), cookie data, and device signatures to third-party marketing networks, notably Google LLC (Google Analytics 4) and Meta Platforms, Inc. (Meta Pixel). This transmission enables the compilation of aggregated site telemetry, attribution analysis, the delivery of behavioral and retargeted advertisements across external digital channels, and the formulation of lookalike audience profiles. These providers process information in conformity with their distinct data policies and technical specifications.

While the Company’s primary web hosting infrastructure and databases managed by MilesWeb are physically situated within the sovereign territory of the Republic of India, certain global service providers, infrastructure modules, and analytics pipelines (including services provided by Google, Meta, and Twilio) may route, transmit, process, or store data on cloud infrastructure, distributed servers, or facilities located outside India. In strict compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), cross-border transfers of personal data are legally permitted to international territories, except where explicitly restricted or blacklisted by notifications issued by the Central Government of India. The Company ensures that any overseas transfer of Personal Information is executed only with third-party processors that implement stringent technical safeguards, end-to-end cryptographic encryption, and organizational security protocols that match or exceed the protection levels mandated by Indian jurisprudence.

In the prospective event that Axiverse Ventures Private Limited undergoes any corporate reorganization, statutory restructuring, merger, demerger, acquisition, consolidation, spin-off, joint venture, assignment, asset sale, or transfer of all or a substantial portion of our business assets (including in connection with bankruptcy or insolvency proceedings), the Customer database, historical order archives, and accumulated Personal Information will constitute a transferable, intangible business asset. In such instances, the acquiring entity or surviving corporate body shall assume the rights and duties outlined in this Privacy Policy, and your data shall remain protected under terms no less restrictive than those established herein.

Notwithstanding anything contained to the contrary in this Policy, the Company reserves the express, unrestricted right to disclose Personal Information if mandated to do so by applicable statutory law, judicial summons, search warrants, court decrees, regulatory directives, or enforceable demands issued by law enforcement authorities, tax investigators, cybersecurity incident response teams (including CERT-In), or governmental bodies operating under lawful jurisdiction. Furthermore, we may disclose your Personal Information in good faith when we deem such disclosure reasonably necessary to investigate, prevent, or take enforcement measures against suspected electronic fraud, intellectual property infringements, cyber threats, breaches of our Terms Of Service, or to protect the safety, vital interests, property, and legal rights of the Company, our Customers, personnel, or the general public.

We will retain, archive, and preserve your Personal Information only for the duration that is reasonably requisite, strictly necessary, or otherwise explicitly permitted or mandated by applicable statutory law, regulatory requirements, or our overarching legitimate business purposes. The retention lifecycle of your Personal Information is meticulously governed by the principles of data minimization and purpose limitation as enshrined under the Digital Personal Data Protection Act, 2023. We may also retain your Personal Information for such extended periods as may be indispensable to fulfill the explicit purposes for which it was originally collected, including but not limited to, the satisfaction of any legal, administrative, accounting, auditing, dispute resolution, or other mandatory corporate reporting imperatives.

To provide absolute clarity regarding our data retention timelines, the Company enforces the following definitive schedules:

In strict adherence to our internal data minimization protocols and privacy-by-design architecture, should a Customer’s registered account remain dormant and entirely inactive—defined as a continuous, uninterrupted absence of authenticated logins, transactional engagements, or demonstrable browsing activity—for a period of five (5) years, the Personal Information, address logs, and profile metadata associated with that specific account shall be systematically purged, irreversibly deleted, or permanently anonymized such that it can no longer be attributed to or utilized to re-identify the Customer.

Notwithstanding the aforementioned account dormancy stipulations, and in rigorous accordance with binding statutory mandates under Indian jurisprudence—including, but not limited to, the Companies Act, 2013, the Central Goods and Services Tax (CGST) Act, 2017, the Information Technology Act, 2000, and applicable direct and indirect tax regulations—all completed order invoices, billing metadata, tax receipts, transaction logs, and associated financial records shall be mandatorily preserved, securely archived, and rendered accessible to regulatory authorities for a minimum statutory period of ten (10) years from the date of the respective purchase or transaction execution.

