Privacy policy

OFFNOTE PRIVACY POLICY

Brand: Offnote

Legal entity: BARELAB ORGANICS PRIVATE LIMITED

Registered office: 514/18, Office No. 202, Deep Plaza Complex, Opp. Civil Court, Gurgaon - 122001, Haryana, India

CIN: U47722HR2026PTC143460

Effective date: [15 Aug 2026]

Last updated: [06 Aug 2026]

1. Scope

This Privacy Policy explains how BARELAB ORGANICS PRIVATE LIMITED ("Barelab", "we", "us" or "our"), operating the Offnote brand, collects, uses, stores, analyses, shares and otherwise processes personal data when you visit or use the Offnote website, create or use an account, place an order, make a payment, submit a review or claim, contact us, participate in a promotion or otherwise interact with Offnote.

This Policy applies to personal data collected digitally and to information collected offline and subsequently digitised in connection with these activities.

2. Data Fiduciary and service-provider roles

BARELAB ORGANICS PRIVATE LIMITED is the Data Fiduciary for the Offnote website and direct customer relationship. We determine the purposes and principal means of processing and remain responsible for our obligations under applicable Indian data-protection and consumer laws.

NeuralCore Dynamics Private Limited is our principal customer-data and technology processor. All consumer data collected by or made available to Barelab through the Offnote website, accounts, orders, support channels and connected services may be routed to, stored in, organised, analysed or otherwise processed within NeuralCore systems on our documented instructions. NeuralCore may provide data infrastructure, reporting, analytics, customer segmentation, personalisation, automation, customer-support integrations, fraud monitoring and related services.

Certain data is also processed directly by the following providers for their respective functions:

- Shopify Commerce Singapore Pte. Ltd.: website hosting, storefront, cart, customer accounts, order administration, security, analytics and related e-commerce infrastructure;

- GoKwik Commerce Solutions Private Limited: checkout, login and OTP authentication, address pre-fill, order creation, checkout optimisation, payment gateway services, payment-processing interface, transaction status, COD verification, fraud and return-to-origin risk analysis, checkout recovery and transaction-related communications;

- Delhivery Limited: pickup, transportation, delivery, tracking, delivery authentication, COD handling, reverse logistics and shipment claims; and

- banks, card networks, UPI participants, regulated payment aggregators and other payment-system providers: payment authorisation, fund transfer, settlement, refunds, chargebacks, fraud prevention and legal compliance.

Although GoKwik Commerce Solutions Private Limited provides the customer-facing checkout and payment gateway services used by us, payment authorisation, custody, transfer or settlement of funds may be performed by banks and regulated payment-system participants connected through the GoKwik service.

A service provider may independently determine limited processing purposes required for its own legal compliance, security, fraud prevention or a separate consumer service. For such independent processing, its own privacy notice may also apply. No third-party term reduces Barelab's responsibility for its own processing or any non-waivable customer right.

3. Personal data we collect

Depending on how you interact with Offnote, we may collect the following categories of personal data.

A. Identity and account data

- full name, username, account identifier and age confirmation;

- password or authentication information in encrypted, hashed or tokenised form;

- profile details, saved addresses, preferences, wishlists, loyalty information and account settings; and

- login, OTP and account-verification records.

B. Contact and delivery data

- email address and telephone number;

- billing and delivery address, PIN code and delivery instructions;

- communication preferences and consent records; and

- social-media handle or other contact identifier when you contact us through another service.

C. Order, checkout and transaction data

- products viewed, selected, purchased, returned or refunded;

- order number, order history, basket value, price, discount, taxes, shipping and COD charges;

- payment method, payment status, transaction reference, payment token and limited payment metadata supplied by GoKwik or the relevant payment provider;

- COD verification, risk-review and return-to-origin indicators;

- invoice, dispatch, delivery, cancellation, replacement, refund, chargeback and store-credit records; and

- customer-support and dispute-resolution records.

We do not ordinarily receive or store complete card numbers, CVV, UPI PINs or internet-banking passwords. These credentials are processed within the secure systems of the relevant payment participants.

D. Technical, device and security data

- IP address, device type, device identifiers, browser, operating system and language;

- screen, network, time-zone and connection information;

- cookies, pixels, SDK identifiers, local storage and similar technologies;

- application, server, login, authentication and error logs; and

- fraud, abuse, bot, account-security and transaction-risk signals.

E. Website-use and analytics data

- pages, products and content viewed;

- searches, clicks, scrolling, navigation paths and time spent;

- cart additions and removals, checkout steps, abandoned carts and conversion events;

- referral source, campaign, advertisement and affiliate attribution;

- email openings, message delivery, link interactions and communication response data;

- website performance, crash, error and diagnostic information; and

- audience, traffic, cohort and aggregated performance statistics.

