Privacy Policy

When you place an order we store:

• Your name, mobile number and email address
• Your hostel and room number, so we can deliver
• The 12-digit UTR reference for your UPI payment
• What you ordered, the sizes, and the amount

If you create an account we also store your name and email address, and your password only in scrambled (hashed) form: nobody at 90 Minutes can see it, which is why we can send you a reset link but never tell you what your password was.

We do not receive or store card numbers, bank credentials or UPI PINs. Payment happens entirely inside your own UPI app; all we see is the reference number you give us.

Your cart, your chosen colour theme, your recent searches and a partially filled checkout form are kept in your browser's local storage so they survive a refresh. They stay on your device and are never sent to us except as part of an order you submit. Clearing your browser data removes them.

Signing in to your account sets a login cookie so you stay signed in on that device until you sign out. Signing in to the admin panel sets one session cookie. There are no advertising or analytics cookies.

Purely to fulfil your order: to verify the payment, deliver to the right room, and contact you if there is a problem. We don't sell your data and we don't send marketing you didn't ask for.

• Supabase — hosts the database holding orders and the product catalogue, and runs sign-in for accounts, including the confirmation and password reset emails.
• ImageKit — hosts product images. It receives no customer data.
• Our delivery helper — sees your name, hostel address and phone number, and only that.

Order records are kept for one year so we can handle disputes, then deleted.

You can ask us for a copy of the data we hold about you, ask us to correct it, or ask us to delete it (your account included) once any open order is complete. Write to us from the email on your account and we'll action it within 30 days.

Privacy questions or a deletion request: get in touch.