PRIVACY POLICY
Last updated: 25 October 2026
- We collect only what we need to sell, deliver, track and support your orders.
- We never sell your data, show ads based on it, or use tracking cookies.
- Your bag and recent order IDs stay in your own browser.
- You can see, correct or delete your data, withdraw consent and complain — we answer within 30 days, and never later than 90 days.
1. Who we are
8586.in is run by 8586 (“we”, “us”). For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) we are the Data Fiduciary: we decide why and how your personal data is used. This policy covers our website 8586.in, our order and contact forms, and orders, deliveries, returns and support connected with them.
- Seller
- 8586
- Website
- 8586.in · Instagram @eight58six
- Customer care
- contact form — we reply by email
- Complaints
- Handled by our customer care team — acknowledged within 48 hours
2. What we collect and why
| What | When | Why we use it |
|---|---|---|
| Name, mobile number (mandatory), email (optional), delivery address, PIN code, order note | When you place an order | To confirm (call/SMS), pack, ship and deliver the order; to let you track it; to handle returns, exchanges and refunds; to keep invoice and tax records |
| Products, sizes, quantities, prices, order ID and status | When you place an order | Same as above, and to keep a simple customer record linked to your mobile number (number of orders, last order) so we can help you faster |
| Name, mobile number, email, your message, ticket number | When you use the contact form | To reply to you, track your request, and handle complaints and privacy requests |
| Order ID or ticket number + mobile number | When you use Track order | Only to find and show your order or ticket status. Not stored, except a short-lived counter (1 hour) to stop abuse |
| Bank account or UPI ID | Only if you ask for a Cash on Delivery refund | Only to send the refund; deleted once it is complete |
| IP address, browser and device type, pages requested | Automatically, when you open the site | Kept in our hosting provider’s security logs to deliver the site and protect it from attacks |
We do not collect card numbers, UPI PINs, passwords, Aadhaar or any government ID, and we do not knowingly collect sensitive details such as health information.
3. Our legal basis
- Legitimate use for the purpose you provided it (Section 7(a), DPDP Act): when you voluntarily give your details to place an order or send a message, we use them for that purpose.
- Consent (Section 6): for anything else, we will ask first, clearly and separately, with an option to say no. We do not use pre-ticked boxes. Right now we do not send marketing messages at all.
- Legal obligations: for example keeping invoices and accounts as tax laws require, or responding to lawful requests from authorities.
4. Cookies and storage on your device
We do not use advertising or analytics cookies, tracking pixels or third-party trackers. Our site stores a few items in your own browser (local storage), which never reach us unless you submit a form:
- your bag (products, sizes, quantities);
- your last order (only for the order-placed page, cleared when you close the tab);
- a list of your recent order and ticket IDs (with date, amount and item names — never your phone or address), so Track order can fill them in for you.
You can clear these at any time by clearing your browser’s site data. Our fonts are loaded from Google Fonts, which receives your IP address to deliver them.
6. Processing outside India
Some of our service providers (such as Google and Cloudflare) may process data on servers outside India. The DPDP Act allows this unless the Central Government restricts transfers to a particular country; we will follow any such restriction.
7. How long we keep it
| Data | Kept for |
|---|---|
| Orders and invoices | As long as Indian tax and accounting laws require (currently up to 8 years), then deleted |
| Customer record linked to your mobile number | 3 years after your last order, then deleted |
| Contact messages and tickets | 12 months after the ticket is resolved, unless they are part of an open order, claim or legal matter |
| Bank or UPI details for a refund | Deleted within 30 days after the refund is complete (we keep only the transaction reference) |
| Track order abuse counter | 1 hour |
| Hosting security logs | As set by our hosting provider, and at least as long as the DPDP Rules require |
8. Your rights
Under the DPDP Act you can:
- Access — get a summary of the personal data we hold about you, how we use it, and who we have shared it with (Section 11);
- Correct, complete or update it (Section 12);
- Erase it, when it is no longer needed for the purpose or a legal duty (Section 12);
- Withdraw consent at any time, as easily as you gave it — this does not affect what was done before, and we may not be able to complete an order without the details it needs (Section 6);
- Complain to us and get it resolved (Section 13), and then to the Data Protection Board of India;
- Nominate someone to exercise these rights if you die or cannot act yourself (Section 14).
How to ask: send the contact form starting your message with “Privacy request”. To protect you, we confirm it is you by your mobile number plus an order ID or ticket number, or by replying to the email address we hold. There is no fee. We acknowledge within 48 hours and reply within 30 days — and never later than 90 days, the maximum allowed under the DPDP Rules, 2025.
9. Your responsibilities
Please give us correct details, use your own mobile number or one you are allowed to use, and do not impersonate anyone. The DPDP Act also asks people not to file false or frivolous complaints (Section 15).
10. How we protect it
- The site runs only over HTTPS (encrypted).
- Records are kept in private Google accounts protected by 2-step verification, and only our authorised team can open them.
- Track order needs both the order or ticket ID and the matching mobile number, limits repeated attempts, and shows only the status, items and city — never your full address.
- We do not store card or UPI details, and spam protection guards our forms.
If a breach happens, we will tell affected customers without delay in plain language: what happened, the likely impact, what we are doing about it, what you can do to stay safe, and whom to contact. We will also report it to the Data Protection Board of India as the DPDP Rules require.
11. Children
Our products and website are meant for adults. If you are under 18, please ask a parent or guardian to place the order or send the message for you. We do not knowingly collect children’s data without verifiable consent from a parent or guardian, and we do not track children or show them targeted ads. If we learn we have such data, we will delete it.
12. Laws we follow
This policy is written to meet the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (notified on 14 November 2025 and coming into force in phases — we follow them now), along with the Information Technology Act, 2000 and its rules where they still apply, and the Consumer Protection (E-Commerce) Rules, 2020.
13. Questions & complaints
For any question or complaint about your personal data, write to us through the contact form. If you are not satisfied with our answer, you can complain to the Data Protection Board of India under the DPDP Act. See grievance redressal for the full process.
14. Changes to this policy
If we change this policy, we will update the date at the top of this page. If a change affects how we use data you have already given us, we will tell you, and ask for consent again where the law requires it.