Throughout the designated retention lifecycle, your Personal Information is rigorously safeguarded against inappropriate access, unlawful interception, and unauthorized disclosure. We maintain, audit, and continually evaluate appropriate, adequate, and commercially reasonable administrative, technical, and physical safeguards specifically designed to protect your stored Personal Information hosted on our MilesWeb Virtual Private Servers against accidental, unlawful, or unauthorized destruction, loss, alteration, access, disclosure, or use.

Upon the expiration of the applicable statutory retention periods, or upon the lawful execution of a verified data erasure request submitted by the Customer (provided no overriding legal, judicial, or tax retention mandate exists), the Company shall undertake commercially reasonable, technologically feasible, and industry-standard steps to securely dispose of, permanently delete, or irreversibly de-identify your Personal Information, thereby rendering it permanently unrecoverable and stripping it of all personally identifiable attributes.

We, along with our authorized third-party service providers, systematically track your preferences, digital footprint, and transactional activities on the Platform. To facilitate this, we employ “Cookies,” local storage protocols, web beacons, and analogous tracking technologies. “Cookies” are small, encrypted data files or text payloads transferred to and stored upon your computer's hard drive or mobile device memory by a website, acting through your web browser (subject to your browser configurations and permissions). They meticulously maintain a chronological record of your activities on the Platform, rendering your subsequent visits to the site vastly more efficient, personalized, and technically seamless. The Cookies and local storage mechanisms may store a diverse array of technical and behavioral information, including, but not limited to, the frequency of your access to the Platform, authenticated session registration information, the number of times you view a particular page or product item, and specific user-interface preferences.

The deployment of cookies is an indispensable and universally adopted practice among digital commerce platforms intended to better serve clientele and ensure robust cybersecurity. We expressly categorize our utilization of cookies and tracking modules into the following functional domains:

• Strictly Necessary and Essential Cookies: These proprietary data files are technologically critical for the fundamental operation, navigation, and security architecture of the Platform. This category strictly encompasses session identification cookies, Cross-Site Request Forgery (CSRF) security tokens designed to prevent malicious cyber-attacks, user authentication state trackers to keep you securely logged in, and localized memory storage imperative for guest shopping cart persistence across multiple page loads.
• Analytical and Performance Cookies: We deploy sophisticated, trusted third-party analytical services—specifically Google Analytics (GA4)—which utilize analytical cookies to autonomously compile, aggregate, and evaluate data concerning site traffic volumes, user engagement metrics, scroll-depth thresholds, and interface interactions. This empowers us to continually optimize the Platform’s navigational architecture, diagnose systemic bottlenecks, and engineer superior user experiences.
• Advertising, Marketing, and Retargeting Cookies: We integrate specific marketing beacons and third-party tracking pixels—notably the Meta Pixel—to monitor and record granular conversion events (such as "Add to Cart," "Initiate Checkout," and "Purchase"). These cookies facilitate the compilation of behavioral profiles, allowing us and our third-party ad networks to orchestrate retargeted advertising campaigns, deliver tailored commercial impressions across external social media ecosystems, and generate statistically modeled lookalike audiences.

By continuing to access, browse, or otherwise utilize the Platform, you are affirmatively consenting to our deployment and execution of cookies as delineated in this Policy. Most contemporary web browsers are natively configured to automatically accept cookies; however, they can be easily modified to block, restrict, or actively alert you each time a cookie is being transmitted. You retain the absolute prerogative to manage your cookie preferences through your localized browser settings. You may consult your browser’s “Help” menu to ascertain the precise methodology for modifying or purging your cookie repositories.

