GOAT™ Privacy Policy

Who this policy covers

This policy covers personal information submitted to this GOAT™ website, its customer dashboard, customer support and connected product/warranty functions. “GOAT”, “we” and “our” refer to the business operating this store, identified in the business details below. A brand name is not a substitute for the operator’s legal identity.

Use the business, support and grievance contacts below to reach the store operator. Separate external applications may provide their own notices; read them when leaving this website. We will explain a material new use before it starts and obtain consent where required.

Information you provide

Account information: name, email, mobile number, an encoded password verifier, account status and profile details. Delivery details include address, city and PIN code where you enter them.

Order and service information: products, quantities, order status, invoice references, purchase dates, seller details, fault descriptions, correspondence, requested transport options and support decisions. Warranty records may include a GUPI/serial, registration reference and confirmed coverage dates.

Optional updates: the email address and signup record you provide when separately subscribing. Please do not include Aadhaar/PAN copies, card details, passwords, UPI PINs, OTPs or unrelated health information in general forms. This website does not request your microphone, contacts, music history or precise location.

Technical and account activity

The service receives connection information such as an IP address to handle requests and limit abuse. Customer activity records include account creation, sign-in, profile, order and warranty events. Authentication uses session records; password recovery uses limited-duration reset records.

In the current local build, bag contents and saved product IDs are stored in your browser. Operational records are stored on the computer running the backend. We do not claim that every page view is profiled or that advertising analytics are present; none are included in the current build.

Why GOAT uses information

We use the details relevant to creating and protecting your account, maintaining orders and service requests, responding to you, verifying eligible warranty records, preventing misuse and complying with applicable obligations. Account access cannot be provided without necessary account details.

Consent is requested where required. Other processing may occur where applicable law permits it, including necessary legal compliance. We do not treat accepting this policy as unlimited consent for unrelated uses. If the purpose changes materially, we will update the notice and seek fresh consent where necessary.

Your account consent and marketing choices

The registration notice asks for permission to use your name, email and mobile number to create/manage the account and provide requested service communications. The affirmative acceptance and policy revision are recorded when you register. Account registration does not subscribe you to promotional marketing.

Newsletter signup is a separate choice. You can ask support to withdraw promotional consent without losing warranty rights. In the current preview, subscriptions are saved but marketing messages are not sent. Live marketing must include a usable unsubscribe route before sending starts.

GUPI verification and connected warranty services

Anyone who enters a complete GUPI can check whether that code matches a GOAT product record and whether it has already been registered. For an already-registered code, the result may also show the purchase date and the registered customer’s masked name. Missing or invalid source details are shown as unavailable, never invented. Masking reduces exposure but does not make the information fully anonymous; someone who knows the code may recognise the registration.

The public lookup does not show a full customer name, phone number, email address, delivery address, invoice document, registration ID or private dashboard data. GOAT further masks the name before returning it to the browser. A matching code alone does not establish ownership or conclusively authenticate a physical item; a copied or mistyped code needs support review. An unrecognised code is not, by itself, a final counterfeit finding.

Where enabled, the connected warranty service collects relevant product/purchase details and may verify your mobile number by OTP. Confirmed registration ID, product and coverage information can return to your signed-in dashboard. The notice shown before registration must explain the limited public GUPI display. The external service must align its notices and treatment of existing records before connection; changing this policy does not retroactively create customer consent.

Live verification and warranty connections await their configured API services. A return visit to the website alone is not proof of completed registration. Do not disclose your OTP outside the intended verified registration flow.

Who can receive information

Only authorised GOAT staff and necessary service providers may process customer information for the account, order, warranty, delivery or support service requested, under appropriate confidentiality and access restrictions. That operational processing is not permission to sell information or disclose it to unrelated outsiders. The current integrations and their launch limits are described elsewhere in this policy.

GOAT does not sell or rent customer data, publish full customer records, or voluntarily disclose private records to marketers, other customers, private investigators or unrelated businesses. Customers may obtain their own information after appropriate verification. The limited public GUPI display and legally compelled disclosures are explained separately below.

Government requests and legally compelled disclosure

GOAT does not release private customer records merely because a person, organisation or purported government official asks. A government or law-enforcement demand must be verified and supported by a valid court order or another binding requirement under applicable law. Where the law requires a court order, that order must be obtained before disclosure. GOAT cannot promise to disregard a statutory demand that is binding without a court order.

Before releasing information, GOAT requires its authorised responsible person to verify the requesting authority, authenticity, legal basis, jurisdiction, case/request reference, specified customer/account identifiers, requested fields and period, and the authorised recipient. An informal call, unverified email, personal messaging account or unsupported assertion of official status is not sufficient.

Only the minimum responsive information lawfully required is to be provided through a verified secure channel to the authority or recipient legally entitled to receive it. An individual request does not authorise release of the entire customer database or unrelated customer records. A request that is unclear, excessive or outside the requester’s power must be clarified, narrowed or challenged where legally permissible.

GOAT requires a restricted disclosure record documenting the demand, verification, approval, scope, date and recipient. The affected customer should be notified when lawful and appropriate; notice may be withheld or delayed where legally prohibited or where it would unlawfully prejudice proceedings. These are the required handling procedures, not an automated government-access system. Government agencies have no public or unrestricted dashboard access.