F. Preferences, profiles and inferred data

- fragrance preferences, scent families and product interests;

- wishlist, purchase, browsing and response patterns;

- reviews, ratings, survey responses and feedback;

- customer segments and inferred product or communication interests; and

- marketing, personalisation and cookie choices.

G. Customer-service and claim data

- emails, messages, chats and call records;

- complaints, grievances, claim descriptions and resolution history;

- photographs and videos submitted for damage, defect, leakage, missing-item, delivery or authenticity claims; and

- supporting documents and account-verification information.

H. Location data

- billing and delivery addresses;

- approximate location derived from IP address, PIN code or network information; and

- precise device location only where a feature requires it and you grant the applicable permission.

I. Information received from third parties

We may receive information from NeuralCore Dynamics Private Limited, GoKwik Commerce Solutions Private Limited, Shopify Commerce Singapore Pte. Ltd., Delhivery Limited, payment providers, banks, marketplaces, quick-commerce platforms, customer-support providers, analytics and advertising providers, fraud-prevention providers, referral partners, publicly available sources and another person placing an order for you.

4. How we collect personal data

We collect personal data directly from you, automatically through the website and connected technologies, from our service providers and commercial partners, when another person places an order for you, and when you interact with Offnote through support, social media, advertising or another channel.

5. Purposes of processing

We may process personal data for the following specified purposes:

- creating, administering, authenticating and securing accounts;

- operating the website, cart, checkout and payment flow;

- confirming payment, issuing invoices and processing COD orders;

- packing, shipping, delivering, tracking and completing orders;

- processing cancellations, returns, replacements, refunds, chargebacks and store credit;

- responding to questions, complaints, claims and grievances;

- detecting fraud, abuse, unauthorised access, payment risk and return-to-origin risk;

- maintaining transaction, tax, accounting, security and audit records;

- personalising products, content, offers and recommendations, subject to applicable consent and settings;

- measuring traffic, conversion, campaigns, website performance and customer engagement;

- improving products, services, communications, operations and customer experience;

- sending transactional, security and service communications;

- sending marketing and advertising communications where you consent or where otherwise lawfully permitted;

- creating and measuring advertising audiences, attribution and retargeting where permitted;

- complying with legal obligations, lawful authority requests and the establishment or defence of legal claims; and

- supporting a lawful investment, financing, merger, reorganisation, acquisition, insolvency or transfer of the Offnote business.

6. Consent and withdrawal

Where processing is based on consent, we will seek a clear affirmative indication appropriate to the purpose. Consent for optional marketing, non-essential analytics, advertising and personalisation will not be treated as necessary for completing an order unless that processing is genuinely required for the requested service.

You may withdraw consent or change applicable preferences by using available account or communication controls or by contacting support@barelabs.in. Withdrawal will not affect processing lawfully completed before withdrawal. We may continue to retain or process data where required or permitted by law, including to complete an order, maintain statutory records, prevent fraud or resolve a dispute.

7. Cookies and similar technologies

We and our authorised providers may use cookies, pixels, tags, SDKs, local storage and similar technologies for website operation, login, cart, checkout, payment, security, fraud prevention, analytics, performance measurement, personalisation and advertising.

Strictly necessary technologies may be required for the website or requested service to function. Non-essential analytics, personalisation and advertising technologies will be used subject to applicable law and consent choices.

8. Automated analysis and profiling

NeuralCore Dynamics Private Limited, GoKwik Commerce Solutions Private Limited, Shopify Commerce Singapore Pte. Ltd. and other authorised providers may use automated tools to analyse website activity, checkout behaviour, purchase history, product interests, marketing engagement, customer segments, delivery outcomes, fraud indicators and return-to-origin risk.

This processing may be used to personalise content, measure conversion, prioritise support, reduce fraudulent or high-risk orders, improve delivery success and determine the relevance or timing of communications. We do not intend to make a decision based solely on automated processing that produces a legal or similarly significant effect without appropriate review and safeguards.

9. Sharing personal data

We may share personal data with:

- NeuralCore Dynamics Private Limited for customer-data processing, infrastructure, analytics, reporting, segmentation, personalisation, automation, support integrations, fraud monitoring and data management;

- GoKwik Commerce Solutions Private Limited for checkout, authentication, address pre-fill, order creation, payment gateway services, payment status, COD verification, risk analysis, checkout recovery, refunds and transaction-related support;

- Shopify Commerce Singapore Pte. Ltd., its affiliates and subprocessors for website hosting, storefront, accounts, cart, e-commerce administration, security, order management, analytics and other enabled Shopify services;

- Delhivery Limited and other logistics providers for pickup, routing, delivery, verification, tracking, COD handling, reverse logistics and shipment claims;

- banks, card networks, UPI participants, regulated payment providers and financial institutions for payment authorisation, fund transfer, settlement, refunds, chargebacks, fraud prevention and regulatory compliance;

- communications, customer-support, cloud, cybersecurity, analytics, attribution and advertising providers for services enabled by us and subject to applicable consent requirements;

- auditors, insurers, lawyers, accountants and other professional advisers;

- government, law-enforcement, tax, judicial and regulatory authorities where disclosure is lawfully required; and

- an investor, purchaser or successor in connection with a permitted financing, restructuring, merger, acquisition or business transfer.