If you voluntarily elect to turn off, block, or persistently reject all cookies, you acknowledge and accept that substantial technical features, personalized interfaces, and critical functionalities of the Platform will be severely disabled or rendered completely inoperable. Specifically, due to our reliance on essential session cookies and CSRF tokens for transactional integrity, disabling cookies will critically impair your ability to authenticate into your account, retain items within your active shopping cart, and successfully execute or complete the checkout and payment process.

We utilize third-party analytics services and sophisticated telemetry tracking ecosystems to comprehensively evaluate your use of the Platform, compile granular reports on user activity, collect demographic and interest-based data, analyze performance metrics, and systematically collect and evaluate other intelligence relating to the Platform, mobile, and internet usage. These authorized third-party entities employ cookies, web beacons, tracking pixels, and analogous proprietary technologies to help analyze site traffic, aggregate conversion data, and provide us with actionable commercial information. In certain instances, these third parties may correlate, cross-reference, or connect such information with other datasets held within their respective proprietary environments or across external advertising networks. You affirmatively consent to the processing of information about you by these analytics providers in the manner, and for the specific purposes, set out in this Policy.

At present, we integrate and work in conjunction with the following authorized analytic and marketing partners:

• Google LLC (Google Analytics 4): We utilize Google Analytics (GA4), a premier web analytics service provided by Google, to compile detailed data regarding Customer interactions, measure session durations, and track complex engagement metrics. Google uses first-party cookies and proprietary identifiers to track visitor interactions and evaluate web page movements. We may utilize Google's demographic, geographical, and interest reporting features to comprehensively understand our consumer base and optimize our Product offerings.
• Meta Platforms, Inc. (Facebook and Instagram): We deploy the Meta Pixel—a snippet of JavaScript code integrated into the Platform—to systematically track digital conversion events (such as instances where a Customer adds an item to their cart, initiates checkout, or finalizes a purchase), measure the efficacy and return-on-investment of our advertising campaigns, and deliver highly targeted, retargeted, and behavioral advertisements to our Customers across the Meta ecosystem (including the Facebook and Instagram applications) based directly on their previous interactions with our Platform.

The Customers retain the autonomy to govern and set preferences for how these third-party platforms deploy advertisements to them. You may actively adjust your personalized advertising preferences by utilizing the Google Ad Settings portal and navigating the Meta Ad Preferences dashboard situated within your respective social media accounts. Alternatively, you can systematically opt-out of pervasive third-party behavioral tracking by visiting the Network Advertising Initiative (NAI) Opt-Out page, utilizing the Digital Advertising Alliance (DAA) opt-out portals, or by independently downloading and installing the Google Analytics Opt-Out Browser Add-on to expressly prevent your analytical data from being collected, aggregated, or utilized by Google Analytics.

In the event that you voluntarily elect to submit, upload, or otherwise disseminate comments, product ratings, textual reviews, photographic endorsements, or any other form of user-generated content on our Platform, you acknowledge and expressly understand that any such information you choose to provide in these designated public spaces may be openly read, collected, scraped, aggregated, or utilized by third parties and the general public. While we display such content—typically accompanied by your submitted name or, in the absence thereof, your masked email identifier—to foster community trust and provide product insights, we are categorically not responsible for the personally identifiable information you proactively choose to submit within these public forums. Furthermore, we cannot guarantee, warrant, or ensure that unauthorized third parties have not created historical copies, cached versions, or will not exploit such publicly disclosed information in any manner, and you hereby release the Company from any liability arising from the third-party scraping or misuse of your voluntarily published content.

The Platform may, from time to time, feature, embed, or display hypertext links, affiliate banners, or routing mechanisms directing you to external digital domains, partner platforms, or social media ecosystems (e.g., Facebook, Instagram) that are entirely owned, operated, and maintained by independent third parties. Please possess the strict understanding that these external websites operate autonomously and are wholly independent of the Company. The Company exercises no administrative, editorial, or operational control over the content, tracking mechanisms, or data harvesting practices deployed on such external websites, even in instances where the Company ostensibly provides information, co-sponsorships, or Products to the owner of that respective website.

