Privacy policy
Last updated: 5 September 2026
What we collect
We collect the name, email address, phone number and delivery or billing address you provide, your ordered items, order history, payment references and payment status. Essential technical logs may contain request times, IP addresses and device or browser information. We also store your shopping bag, wishlist, theme preference and sign-in session in your browser.
Why we collect it
We use contact details to verify your sign-in, confirm purchases and answer support requests; addresses to deliver your orders; order and payment records to reconcile payments, process refunds and meet accounting obligations; and limited technical information to prevent abuse and operate the service reliably.
Payments and service providers
Razorpay processes payment details through its checkout. We receive payment references, status, method and limited contact information; we do not receive or store your full card number, CVV or UPI PIN. Necessary information is shared with delivery providers, email providers and our hosting, database and storage providers to perform their services. These providers may process data outside India under their service terms and applicable safeguards.
Marketing choices
Marketing subscriptions are optional and separate from checkout. We send product or promotional updates only when you opt in. You can withdraw marketing consent through the unsubscribe option or by contacting support. Transactional messages about sign-in, orders, deliveries or refunds may still be sent where needed to fulfil your request.
Storage and retention
We keep account and order data for as long as needed to fulfil orders, provide support, resolve disputes and meet legal or accounting requirements. Login codes expire after ten minutes and are stored as hashes. Signing out removes the active session from your browser. Browser storage used for your bag and wishlist can be cleared in your browser settings.
Your requests and choices
Contact shop@crabtile.com to request access, correction or deletion of your personal data, withdraw consent where applicable, or raise a privacy complaint. We may verify your identity before acting. Some transaction records may need to be retained to meet legal obligations. We do not sell your personal data.
Children and updates
This service is intended for adults. We do not knowingly solicit personal data from children without appropriate parental involvement. We may update this policy when our practices change and will display the current version here.