Payment information

The local website does not collect payments or request full card details, CVV, bank passwords or UPI PINs. If a payment gateway is introduced, its identity and relevant privacy terms must be disclosed before checkout. GOAT should receive only the transaction information required for order and refund handling, not a customer’s secret payment credentials.

Cookies and browser storage

Customer and administrator sign-in use separate HTTP-only, SameSite session cookies with an eight-hour lifetime. They support authentication, not advertising. Production configuration adds the Secure flag for HTTPS. Browser storage remembers your bag and saved favourites until you clear it or remove the items.

You can clear cookies/storage through browser settings; doing so may sign you out and remove saved preferences. The current build contains no third-party advertising cookies or analytics trackers. Optional tracking must not be introduced silently; a separate choice and updated notice are required where applicable.

Security throughout the data lifecycle

The application stores passwords as salted, one-way password hashes rather than readable passwords. Session tokens are represented by hashes on the server, private dashboard access is checked against the signed-in customer, and sensitive administrator functions require administrator authentication.

The application also uses request validation, origin checks, rate limits and browser security headers. Password-reset links are single-use, expire after ten minutes and invalidate existing customer sessions when successfully used. These controls reduce risk; they do not make any system immune to compromise.

This is not an end-to-end encrypted messaging service: authorised service systems must process relevant customer information. The local database is not encrypted by this application, and localhost is not a public HTTPS deployment. Before launch, the operator must configure HTTPS, host/disk and backup protection, restricted staff access, recovery procedures and security monitoring. We will not represent those operational measures as completed merely because this policy exists.

Retention, deletion and backups

Information should be kept only for the active purpose and applicable legal, tax, warranty, dispute or security requirements. Account details support the account; purchase and service records may need to remain after account closure for a specific legal or unresolved-service reason. Marketing preferences should be honoured when withdrawn.

You may request deletion or closure through support. We will verify the request proportionately, explain any record that must be retained and restrict its further use to the retention reason. Deleting a browser cookie does not delete server records.

There is no blanket automatic deletion schedule in the current local build. Retention periods and backup-expiry schedules must be confirmed and implemented before launch. Test information remains in the local database until removed by the operator; requests are reviewed manually. We do not promise instant deletion from all backups.

Your choices and requests

Contact GOAT to request access to your information, correction, account closure, deletion, consent withdrawal or information about relevant sharing. Applicable statutory rights—including grievance and nomination rights when in force—remain available. You can edit supported profile fields in your account.

Use the support form with the subject “Privacy request”, preferably from your registered email. We may ask for reasonable verification before disclosing or changing personal records. We will never require your password or OTP in a support message. If a request cannot be fulfilled, we will explain the reason and available escalation. Withdrawing necessary account-processing consent may mean the affected account service can no longer operate; it does not remove statutory purchase rights.

Children and sensitive information

The store is intended for adults able to enter a valid purchase/account arrangement. We do not knowingly target children with behavioural advertising or invite children to submit personal information independently. A parent or guardian should handle purchases and service requests for a child.

If you believe a child’s information has been submitted inappropriately, contact GOAT so it can be reviewed and removed or otherwise handled as required. Any future child-specific service must introduce appropriate age/parental-consent safeguards before launch.

Hosting, transfers and external links

The current preview stores operational data on the computer running the backend. Public hosting locations and external processors have not yet been finalised. We do not claim that all future processing will stay in India or that an overseas transfer is already occurring.

Before activating a provider or international transfer, GOAT must check applicable restrictions, safeguards and notices. External sites and apps may process information under their own notices; linking to them is not a promise about every aspect of their security.

Security incidents and complaints

Report suspected account misuse or a privacy incident promptly through GOAT support or the listed privacy/grievance contact. Avoid sharing sensitive data in public comments. We will assess the report, take appropriate containment steps and notify affected people or authorities where applicable law requires.

Privacy requests and consumer complaints can be escalated to the grievance contact below. Applicable legal response periods take priority; the consumer grievance standard is acknowledgment within 48 hours and redress within one month. An internal complaint process does not remove access to a competent statutory authority.

Updates and applicable law

The revision and publication date identify this notice. Material changes should be communicated through an appropriate notice; new uses needing consent require that consent. Updates do not retrospectively validate an unrelated use or erase an earlier commitment.

Indian data-protection requirements, including the Digital Personal Data Protection Act and rules, have phased commencement. We will honour applicable requirements as they come into force. This policy does not claim certification, a completed compliance audit or that every future legal provision is already operative.

Governing law and jurisdiction

These terms are governed by Indian law. Subject to mandatory law, courts of competent jurisdiction in Bengaluru, Karnataka have exclusive jurisdiction over contractual disputes. This does not restrict your right to approach a competent consumer commission, data-protection authority or other statutory forum, including a forum available where you reside or work, where the law permits. No provision waives a non-excludable consumer right.

Retrieving existing warranty registrations

To retrieve previous registrations, sign in and request an OTP for the mobile number in your GOAT profile. By choosing to retrieve your warranties, you authorise GOAT to query registrations for that verified mobile and save private copies in your account. Your OTP and short-lived ownership proof are used for verification; the proof remains on the server and expires. An email match or a public GUPI lookup alone does not grant access to private records.

Copies include the registration ID, GUPI, product/colour names, invoice reference, purchase date and saved coverage dates where available. Missing historical coverage is shown as unavailable, not calculated. A saved registration is not approval of a service claim. Saved copies can remain available after verification expires; request a new OTP to retrieve more records. Contact GOAT support for corrections or account-data requests.