The Company does not make any representations, warranties, or endorsements regarding, nor do we accept any fiduciary or legal responsibility for, the accuracy of the content, the security protocols, or the privacy practices inherent to the use of such third-party websites. Consequently, once you navigate away from our Platform or are redirected to a third-party application, you are no longer governed by this Privacy Policy or our internal Terms Of Service. We shall not be held responsible or legally liable for any direct, indirect, consequential, or incidental damage, financial loss, or privacy infringement related to or arising from your access to or use of any third-party website. We strongly urge and actively encourage you to meticulously review the specific terms and conditions, as well as the independent privacy policies, of any third-party website prior to initiating access, transmitting data, or utilizing their services.

The Company places the highest priority on the integrity, confidentiality, and security of your Personal Information. We rigorously endeavor to protect your Personal Information against accidental loss, digital theft, unauthorized interception, unauthorized access, disclosure, copying, malicious use, or unlawful modification. To achieve this, we deploy a comprehensive, multi-layered security architecture comprising stringent administrative, technical, and physical safeguards appropriate to the sensitivity of the data being processed, regardless of the format in which it is held.

We incorporate and continuously monitor the following enterprise-grade security methodologies to safeguard your Personal Information:

Online transactional security is a paramount operational priority. All data transmitted between your internet browser and our server endpoints is systematically encrypted in transit utilizing advanced Secure Sockets Layer / Transport Layer Security (SSL/TLS - HTTPS) cryptographic protocols. Furthermore, highly sensitive credential data, such as your registered account passwords, are never stored in plaintext; rather, they are mathematically obscured within our databases using robust, one-way cryptographic hashing algorithms, rendering them inaccessible even to our internal administrative personnel.

Your Personal Information is strictly contained behind secured network perimeters and isolated database environments hosted on Virtual Private Servers (VPS) managed by MilesWeb. We rely on our infrastructure partner to implement commercial-grade firewalls, routine server hardening procedures, regular malware scanning, and intrusion detection systems specifically designed to protect our core servers and network topologies from unauthorized users, malicious botnets, and external tampering.

Access to the backend databases containing your Personal Information is fiercely restricted on a strict "need-to-know" and "least-privilege" basis. Such access is granted exclusively to a highly limited number of authorized personnel, system administrators, and vetted third-party service providers who possess special access credentials and are contractually bound by rigorous confidentiality agreements to maintain the absolute secrecy of the information.

While the Company operates as a digital-first entity, the physical server hardware housing your Personal Information is located within enterprise data centers managed by our hosting and infrastructure partners (MilesWeb). These facilities employ their own stringent physical access controls, including biometric restrictions, 24/7 surveillance, and alarm systems to prevent physical data breaches.

While we implement a variety of stringent security measures when a Customer enters, submits, or accesses their information to maintain the safety of their Personal Information, we must acknowledge the inherent vulnerabilities of the global internet ecosystem. No method of data transmission over the Internet, nor any method of electronic cloud storage, is unequivocally, 100% secure. Therefore, while we strive to use commercially acceptable and industry-standard means to protect your Personal Information, we cannot guarantee its absolute, mathematical security.

Consequently, the Company expressly disclaims any warranties, express or implied, regarding the ultimate security of your data. We shall not be held liable, under any circumstances, to any Customer or third party for any loss, damage (whether direct, indirect, consequential, incidental, punitive, or special), financial detriment, or harm caused to the Customer arising directly or indirectly out of data breaches, cyber-attacks, unauthorized access, malicious hacking, or the misuse of Personal Information by any unauthorized third party, provided the Company has adhered to its statutory data protection obligations under applicable Indian law. You acknowledge that you provide your Personal Information at your own calculated risk.