We require processors to use personal data only for authorised purposes and to apply appropriate confidentiality, security and data-protection safeguards. We do not sell personal data for direct monetary consideration. We may share limited or pseudonymous identifiers with analytics and advertising providers where permitted by law and consistent with applicable consent choices.

10. Third-party terms and independent processing

A third-party provider may have its own terms and privacy notice where you directly use its feature or where it independently determines a processing purpose. These third-party documents apply only to the relevant independent service and do not replace this Policy or reduce any non-waivable right against Barelab.

For most privacy requests relating to an Offnote order or account, contact Barelab at support@barelabs.in. A provider may separately require you to contact it for processing it independently controls.

11. Cross-border processing

Barelab and its authorised processors, affiliates and subprocessors may process or store personal data in India or another jurisdiction where their infrastructure, personnel or service providers are located. Shopify and its subprocessors may process data outside India, including in Singapore, Canada, the United States and other service locations.

Cross-border processing will be subject to applicable Indian law, government restrictions and reasonable contractual, technical and organisational safeguards.

12. Data security

We use reasonable technical and organisational safeguards appropriate to the nature and risk of processing, which may include access controls, role-based permissions, encryption in transit and where appropriate at rest, password hashing, logging, monitoring, backup, recovery, vulnerability management, processor obligations and employee confidentiality requirements.

No method of electronic transmission or storage is completely secure. We cannot guarantee absolute security, but we will take reasonable measures to protect personal data and respond to incidents.

13. Personal-data breach response

Where a personal-data breach occurs, we will coordinate with the affected provider to investigate, contain, remediate and document the incident. We will notify affected individuals and relevant authorities where required by applicable law and provide information reasonably necessary for individuals to protect themselves.

14. Data retention

We retain personal data only for as long as reasonably necessary for the stated purpose or to comply with law. In general:

- account information is retained while the account remains active and for a reasonable period afterwards;

- orders, invoices, payments, refunds, taxes and accounting records are retained for applicable statutory periods;

- support, complaint and grievance records are retained for the period needed to resolve and defend claims;

- marketing data is retained until consent is withdrawn or the data is no longer reasonably required;

- identifiable analytics data is ordinarily retained for up to 24 months, subject to provider configuration and legal requirements;

- security and processing logs are retained for the period required for security, audit and applicable law; and

- anonymised or aggregated information may be retained for longer where it no longer reasonably identifies an individual.

When retention is no longer necessary, we will delete, anonymise or securely isolate the information, subject to technical and legal limitations.

15. Your rights and requests

Subject to applicable law and the commencement of the relevant statutory provisions, you may request access to or a summary of your personal data, information about processing and recipients, correction, completion, updating, erasure, withdrawal of consent, cessation of consent-based marketing, grievance redressal and nomination of another person to exercise applicable rights in the event of death or incapacity.

We may verify your identity before acting on a request. We may retain or continue processing information where required or permitted by law, including for statutory records, fraud prevention, security, dispute resolution or legal claims.

Submit requests to support@barelabs.in.

16. Children

The Offnote website and direct purchasing facilities are intended for persons aged 18 years or older. We do not knowingly seek to collect personal data directly from a child. A parent or lawful guardian should place an order on behalf of a person under 18.

If you believe a child has provided personal data without appropriate parental involvement, contact support@barelabs.in.

17. Marketing communications

You may opt out of marketing using the unsubscribe or opt-out mechanism provided in the communication, available account settings, or by contacting support@barelabs.in. You may continue to receive non-promotional communications required for an order, refund, security notice, account administration or legal compliance.

18. Changes to this Policy

We may update this Privacy Policy to reflect changes in law, technology, products, partners or business practices. The updated version will be published with a revised last-updated date. Where a material change affects an existing consent or materially changes the purpose of processing, we will provide an appropriate notice and seek fresh consent where required.

19. Privacy and grievance contact

Data Fiduciary: BARELAB ORGANICS PRIVATE LIMITED

Brand: Offnote

Registered office: 514/18, Office No. 202, Deep Plaza Complex, Opp. Civil Court, Gurgaon - 122001, Haryana, India

CIN: U47722HR2026PTC143460

GSTIN: 06AAOCB5898G1Z3

Privacy / Grievance Officer: Sanjeet Kumar

Email: support@barelabs.in

Telephone: +91-8929966066

We will acknowledge and resolve privacy grievances within the period prescribed by applicable law.