The Platform provides an explicit, accessible mechanism for all Customers to opt out of receiving any promotional, advertising, or marketing communications from the Company. If you no longer wish to receive commercial communications, newsletters, or marketing-related electronic mail and SMS broadcasts from us, you possess the unconditional right to opt out at any time. You may seamlessly execute this preference by clicking the designated “unsubscribe” link embedded at the bottom of any promotional email you receive from us. Alternatively, you can formally submit a written electronic request to opt out by contacting our support team at forestthread@gmail.com. Please note that even if you opt out of marketing messages, the Company reserves the right to continue transmitting strictly transactional, operational, and administrative communications pertinent to your active orders, account security, and legal notices.

In instances where the collection, processing, and/or disclosure of your Personal Information is predicated explicitly upon your informed consent (as identified within this Policy), you retain the absolute statutory right to withdraw this consent at any juncture. To execute a formal withdrawal of consent, you must transmit a written request to forestthread@gmail.com. Upon receipt and verification of such a request, we shall cease the processing of the applicable Personal Information. However, please be expressly advised that any data processing, sharing, or utilization that we have lawfully carried out prior to the formal withdrawal of your consent shall remain entirely lawful and valid. Furthermore, notwithstanding your request to withdraw consent, the Company may still retain and process specific fragments of your Personal Information if such retention is mandated to comply with our overriding legal obligations, resolve active disputes, prevent financial fraud, or enforce our contractual agreements.

In strict compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Company guarantees and facilitates the exercise of your fundamental data principal rights. As a Customer, you are legally entitled to the following:

• Right to Access and Summary: You possess the right to request and obtain a comprehensive summary of your Personal Information currently being processed by us, alongside the identities of all third-party Data Fiduciaries and Data Processors with whom such information has been shared.
• Right to Correction and Updating: You may request the immediate correction of any inaccurate, misleading, or obsolete Personal Information, as well as the completion of any incomplete data attributes associated with your profile. You can independently update your name, delivery addresses, and profile preferences by authenticating into your registered account and navigating to the account management dashboard.
• Right to Erasure (Right to be Forgotten): You have the right to request the permanent erasure, deletion, or de-identification of your Personal Information in circumstances where the data is no longer necessary for the purpose for which it was originally collected, or where you have successfully withdrawn your consent.

To assert and exercise any of the aforementioned statutory rights, you must submit a detailed, written electronic request directly to forestthread@gmail.com. The Company will endeavor to acknowledge and honor your verifiable requests within the legally stipulated timeframes. Please be cognizant that while we will take all commercially reasonable steps to purge your data upon a valid erasure request, our removal of your information from active production databases does not instantaneously eradicate all fragmented historical copies, encrypted archival backups, or residual internet "caches" that may temporarily persist due to systemic network architectures.

Please note that the Company systematically reviews and expressly reserves the unilateral right to amend, modify, update, or revise this Privacy Policy from time to time, at our sole and absolute discretion. Such modifications may be necessitated by evolving operational requirements, technological advancements, structural business changes, or mandatory compliance with new or amended legal, statutory, or regulatory frameworks (including, but not limited to, the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000).

When material changes or structural revisions are executed, we will publish the revised Policy directly on this designated web page. The Policy will include a prominently displayed “Last Updated” or “Effective Date” timestamp at the apex of the document, serving as formal public notice that you should review the newly instituted terms. The modified Privacy Policy will become legally binding and strictly effective immediately upon its publication and posting on the Platform, without the necessity of delivering individual electronic notices to each registered Customer.

We strongly encourage and actively urge all Customers to periodically revisit and meticulously review this page to remain comprehensively informed regarding our current data protection protocols, privacy practices, and any shifting contours of your data principal rights. By affirmatively continuing to access, browse, or utilize the Platform, or by engaging in commercial transactions with the Company following the publication of any such modifications, you unequivocally signify your informed consent, acknowledgment, and binding agreement, on a prospective basis, to the amended Privacy Policy and all new terms or changes contained therein. If you do not agree with the updated terms, your sole and exclusive remedy is to cease all use of the Platform and formally request the deletion of your account.

In strict compliance with the statutory mandates set forth under the Information Technology Act, 2000 (along with the applicable Information Technology Rules formulated thereunder) and the Digital Personal Data Protection Act, 2023 (DPDP Act), the Company has formally appointed a designated Grievance Officer / Data Protection Officer to address, investigate, and conclusively resolve any discrepancies, complaints, or inquiries raised by Customers regarding the processing of their data.

If you harbor any concerns, apprehensions, or grievances pertaining to the collection, processing, storage, handling, or disclosure of your Personal Information, or if you suspect any breach of the conditions stipulated within this Privacy Policy or applicable data protection statutes, you are strongly encouraged to register a formal complaint by contacting our designated officer.

Please direct all formal privacy-related correspondence, legal notices, and data principal requests to the following designated authority:

• Name of the Officer: Hrishikesh Paradkar
• Official Designation: Data Protection Officer (DPO) / Grievance Officer
• Corporate Ownership Entity: Axiverse Ventures Private Limited
• Corporate Identification Number (CIN): U62013MH2025PTC457316
• Goods and Services Tax Identification Number (GSTIN): 27ABDCA7946A1ZS
• Official Contact Email: forestthread@gmail.com
• Mandatory Subject Line for Correspondence: Data Privacy Grievance - ForestThread

To ensure the rapid and effective resolution of your concerns, the Company enforces a stringent internal grievance redressal mechanism. Upon the successful receipt of a written electronic grievance at the aforementioned email address, our Grievance Officer shall undertake the following procedural timeline:

• Acknowledgment of Receipt: The Company shall endeavor to formally acknowledge the receipt of your grievance or complaint within seven (7) business days from the date of initial transmission.
• Investigation and Final Resolution: The Grievance Officer shall subsequently initiate a comprehensive internal investigation into the matters raised and shall strive to provide a conclusive resolution, remedy, or detailed explanatory response within a maximum period of thirty (30) calendar days from the date of the initial acknowledgment.

In the unlikely event that your grievance is not acknowledged within the stipulated timeframe, or if you remain fundamentally unsatisfied with the resolution or remedy provided by our Data Protection Officer, you retain the unabridged statutory right to escalate the dispute and file a formal legal complaint with the Data Protection Board of India, or any other relevant regulatory or judicial authority possessing competent jurisdiction under applicable Indian law, to seek further adjudication and redressal.

The Platform and the Products offered by the Company are exclusively intended for access and use by individuals who have attained the legal age of majority as recognized under the Indian Majority Act, 1875 (i.e., eighteen (18) years of age or older) and are legally competent to form a binding contract under the Indian Contract Act, 1872. The Company does not knowingly solicit, collect, process, or maintain Personal Information from minors or children under the age of 18. All user registrations and transactions require active mobile phone OTP verification to validate user ownership and implicit legal competence. In the event that the Company inadvertently discovers or is notified that it has collected the Personal Information of a minor without verifiable, explicit consent from a parent or legal guardian, we shall initiate immediate, commercially reasonable measures to systematically purge and delete such data from our active servers and operational databases.

This Privacy Policy, alongside your access to and usage of the Platform, shall be exclusively governed by, construed, and interpreted in strict accordance with the substantive laws of the Republic of India, without regard to its conflict of law principles. Any disputes, grievances, claims, or legal controversies arising out of or in connection with this Privacy Policy, the handling of your Personal Information, or your use of the Platform, which cannot be amicably resolved through our designated Grievance Officer, shall be subject to the exclusive legal jurisdiction of the competent courts and tribunals situated in Mumbai, Maharashtra, India. By utilizing the Platform, you hereby expressly and irrevocably consent to the personal jurisdiction and venue of these designated courts.